A method, apparatus, and computer instructions for managing email messages. Outgoing packets are monitored. The outgoing packets are parsed for outgoing email messages. An identification of recipients in packets for outgoing email messages is made. A list of email addresses is updated with email addresses for the identified recipients, wherein the list of email addresses is used to accept incoming email messages. The outgoing packets also are parsed to identify Web traffic containing a user email address. A domain name of the destination is identified for Web traffic containing the user email address. The list of email messages is updated with this domain name. Incoming email messages are screened to see if the domain name is present in the email address of the sender in determining whether to accepted the email messages.