Reading time: 9 min · Last verified: August 2026 · SMTPedia editorial team
Every message you receive was judged before you saw it. Something read the envelope, checked who claimed to be sending it, looked the address up on a list of known offenders, weighed the words, and produced a verdict. That verdict decided whether the message reached your inbox, dropped into Junk, or was refused at the door and never existed for you at all.
Most explanations of spam mail filtering stop at a list of filter types. That list is accurate and not much use, because it never says where in the journey the decision happened or how to find out what it was. Both are knowable: the verdict is written down, in the message, in a header you can read. This page covers what an email spam filter measures, where, and how to read the answer it left behind.
A spam filter runs twice, in two places, and only one of them tells anybody what it did. At the edge, the receiving server can refuse the message and answer with a numeric SMTP code the sender gets as a bounce. After acceptance, the same message can be quietly filed into Junk: no code, no bounce, no notification. Almost every confusing thing about spam filtering comes from mistaking the second for the first.
The Filter Runs Twice, and Only One Run Leaves a Receipt
Filtering is not a single gate. A message passes two judgments, separated by the moment the receiving server accepts responsibility for it, and they produce completely different evidence. That is why one decision looks like a bounce to one person and a vanishing act to another.
Refused during the SMTP conversation
The server declines to accept the message and answers with a numeric reply. The sender gets a bounce carrying that code. Visible to the sender, invisible to the recipient. The message never lands anywhere.
Accepted, then filed into Junk
The server says yes, takes the message, and then routes it to the Junk or Spam folder. No code, no bounce, no warning to anyone. The sender’s logs show a clean delivery.
This answers the most common complaint about email: the message that was definitely sent, definitely accepted, and definitely never read. Nothing failed. It was delivered and then filed, which on the sending side counts as a success. That is why delivery rate and inbox rate are two different measurements: our reference on what inbox placement rate measures covers the gap.
The Five Things an Email Spam Filter Actually Measures
Vendors describe their filters by technology: Bayesian, heuristic, machine learning. That describes the machinery, not the inputs. The inputs are the same everywhere, and there are five.
Does the sender actually control the domain it claims? This is what SPF, DKIM and DMARC answer, and the answer is recorded in the message.
How has this IP address and this domain behaved recently? Volume, consistency, complaint history, and how long the domain has existed.
Is the sending IP or domain named on a public blocklist? A single DNS lookup, answered in milliseconds, and it can end the conversation.
Subject line, body text, link targets, image to text ratio, and the structure of the HTML. Each contributes a small amount, rarely a decision on its own.
What did recipients do with the last batch? Opens, replies, deletions without reading, and the one that costs most: pressing the report button.
Two of the five are worth pulling apart, because people fix them in the wrong order.
Identity is cheap to check and expensive to fake
Three DNS-based mechanisms answer the identity question, and a receiving server evaluates all three before reading a word of the body. An SPF record lists which servers may send for a domain, a DKIM signature proves the message was not altered in transit, and a DMARC policy says what to do when the first two disagree with the visible From address. To check a live record, use the SPF record checker.
Content matters less than the panic around it suggests
The idea that certain words trigger a spam filter has outlived its accuracy. Words carry weight, but a small one: a message from an authenticated domain with a clean history survives vocabulary that would sink an unknown sender on a fresh IP. Our catalogue of the terms that do carry measurable weight is best read as what to check last, after identity and reputation.
The Score Is Additive, and the Threshold Is Somebody’s Setting
Filters do not answer yes or no. They run dozens of independent tests, each contributing a positive or negative number, and compare the total against a threshold. That threshold is a configuration value, which means the same message can be spam on one server and legitimate on the next.
Apache SpamAssassin, the open source filter most self-hosted mail passes through, makes this explicit in its own configuration documentation. Its default cut-off is 5.0, and the project describes that number in unusually frank terms: “5.0 is the default setting, and is quite aggressive; it would be suitable for a single-user setup, but if you’re an ISP installing SpamAssassin, you should probably set the default to be more conservative, like 8.0 or 10.0.”
Read that quote again, because it is the whole point. The most widely deployed threshold in email is called aggressive and unsuitable for large operators by its own authors. There is no universal line between spam and not spam: there is a number somebody chose, different on every server your message touches.
Scores are not even fixed per test. SpamAssassin ships four score sets, selected by which subsystems are active: “The first score is used when both Bayes and network tests are disabled (score set 0). The second score is used when Bayes is disabled, but network tests are enabled (score set 1).” The same rule can therefore cost a different amount on two servers before any administrator has touched a setting.
The Verdict Is Written in the Message
This is the part that turns a guess into a diagnosis, and almost no guide covers it. Filtering decisions are recorded in the headers: open any message, view its source, and the reasoning is there in plain text.
| Where to look | What it tells you |
|---|---|
Authentication-Results | The identity verdict: whether SPF, DKIM and DMARC passed, failed or were absent, written by the receiving server itself. |
Received chain | The route the message took and which host handed it to which, read from the bottom upward. |
| The bounce text | If the message was refused at the edge, the numeric reply and its explanatory text name the reason, and often the blocklist responsible. |
| Filter score headers | Many servers stamp their own score and threshold into the message, showing exactly how close to the line it landed. |
Our guide to parsing the Authentication-Results header and its SPF, DKIM and DMARC verdicts works through real examples, and reading the Received chain covers the second half. When the refusal happened at the edge, the numeric reply is the fastest way in: the SMTP error codes reference directory indexes each one, down to named rejections such as the 550 that cites zen.spamhaus.org.
If You Send Mail, These Are the Numbers That Filter You
Reputation stops being abstract the moment a mailbox provider publishes its thresholds. Google’s sender requirements do exactly that.
The spam rate ceiling. Google’s guidance is to “keep spam rates reported in Postmaster Tools below 0.30%”, and to stay under 0.10% for margin.
Messages a day to Gmail addresses is the line above which SPF, DKIM and DMARC all become requirements rather than recommendations.
Marketing mail “must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body.”
One-click unsubscribe uses two headers together, List-Unsubscribe carrying the URL and List-Unsubscribe-Post declaring that a single POST is enough; our guide to adding an unsubscribe link that satisfies both the header and the body requirement covers it. The complaints that push a spam rate toward that 0.30% ceiling arrive through feedback loops, and the sender-side view is in the twelve reasons legitimate mail lands in spam.
Turning the Dial on Your Own Mailbox
On the receiving side the filter is adjustable, over a wider range than most people realise. Outlook publishes four protection levels, and the wording matters because the extremes behave very differently.
| Level | What Microsoft says it does |
|---|---|
| No Automatic Filtering | Turns off the automatic filter, but “messages are still evaluated by using the domain names and email addresses in your Blocked Senders List.” |
| Low | For those who want “to filter only the messages that are the most obvious junk.” |
| High | For heavy spam volumes, without restricting “messages from senders on your safe lists.” |
| Safe Lists Only | “The most restrictive option. Any message that isn’t from someone on your Safe Senders List or isn’t to a mailing list on your Safe Recipients List, is classified as junk.” |
One detail matters before you touch the dial: junk is not kept forever. Microsoft states that “junk email is retained for 30 days before it is automatically deleted and is not recoverable.” That is the real cost of setting the filter too high, and it is why checking the Junk folder is not busywork.
Why Blocking a Sender Does Not Stop the Spam
The answer follows directly from the two moments described above. Blocking a sender refuses nothing. In Microsoft’s own description, adding an address or domain to the blocked list causes “these messages to be moved directly to your Junk Email folder.” The message is still accepted, still stored, simply filed somewhere you do not look.
That is a mailbox rule, not a filter, and it acts on an address the spammer chose and can change in seconds. The filter acts on identity, reputation and list membership, which are far more expensive to replace. This is why marking a message as junk beats blocking it: marking teaches the classifier, blocking adds one line to a list. The full sequence is in our guide to reducing the junk that reaches your inbox.
Frequently Asked Questions
What is a spam filter?
A spam filter is an automated system that examines incoming messages and decides whether each reaches the inbox. It weighs sender identity, sending reputation, blocklist membership, content and recipient engagement, turns those signals into a score, and compares it against a threshold. Above the line the message is refused or filed as junk; below it, delivered.
Why do I keep getting spam emails even though I block them?
Because blocking is a filing rule, not a refusal. A blocked sender’s mail is still accepted and stored, just routed straight to Junk, and the rule matches only the exact address or domain you listed. Spammers rotate addresses constantly, so a blocked one is usually already abandoned.
Why am I suddenly getting lots of spam emails?
A sudden increase usually means your address has newly appeared on a list being sold or traded, often after a breach at a service you signed up to, after being scraped from a public page, or after you interacted with a previous spam message. The address has not changed, its distribution has.
How to permanently stop getting spam emails?
There is no permanent stop: the cost of sending is near zero and addresses circulate independently of anything you control. What works is reducing exposure and training the filter: report junk rather than deleting it, unsubscribe only from senders you recognise, and use separate addresses for signups. Expect reduction, not elimination.
Why should you never delete spam emails?
The advice is really about reporting instead of deleting. Deleting teaches the filter nothing; marking as junk feeds the classifier a labelled example. Leaving junk in place has no benefit of its own: Microsoft states that junk email is retained for 30 days before automatic deletion.
What are the types of spam filters?
The common groupings are content filters that read the body and subject, header filters that inspect technical fields for forgery, blocklist filters that check the sending IP or domain against published lists, rule-based filters written by an administrator, and Bayesian filters that learn from what users mark. Production systems run several at once and combine them into one score.
How do I filter spam emails in Gmail?
Gmail’s own filtering cannot be switched off, but you can layer rules on top by creating filters that match a sender, subject or phrase and applying an action. Google Workspace administrators can configure custom spam settings per organisational unit from the Admin console. On a personal account, reporting spam and adding trusted senders to contacts are what measurably change your inbox.
Sources: Apache SpamAssassin configuration documentation; Microsoft Support (junk email filter levels, retention, blocked senders); Google Workspace Admin Help (email sender guidelines).
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
