How Spam Filters Work
What Spam Filters Check
This is how spam filters work in short: they combine many signals into a single score and take action when the score passes a set threshold. Spam filters are software, running on a receiving mail server or inside a mail client, that decides whether an incoming message is unwanted.
No single test is decisive. A filter looks at who sent the message, how it was sent, what it says and how recipients have treated similar mail before. Each signal adds or subtracts points, so a message can pass most checks and still be filtered because of one strong signal.
Content Scoring and Rule-Based Checks
Content scoring is one of the oldest methods. The filter compares the message against a set of rules, each with a weight. Rules may look for certain phrases, unusual formatting, hidden text, mismatched links or images with little text. Open-source tools such as SpamAssassin use this approach, adding points for each rule a message matches and comparing the total to a threshold.
Rules are blunt. A legitimate bank notice may use wording similar to a scam, and a newsletter full of links can look like spam. This is why rule scores are combined with other signals rather than used alone.
Reputation, Authentication and Machine Learning
Reputation checks look at the sending IP address and domain, using their history and public blocklists. Authentication checks ask whether the message passes SPF, DKIM and DMARC. A message that fails authentication, or comes from a poorly regarded source, starts with a higher score before its content is even read.
Many modern filters also use machine learning. They are trained on large sets of messages labeled as spam or legitimate, and they learn patterns that fixed rules can miss. Filters can also learn from individual users: when someone marks a message as spam or rescues one from the spam folder, that feedback can shape future decisions for that mailbox. Filters may also delay mail from unknown senders, a technique explained in greylisting.
A Legitimate Invoice Sent to Spam
A small contractor emails invoices with a PDF attached and a link to pay online. The sending domain has no DMARC policy, and its server is on a blocklist from an old incident. The filter adds points for the unauthenticated sender, the listing and the link, so the invoice lands in the spam folder. The customer does not see it until they check the folder days later.
After the contractor sets up authentication and the listing is removed, the same invoices reach the inbox. Nothing about the invoice text changed. Only the sender's signals did, which is why sender-side setup often matters as much as the wording of a message.
Frequently asked questions
What is a false positive in spam filtering?
A false positive is a legitimate message wrongly treated as spam. A false negative is spam that reaches the inbox. Filters are tuned to balance the two, because stricter settings catch more spam but also block more real mail, and looser settings do the reverse.
Why does my email go to spam even though it is authenticated?
Authentication shows who sent a message, not whether the recipient wants it. Filters still score content, reputation and engagement. Mail that passes authentication but is unwanted, or that uses content resembling spam, can still be filtered. Checking the sender's history is often the next step; see blacklists for one common cause.