Category: Deliverability

A honeypot is a decoy built to look like a real target so it attracts attackers, spammers or bots, then records what they do. In cybersecurity that decoy might be a fake server or database. In email it is usually a spam trap: an address that no real person uses, so any mail it receives exposes a sender with bad list practices.

Honeypot definition: what does honey pot mean?

The term borrows from an old image: leave honey out and you will soon see what comes to eat it. In plain English, a honey pot is anything deliberately attractive that lures people or software into revealing themselves.

You will see it used in four main ways:

• Cybersecurity. A fake system, service or file that looks valuable and vulnerable. Legitimate users have no reason to touch it, so any interaction is suspicious by definition.
• Email deliverability. A spam trap address seeded where harvesters or careless list builders will pick it up.
• Web forms. A hidden field that humans never see but bots fill in, which flags the submission as automated.
• Espionage. A “honey trap” is an intelligence operation that uses romantic or personal attraction to compromise a target. Spy fiction leans on this meaning heavily, but it has nothing to do with your inbox.

So what is honey potted? It is informal slang for having been caught by one of these lures. A spammer who mails a trap address has been honey potted. So has a hacker who spent an afternoon looting a fake database full of planted data.

One of the best-known early cases came from astronomer-turned-sysadmin Clifford Stoll. In 1986 at Lawrence Berkeley Laboratory, he created bogus files about an invented “SDInet” project to keep an intruder connected long enough to trace him. He told the story in his 1989 book The Cuckoo’s Egg, and it remains a textbook example of the idea.

How a honeypot works

The logic is simple and that is why it is so effective. A real production server gets plenty of legitimate traffic, so spotting the malicious requests is hard. A decoy gets no legitimate traffic at all. Every connection, login attempt or email that lands on it is a signal.

That gives defenders three things:

1. Detection. An alert fires the moment anything touches the decoy.
2. Information. You can study the attacker’s tools, commands and malware without risking real assets.
3. Diversion. Time an attacker spends inside a fake system is time not spent on your real one.

Email spam traps run on exactly the same principle. An address that never subscribed to anything should never receive marketing. If it does, the sender either scraped it, bought it, guessed it, or kept mailing it long after it died.

Types of honeypots

Security teams sort honeypots along a few different lines. The two most useful are purpose and complexity.

Research vs. production honeypots

Research honeypots exist to study attackers. Universities, security vendors and groups like the Honeynet Project (founded in 1999) run them to learn about new exploits, botnets and malware families. They tend to be elaborate and are watched closely, because the goal is data.

Production honeypots sit inside a company’s network as an early-warning system. They are simpler, cheaper and placed near real servers so that an intruder who moves sideways through the network trips an alarm. The goal here is protection, not research.

Honeypots by complexity level

Level	What it imitates	Effort to run	What you learn	Risk
Low-interaction	A few services or open ports	Low	Who is scanning and probing	Low
Medium-interaction	Convincing service responses, fake shells	Moderate	Common attack scripts and payloads	Moderate
High-interaction	A full real operating system and applications	High	Complete attacker behaviour, custom tools	Higher, since a real system can be abused

Low-interaction decoys are the sensible starting point for most organisations. High-interaction setups give much richer intelligence, but they need tight isolation so a compromised decoy cannot be used to attack anyone else.

6 types of honeypots by target

1. Email honeypots (spam traps). Addresses built to catch spammers and list harvesters. More on these below, since they are the ones that will hurt your email marketing.
2. Database honeypots. Fake databases that attract SQL injection and data theft attempts.
3. Malware honeypots. Systems that mimic vulnerable software or USB storage to capture malware samples.
4. Spider honeypots. Pages and links only reachable by crawlers, used to identify malicious bots and scrapers.
5. Client honeypots. Decoy “users” that visit websites to find malicious servers that attack visitors.
6. Honeynets. Whole networks of linked decoys that let researchers watch an attack unfold across multiple machines.

What is a honeypot trap in email?

For senders, the honeypot that matters is the spam trap. It is a valid-looking address on a real domain that accepts mail, never opts in to anything and never engages. Blocklist operators and mailbox providers run them, and anti-spam services use the hits to decide whose mail is trustworthy.

Spamhaus, the most influential blocklist operator, runs large trap networks. Mailbox providers run their own. Community projects have done the same: Project Honey Pot, started in 2004 by Unspam Technologies, distributed trap addresses through volunteer websites to identify harvesters. Nobody publishes trap addresses, which is the whole point. You cannot “scrub” them from a list with a lookup.

The 3 spam trap types

Trap type	How it is created	How you end up mailing it	Severity
Pristine	Created purely as a trap and planted on web pages or in code where only scrapers find it	Bought, rented or scraped lists	Severe
Recycled	A once-real address abandoned by its owner, bounced for a long period, then reactivated as a trap	Mailing old contacts without removing hard bounces or inactive subscribers	Moderate to severe
Typo	A misspelled domain or address, such as a common domain with one letter swapped	Signup forms with no validation or confirmation	Lower, but adds up

A pristine trap hit is the most damaging because there is no innocent explanation. Nobody signs up with that address, so mailing it proves you acquired data you had no permission to use.

Recycled traps catch legitimate senders who simply got lazy. The address hard bounced for months, you ignored the bounces, and one day it quietly started accepting mail again. Typo traps catch senders with weak forms: someone types their address wrong, you never confirm it, and you keep mailing a stranger’s domain.

What happens when you hit a spam trap

The consequences scale with the trap type and how often you hit them.

• Blocklisting. Spamhaus can list your sending IP or domain. Many receiving servers reject or junk mail from listed sources outright.
• Filtering penalties. Blocklist hits feed into e-mail spam filtering everywhere. Tools that use real-time blocklists add points to your SpamAssassin score, pushing borderline messages into the junk folder.
• Reputation damage at the mailbox providers. Gmail, Yahoo and Microsoft weigh trap hits alongside complaints and engagement. Damage to your domain reputation follows you even if you change IPs.
• Account action from your ESP. Email service providers watch their shared IP reputation. Repeated trap hits can get your account paused or closed.

The pressure has increased since February 2024, when Google and Yahoo began enforcing rules for bulk senders. Anyone sending around 5,000 or more messages a day to Gmail addresses must authenticate with SPF, DKIM and DMARC, support one-click unsubscribe, and keep the spam complaint rate in Postmaster Tools well below 0.3%, the level at which Gmail starts blocking mail. Google recommends staying under 0.1%. Microsoft announced similar authentication requirements for high-volume senders to Outlook.com addresses, enforced from May 2025. Senders who hit traps usually have the same list problems that drive complaints, so the two failures tend to arrive together.

How to avoid honeypot spam traps

You cannot identify a trap address directly, so the defence is process. Clean list building and steady hygiene keep traps out, and that protects your reputation far better than any after-the-fact scrubbing.

A few notes on the steps that matter most:

Double opt-in is your strongest shield. A trap address cannot click a confirmation link, so it never becomes an active subscriber. It also stops typo traps and malicious signups that enter someone else’s address.

Sunset inactive contacts. Recycled traps only exist because abandoned addresses go silent. If you suppress people who have shown no opens or clicks across a reasonable window, you drop most dead addresses before they can be converted. Treat Apple Mail Privacy Protection opens with caution here, since they inflate opens; clicks, replies and purchases are better signs of life.

Validate at entry, not just in bulk. Real-time validation catches obvious typos like misspelled popular domains before they reach your list. Bulk verification services are useful for spotting invalid and risky addresses, but none of them can reliably detect every trap. Their own documentation is generally careful about that claim, and you should be too.

Use a honeypot field on your own signup forms

Here is the angle most guides skip: you can turn the honeypot idea against bots yourself. Spam bots fill in every field they find on a form. A honeypot field is an input that is hidden from humans with CSS. If it comes back filled in, the submission is almost certainly automated and you discard it.

<div style="position:absolute; left:-9999px;" aria-hidden="true">
  <label for="company_url">Leave this field empty</label>
  <input type="text" id="company_url" name="company_url"
         tabindex="-1" autocomplete="off" value="">
</div>

Then reject any submission where company_url has a value. Hide the field with CSS positioning rather than type="hidden", because some bots skip true hidden inputs. The tabindex="-1" and aria-hidden attributes keep keyboard and screen reader users from landing on it.

Many ESP embedded forms already include a field like this. Mailchimp’s standard embed, for example, ships with a bot-catching input. If you build custom forms, add your own and pair it with rate limiting or a CAPTCHA for high-traffic pages. Bot signups do more than pollute your list; they are often used in “list bombing” attacks that flood a victim’s inbox with confirmation emails from dozens of senders at once.

Pros and cons of honeypots

For security teams running their own decoys, the trade-offs look like this:

Pros	Cons
Very few false positives, since no legitimate traffic should hit the decoy	Only sees attacks aimed at the decoy itself
Cheap low-interaction options exist	Experienced attackers can sometimes fingerprint a fake system
Captures real malware and techniques for study	A poorly isolated high-interaction decoy can be hijacked
Buys time and diverts attackers from real servers	Needs monitoring; an unwatched honeypot is just noise

For email senders the calculation is simpler. You do not run the traps; you just need to avoid them. And because trap operators never reveal which addresses they use, good permission practice is the only approach that works.

Signs you may already have hit a trap

Trap hits rarely come with a polite notice. Watch for these symptoms:

• A sudden drop in inbox placement at one provider while others stay stable.
• Bounce messages that reference Spamhaus or another blocklist.
• Your sending IP or domain appearing on a blocklist lookup.
• A warning or suspension notice from your ESP.
• Rising spam rates in Google Postmaster Tools after mailing an old or imported segment.

If you see these, stop mailing the segment that triggered the problem. Identify the source: an imported list, a reactivated old segment, or a form being abused by bots. Suppress everyone in that source who has not engaged recently, fix the signup process, then follow the delisting procedure on the relevant blocklist’s site. Delisting without fixing the cause just gets you listed again.

It also helps to send from a domain email address you own and authenticate properly. A shared or free-mailbox From address gives you nothing to rebuild once reputation recovers.

FAQ

What is a honeypot in simple terms?

A honeypot is a decoy that looks like a real target. It exists to attract attackers, spammers or bots so their activity can be detected, recorded and studied without putting genuine systems or people at risk.

What is a honeypot trap in email marketing?

It is a spam trap: an email address that no real person uses and that never opted in to receive mail. Sending to one tells blocklist operators and mailbox providers that your list was bought, scraped or poorly maintained.

Can I find and remove spam traps from my list?

Not reliably. Trap operators keep their addresses secret. Verification tools flag some risky addresses, but the dependable fix is double opt-in, removing hard bounces, and sunsetting inactive subscribers.

Is a honey trap the same as a honeypot?

They share an origin but mean different things. A honey trap is an espionage or scam tactic that uses personal attraction to compromise someone. A honeypot is a technical decoy used in security and email.

How long does it take to recover from a spam trap hit?

It depends on the blocklist and how many traps you hit. Some listings clear quickly once the cause is fixed and you request removal. Domain reputation with Gmail or Microsoft usually takes weeks of clean, engaged sending to rebuild.

Are honeypots legal?

Running a honeypot on your own systems is generally legal and is standard security practice. Legal questions around data capture and privacy vary by country, so organisations running research honeypots that record attacker data should check local rules.

A SpamAssassin score is the total of points a message collects from hundreds of spam tests. Positive points look spammy, negative points look legitimate, and on a default install anything scoring 5.0 or higher gets flagged as spam. You lower your score by fixing the specific rules your message triggers, and those rules are listed in the message headers.

What a SpamAssassin Score Actually Is

Apache SpamAssassin is an open-source spam filter maintained by the Apache Software Foundation. It has been around since the early 2000s, and the current major release is the 4.0 branch, first shipped in December 2022. You rarely interact with it directly. It runs behind the scenes on web hosting servers, cPanel accounts, university mail systems, corporate gateways and plenty of self-hosted mail setups.

SpamAssassin does not give a message a yes-or-no verdict straight away. It runs the message through a large set of rules, and each rule that matches adds or subtracts a fixed number of points. Then it compares the total against a threshold called required_score.

How the points add up

Think of it as a ledger. A missing Message-ID header might add some points. A link to a domain on a spam blocklist adds a lot. A valid DKIM signature from the sending domain subtracts a fraction of a point. The final number is just the sum.

A few properties of this system matter when you try to lower a score:

• Most rules are worth less than one point. A message usually crosses 5.0 because it trips several medium rules together, not because of one catastrophic error.
• A handful of rules carry heavy weight. Blocklist hits on your sending IP or your linked domains can push you near the threshold on their own.
• Negative rules are small. Passing SPF or DKIM earns almost nothing. The real value of authentication is avoiding the failure rules, which cost far more.
• Scores change over time. Rule scores are regenerated from large mail corpora and distributed through sa-update, so the same message can score differently six months later.

SpamAssassin also uses four “score sets,” depending on whether Bayesian filtering and network tests are enabled on that server. The same rule can carry a different weight on a host with network checks turned on than on one running offline. This is one reason your score on a testing tool rarely matches your score on a recipient’s server exactly.

Reading the X-Spam headers

When SpamAssassin scans a message, it adds headers you can see by viewing the raw source (in most clients, “Show original,” “View source” or “Message details”). A typical result looks like this:

X-Spam-Checker-Version: SpamAssassin 4.0.0 on mail.example.com
X-Spam-Level: *
X-Spam-Status: No, score=1.3 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
    DKIM_VALID_AU,HTML_MESSAGE,MIME_HTML_ONLY,SPF_HELO_NONE,SPF_PASS
    autolearn=no autolearn_force=no version=4.0.0

Here is what each part tells you:

Header	What it means
X-Spam-Status	Yes or No verdict, the score, the threshold and every rule that matched
X-Spam-Level	One asterisk per whole point, handy for simple folder filters
X-Spam-Flag: YES	Added only when the message crossed the threshold
X-Spam-Report	Optional detailed breakdown with points per rule, if the admin enabled it
X-Spam-Checker-Version	SpamAssassin version and the server that scanned it

The tests= list is your to-do list. Every rule name in it is documented, and each one points to something specific about your sending setup or content.

How the SpamAssassin Spam Filter Processes a Message

People often treat SpamAssassin as the thing that deletes their mail. It is better to think of processing as two separate stages, because the second stage is usually configured by someone else.

Stage one: scoring

The mail server hands the incoming message to SpamAssassin, commonly through the spamd daemon and its spamc client, or through a wrapper like amavisd-new or MIMEDefang. SpamAssassin runs its header, body, URI, network and Bayesian tests, adds up the points and writes the headers shown above.

At this point nothing has been blocked. The message has simply been labelled. Depending on configuration, SpamAssassin may also rewrite the subject line (for example adding *****SPAM*****) using the rewrite_header Subject setting.

Stage two: acting on the score

Something else decides what happens next. That might be:

• The mail server rejecting messages above a very high score during the SMTP conversation
• A hosting panel moving flagged mail into a spam folder
• A Sieve or procmail rule filing anything with X-Spam-Flag: YES
• An auto-delete rule that silently discards mail above a chosen score

That last option is where legitimate mail disappears without a trace. If your recipients’ host auto-deletes at a low score, your message never even reaches a junk folder. If you want the bigger picture of how these layers interact with other filters, our guide on how email spam filters work and why messages get caught covers the full chain.

What mail gets checked for spam

Not every message gets scanned, and that surprises a lot of admins.

• Size limits. spamc skips messages larger than its size cap, which defaults to 500 KB. Big attachments often pass through unscored.
• Trusted and internal networks. Mail from IPs listed in trusted_networks or internal_networks is treated differently, and many setups skip scanning for authenticated users sending outbound.
• Per-account toggles. On shared hosting, spam filtering is often off until the account owner turns it on.
• Outbound mail. Some providers scan outgoing mail too, to catch compromised accounts before they damage the server’s reputation.

So if you see no X-Spam headers at all, the message may simply never have been checked.

The Rules That Decide Your Score

SpamAssassin ships with several rule types. Knowing which family a rule belongs to tells you where to look for the fix.

Header tests

Header rules inspect the envelope and message headers. These are the ones senders trip most often through misconfiguration rather than spammy intent.

From: header. Rules look at whether the From address uses a free webmail domain, whether the display name contains an address that differs from the real one, and whether the header is oddly encoded. FREEMAIL_FROM fires when bulk mail comes from addresses like gmail.com or yahoo.com, and FROM_EXCESS_BASE64 catches unnecessarily encoded From lines.

To: header. A missing To header, an “undisclosed recipients” placeholder, or a To address that does not match the actual recipient can all add points. Mail that looks like one copy blasted to everyone is a classic spam signal.

Cc: header. Long Cc lists full of addresses from the same domain look like address harvesting. Legitimate bulk email marketing sends one message per recipient, which keeps Cc empty.

Subject: header. All-caps subjects (SUBJ_ALL_CAPS), heavy punctuation, empty subjects and known spam phrases trigger rules here. One shouted word rarely hurts. A subject like “FREE!!! ACT NOW” stacks several small penalties.

Date: header. MISSING_DATE and the DATE_IN_FUTURE_* and DATE_IN_PAST_* family catch messages with no date or a date far from when the message was received. A server with a broken clock or a script building messages by hand is the usual cause.

Other header rules worth knowing: MISSING_MID (no Message-ID), RDNS_NONE (the connecting IP has no reverse DNS), and FREEMAIL_FORGED_REPLYTO (a free webmail Reply-To that differs from the From address, a common scam pattern).

Body and URI tests

Body rules scan the decoded text. They look for spam phrasing, hidden text such as HTML_FONT_LOW_CONTRAST, and structure problems. MIME_HTML_ONLY fires when there is no plain-text version. The HTML_IMAGE_RATIO_* and HTML_IMAGE_ONLY_* rules catch emails that are mostly one big image with little text.

URI rules extract every link and check the domains. Linking to a domain on a URI blocklist is one of the fastest ways to gain points, and it does not matter that your own domain is clean. Public link shorteners and cheap tracking domains shared with spammers are frequent offenders.

Network tests

These rules query outside services in real time:

• DNS blocklists such as Spamhaus check the sending IP. Rule names start with RCVD_IN_.
• URI blocklists such as SURBL, URIBL and Spamhaus DBL check linked domains. Rule names start with URIBL_.
• Collaborative checksum networks (Razor, Pyzor and DCC) compare a fingerprint of your message against messages other users reported as spam or seen in huge volume.

A note for admins: if you see URIBL_BLOCKED in your headers, the blocklist refused your server’s DNS queries. This usually happens when a server uses a large public resolver such as 8.8.8.8, which the blocklists throttle. The rule itself scores almost nothing, but it means your URI checks are silently not working. Running a local recursive resolver fixes it.

Bayesian filtering

Bayesian filtering is the part of SpamAssassin that learns. It breaks messages into tokens (words, header fragments, URL pieces) and estimates how likely each token is to appear in spam versus legitimate mail on that specific server. The result lands in one of the BAYES_00 to BAYES_99 rules, where BAYES_00 means almost certainly ham and BAYES_99 means almost certainly spam.

Some details that make Bayes behave the way it does:

• It stays switched off until it has learned at least 200 spam and 200 ham messages, the defaults for bayes_min_spam_num and bayes_min_ham_num.
• It can auto-learn. By default, messages scoring below 0.1 are learned as ham and messages scoring 12.0 or higher are learned as spam.
• It is personal to the server or user. A message that hits BAYES_00 at one company can hit BAYES_80 at another whose users report similar newsletters as junk.

For senders, Bayes is the hardest factor to control directly. Consistent sending and content people actually want to open keep you out of the high Bayes bands over time.

How to Check Your SpamAssassin Score

You have three practical ways to see your score before real recipients do.

Send to a seed address and read the headers. If you have an account on a host running SpamAssassin (most cPanel hosts do), send your campaign there and open the raw source. This shows you exactly how that server scored you.

Use a testing service. Mail-tester gives you a temporary address, scores the message with SpamAssassin and presents the result as a grade out of 10 alongside the rules that fired. Postmark runs a free Spamcheck API that accepts a raw message and returns a SpamAssassin score and rule breakdown as JSON, which is useful if you want to check templates automatically from a build pipeline or a webhook-driven workflow.

Run it yourself. If you have SpamAssassin installed, save a raw message as a .eml file and run:

spamassassin -t < message.eml

The -t flag prints a report with points per rule. Add -D for verbose debug output when you need to see why a network test failed, and run spamassassin --lint after editing configuration to catch syntax errors.

How to Lower Your SpamAssassin Score as a Sender

Work from the tests= list, biggest offenders first. In practice, the fixes fall into a predictable order.

Fix authentication first

Failure rules such as SPF_FAIL, SPF_SOFTFAIL and DKIM_INVALID cost real points, and they also hurt you with Gmail, Yahoo and Microsoft. SpamAssassin 4.0 also added a DMARC plugin, so failing DMARC can now show up in your score on updated servers.

A basic SPF record for a domain that sends through Google Workspace and one email platform looks like this:

example.com.  IN  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

Swap the includes for the services you actually use, and keep it to one SPF record per domain. Multiple SPF records cause a permanent error, which counts as a failure.

DKIM is published by your sending platform as a TXT or CNAME record at a selector it gives you:

s1._domainkey.example.com.  IN  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh...IDAQAB"

A starter DMARC record that monitors without blocking:

_dmarc.example.com.  IN  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

Since February 2024, Gmail and Yahoo require SPF, DKIM and at least a p=none DMARC policy from anyone sending more than 5,000 messages a day, and Microsoft began enforcing similar rules for Outlook.com in May 2025. Fixing these for SpamAssassin fixes them for the big providers too.

Fix the server-level signals

If you run your own mail server, make sure the sending IP has a PTR record that resolves back to the same hostname your server announces in HELO. RDNS_NONE and RDNS_DYNAMIC are common on cheap VPS setups. Also confirm the server clock syncs with NTP, which kills the date rules, and that your MTA generates a Message-ID. If you send from an application, route it through a proper relay on an authenticated SMTP port instead of having the app speak directly to recipient servers.

Fix the content signals

Content rules are usually the cheapest to fix and the most often ignored.

• Always send multipart messages with both HTML and plain-text versions. Every serious sending platform does this automatically if you let it.
• Avoid single-image emails. Put real text in the message and keep images supporting it.
• Use your own domain for links and tracking where your platform supports it, and skip public link shorteners.
• Drop hidden text, tiny fonts and white-on-white tricks. They trip specific rules.
• Write subject lines in normal case with one exclamation mark at most.

Common rules and how to fix them

Rule	What triggers it	Fix
MISSING_MID	No Message-ID header	Let your MTA or platform generate one
MISSING_DATE, DATE_IN_FUTURE_*	No date or a wrong clock	Sync the server with NTP
MIME_HTML_ONLY	No plain-text part	Send multipart/alternative
HTML_IMAGE_RATIO_*	Too many images, too little text	Add real copy
FREEMAIL_FROM	Bulk mail from a webmail address	Send from your own domain
FREEMAIL_FORGED_REPLYTO	Webmail Reply-To differs from From	Use a Reply-To on your domain
RDNS_NONE	Sending IP has no PTR record	Ask your host to set reverse DNS
SPF_SOFTFAIL, SPF_FAIL	Sender not in SPF record	Add the service’s include
DKIM_INVALID	Signature broken in transit	Check footers or relays modifying mail
RCVD_IN_*	Sending IP on a DNS blocklist	Find the cause, then request delisting
URIBL_*	Linked domain on a URI blocklist	Remove or replace the link
SUBJ_ALL_CAPS	Subject entirely in capitals	Use normal casing

Rules starting with T_ are testing rules with near-zero scores. You can ignore them unless they later get promoted.

If you send through a shared platform and keep landing on IP blocklists, the problem may be your provider’s pool rather than you. Our roundup of the best email marketing platforms for small businesses compares providers on exactly that kind of infrastructure.

Tuning SpamAssassin as an Admin or Mailbox Owner

The other half of the search intent comes from people on the receiving end: either too much spam is getting through or legitimate mail is getting flagged. Here is how to adjust it.

The customization form in your hosting panel

On cPanel hosting, SpamAssassin settings live under cPanel » Email » Spam Filters. The interface typically offers:

• A master toggle to process new emails and mark them as spam
• An option to move new spam to a separate folder (the “Spam Box”)
• An option to auto-delete spam above a score you choose
• A spam threshold score setting
• Additional configuration for allowed senders, blocked senders and custom rule scores

Other panels such as Plesk and DirectAdmin offer similar forms with different labels. Under the hood, they all write the same SpamAssassin settings.

Reducing the “required hits” needed to mark a message as spam

Older versions and some hosting panels still call the threshold required_hits. Modern SpamAssassin uses required_score. Either way, it is the number that separates spam from ham, and the default is 5.0.

Lowering it to 4 or 4.5 catches more spam but flags more legitimate mail. Raising it to 6 or 7 does the opposite. In local.cf (usually /etc/mail/spamassassin/local.cf, or /etc/spamassassin/local.cf on Debian and Ubuntu):

required_score 4.5

Change it in half-point steps and watch your spam folder for a week before going further. Never set auto-delete at the same score as your threshold. A safer pattern is to file anything at 5.0 or above into a spam folder and only auto-delete above 10 or 15, where false positives are rare.

Welcomelisting senders

SpamAssassin 4.0 renamed whitelists and blacklists to welcomelists and blocklists. The old option names still work for backward compatibility, but use the new ones for new configs.

welcomelist_from [email protected]
welcomelist_from *@trustedvendor.com

A welcomelist hit triggers USER_IN_WELCOMELIST (formerly USER_IN_WHITELIST), which carries a large negative score and effectively guarantees delivery. That is also the danger. Spammers forge From addresses constantly, so a plain welcomelist_from on a big brand’s domain can wave through phishing. The safer option checks authentication first:

welcomelist_auth *@trustedvendor.com

This only applies when SPF or DKIM confirms the sender really is that domain. Use it for anything important. It is particularly useful for an internal newsletter or HR announcement that keeps getting flagged by your company’s own gateway because it is image-heavy and goes to everyone at once.

Blocklisting senders

blocklist_from *@spammydomain.example

This triggers USER_IN_BLOCKLIST at +100 points. It works well for persistent senders who ignore unsubscribes. It works poorly against real spam campaigns, which rotate domains daily.

Blocklisting recipients

This one confuses people. blocklist_to matches the recipient address, not the sender:

blocklist_to [email protected]

It is useful for retired addresses or catch-all aliases that now receive nothing but spam. Any message sent to that address picks up a big penalty. There is also welcomelist_to for addresses such as abuse@ or postmaster@ that must receive spam samples without filtering.

Overriding individual rule scores

If one rule keeps hurting legitimate mail on your server, adjust it rather than changing the global threshold:

score FREEMAIL_FROM 0.5
score HTML_IMAGE_RATIO_02 0

Setting a score to 0 disables the rule. Individual users can place the same settings in ~/.spamassassin/user_prefs if the admin allows user preferences. Keep a comment next to each override explaining why, because six months later nobody will remember.

You can also write custom rules. A simple header rule looks like this:

header   LOCAL_FAKE_INVOICE  Subject =~ /binvoices+overdueb/i
score    LOCAL_FAKE_INVOICE  2.0
describe LOCAL_FAKE_INVOICE  Subject claims an overdue invoice

Prefix local rules with something like LOCAL_ so they never collide with official rule names.

Keep rules updated and train Bayes

Run sa-update on a schedule (daily is common) and restart spamd afterwards so new rules load. A server running rules from years ago misses current spam patterns and may score modern legitimate mail badly.

Train Bayes with real mail from your own users:

sa-learn --spam /path/to/spam-folder
sa-learn --ham /path/to/inbox-folder

Feed it balanced samples. Training only on spam skews the model and pushes legitimate mail into higher Bayes bands. Clear out a bloated spam folder first if you need to; the same approach you would use to bulk delete Gmail emails applies, keep a recent clean sample and remove the rest.

Why a Low Score Doesn’t Guarantee the Inbox

This is the part most score checkers skip. Gmail, Yahoo and Microsoft do not run SpamAssassin on consumer mailboxes. They use their own machine-learning filters, sender reputation data and engagement signals. A message scoring -0.5 on mail-tester can still land in Gmail’s spam folder, and a message scoring 4 can land in the primary tab.

Treat your SpamAssassin score as a technical health check. It reliably catches broken authentication, missing headers, blocklisted links and sloppy HTML. It cannot measure whether your recipients want your mail. For Gmail and Yahoo, the numbers that matter most are your spam complaint rate (keep it under 0.3%, and ideally under 0.1%), one-click unsubscribe support, and consistent sending from an authenticated domain.

SpamAssassin still matters a great deal for B2B senders. Many business, university and hosting-provider inboxes sit behind SpamAssassin or gateways that borrow its rules. If your list is full of company domains, a clean score is close to essential.

FAQ

What is a good SpamAssassin score?

Anything below 5.0 passes a default install, but aim for under 2.0 to leave room for servers with stricter thresholds or different score sets. A score at or below zero is excellent and usually means you are authenticated and triggering no meaningful content rules.

Is a negative SpamAssassin score possible?

Yes. Rules like DKIM_VALID_AU and SPF_PASS subtract small amounts, BAYES_00 subtracts more, and a welcomelist entry subtracts 100. Most well-configured legitimate mail scores close to zero or slightly negative.

What is the difference between required_hits and required_score?

They are the same threshold. required_hits is the older name, and required_score is the current one. Both default to 5.0, and hosting panels sometimes still show the older label.

Why is my score different on mail-tester than on my client’s server?

Each server uses its own SpamAssassin version, rule updates, score set, network tests, Bayes database and local overrides. Testing tools give you a useful baseline, not the exact score every recipient will calculate.

Does SpamAssassin check attachments?

It scans the message structure and can flag suspicious attachment types, but it is not an antivirus scanner. Many setups also skip messages above a size limit entirely, with spamc defaulting to 500 KB, so large attachments often bypass scoring altogether.

Should I lower my spam threshold below 5?

Only if spam is clearly getting through and you have checked that Bayes and network tests are working. Fixing URIBL_BLOCKED, updating rules and training Bayes usually do more than moving the threshold, and they carry far less risk of losing legitimate mail.

E-mail spam filtering is the set of tests a receiving mail server runs on every incoming message. Those tests decide whether the message lands in the inbox, goes to the spam folder, or gets rejected. Modern filters combine connection checks, sender authentication, reputation lookups, content analysis, machine learning and recipient behaviour into a single verdict, and most legitimate mail gets caught because it fails one of those layers.

What an email spam filter actually does

A spam filter is software that scores incoming mail and acts on that score. It can run at your mailbox provider (Gmail, Outlook.com, Yahoo), on a corporate gateway, on your own mail server, or inside your email client.

The volume explains why filters are so aggressive. Kaspersky’s annual spam and phishing report put spam at 45.6% of global email traffic in 2023. Close to half of all mail is junk, so providers err on the side of suspicion. A sender with no history gets less benefit of the doubt than one with years of clean sending.

Every filter ends with one of four outcomes:

• Reject at the door. The receiving server refuses the message during the SMTP conversation and returns an error code. The sender gets a bounce.
• Accept to the inbox. The message passed and gets delivered normally.
• Accept to spam or junk. The server took the message but routed it away from the inbox.
• Quarantine. Common in business filters. An admin or user has to release the message before anyone sees it.

Most filters work on points, not a single pass or fail. Apache SpamAssassin, the open-source filter that shaped a lot of this industry, adds up scores from hundreds of rules and treats anything at 5.0 or above as spam by default. Commercial and mailbox-provider filters are far more complex, but the idea holds. Small problems add up, and one big problem can sink you alone.

The 6 checks a message has to pass

You can follow a message through roughly six layers, from the moment your server connects to the moment a human decides whether to open it. Here is the short version before we go through each one.

Layer	What it examines	Typical tools and signals	What failure looks like
1. Connection	Sending IP, reverse DNS, sending rate	DNS blocklists, PTR lookups, greylisting	SMTP rejection or temporary deferral
2. Authentication	Proof the sender owns the domain	SPF, DKIM, DMARC	Rejection or spam folder
3. Domain and URL reputation	Domains in the From line and links	Spamhaus DBL, URIBL, domain age	Spam folder or rejection
4. Content	Headers, body, HTML, attachments	Rule sets, Bayesian scoring, malware scanning	Higher spam score, quarantine
5. Machine learning	Patterns across billions of messages	Neural networks, text classifiers	Spam folder, warning banners
6. Engagement	How recipients treat your mail	Opens, replies, deletes, spam reports	Gradual slide into the spam folder

1. Connection and IP reputation

Before the receiving server reads a single word, it looks at who is knocking. The sending IP address is checked against DNS-based blocklists such as Spamhaus ZEN, Barracuda’s BRBL and SpamCop. If your IP is listed, many servers drop the connection on the spot.

The server also checks reverse DNS. Your sending IP should have a PTR record that resolves to a hostname, and that hostname should resolve back to the same IP. Gmail requires this from every sender, regardless of volume.

Rate matters too. A brand-new IP that suddenly pushes 50,000 messages an hour looks like a compromised machine. Receivers throttle it with temporary 4xx errors. Some servers use greylisting, which deliberately defers the first message from an unknown sender. Real mail servers retry a few minutes later, while a lot of spam software never does.

2. Authentication: SPF, DKIM and DMARC

Authentication answers one question: is this server allowed to send mail for this domain? Three DNS records handle it.

SPF lists the servers permitted to send for your domain. Keep it under the 10 DNS lookup limit or it fails silently.

example.com.  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

DKIM adds a cryptographic signature to each message. The receiving server fetches your public key from DNS and checks the signature, which proves the message wasn’t altered and came from someone holding your private key.

s1._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

DMARC ties the two together. It requires that SPF or DKIM pass and align with the domain in the visible From address. It also tells receivers what to do when checks fail and where to send reports.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r"

Start at p=none to collect reports. Then move to p=quarantine and finally p=reject once you’re sure every legitimate source is authenticated. Alignment is the part people miss. If your newsletter platform signs DKIM with its own domain instead of yours, DMARC can fail even though DKIM technically passed.

3. Domain and URL reputation

Filters look past your IP to the domains inside the message. That includes your From domain, the Return-Path domain, every link and the image hosts. Services like the Spamhaus Domain Blocklist (DBL) and URIBL track domains seen in spam.

This is why a single bad link can sink a clean campaign. A public link shortener that spammers also abuse, a tracking domain shared with thousands of other customers, or a freshly registered domain can all drag your score down. Domain age counts. A domain registered last week and already sending bulk mail is a classic spam pattern.

4. Content analysis

Content filters read the headers and body. Rule-based filters look for known patterns. Think mismatched From and Reply-To addresses, HTML that hides text in tiny fonts or white-on-white colour, image-only emails with almost no text, malformed headers, and attachments with risky file types like .exe, .js or macro-enabled Office files.

Bayesian filtering adds statistics. Paul Graham’s 2002 essay “A Plan for Spam” popularised the approach: train a filter on known spam and known good mail, then score new messages by the probability that their words and tokens appear in spam. Desktop clients like Thunderbird still use adaptive filters built on the same idea.

Attachments and links are also scanned for malware and phishing. Business filters often open them in a sandbox before releasing the message.

5. Machine learning and AI

The big mailbox providers rely mainly on machine learning now. Rules can’t keep up with spammers who rotate wording, domains and IPs hourly. Models trained on billions of messages pick up patterns no human would write as a rule. More on this below.

6. Engagement and recipient signals

The last check happens after delivery, and it is the one senders ignore most. Gmail, Yahoo and Microsoft watch what recipients do with your mail. Opening, replying, moving a message out of spam and adding you to contacts all count in your favour. Deleting without reading, ignoring you for months and hitting “Report spam” all count against you.

These signals feed back into your reputation for future sends. That’s why a sender can pass every technical check and still drift into the spam folder. The filter learned from its users that people don’t want this mail.

Types of spam filters

The layers above describe what gets checked. Where the filter sits determines how much control you have.

Mailbox provider filters. Gmail, Outlook.com, Yahoo and Apple iCloud run their own filtering. You can’t configure it as a sender. You can only earn a good reputation.

Secure email gateways (SEGs). These sit in front of a company’s mail server and filter traffic before it arrives, usually by changing the domain’s MX records to point at the gateway. Proofpoint, Mimecast, Barracuda and Cisco Secure Email are long-standing names here.

API-based cloud email security. Newer tools connect directly to Microsoft 365 or Google Workspace through their APIs and scan mail after the platform’s built-in filter. Abnormal Security, Check Point Harmony Email and Collaboration, and similar products focus on behavioural analysis. They learn who normally emails whom and flag oddities like a “CEO” suddenly asking finance for a wire transfer.

Server-side open-source filters. SpamAssassin and Rspamd run on self-hosted mail servers. Both are free, highly configurable, and need someone who knows what they’re doing to maintain them.

Client-side filters. Outlook’s Junk Email settings, Apple Mail’s junk filter and Thunderbird’s adaptive filter run on the user’s device or account. They mostly add a personal layer on top of server filtering.

There’s also the old challenge-response model, where unknown senders must confirm they’re human before delivery. It still exists in a few services, but it annoys legitimate senders and generates backscatter, so most admins avoid it.

Spam filtering with AI

Google has been the most open about its machine learning. In 2019 it said its TensorFlow models were blocking an extra 100 million spam messages a day that earlier systems missed. In late 2023 it introduced RETVec, a text classifier built to handle the tricks spammers use to dodge text filters: misspellings, swapped characters, invisible Unicode and homoglyphs. Google reported that RETVec improved Gmail’s spam detection rate by 38% over the previous baseline and cut false positives by 19.4%.

Google also says Gmail blocks more than 99.9% of spam, phishing and malware. That number explains why getting into the Gmail inbox is so hard for marginal senders. The system is tuned to catch nearly everything questionable.

AI cuts both ways. Spammers and phishers now use large language models to write fluent, personalised messages with none of the broken grammar that older content rules relied on. That has pushed filters toward signals that are harder to fake, like authentication, sending history, relationship patterns between sender and recipient, and behaviour after delivery. The words in your email matter less every year. Who you are and how people react to you matter more.

The Gmail, Yahoo and Microsoft sender rules

The three largest consumer mailbox providers now publish hard requirements. Fail them and no amount of good content will help.

Provider	Applies to	Effective date	Key requirements
Gmail (all senders)	Anyone sending to personal Gmail accounts	February 2024	SPF or DKIM, valid forward and reverse DNS, TLS, spam rate under 0.3%, RFC 5322 formatting
Gmail (bulk senders)	5,000+ messages a day to Gmail accounts	February 2024; one-click unsubscribe by June 1, 2024	SPF and DKIM, DMARC at p=none or stricter, From domain aligned, one-click unsubscribe, honour unsubscribes within 2 days
Yahoo	Bulk senders (no public numeric threshold)	February 2024	SPF and DKIM, DMARC at p=none or stricter, aligned From domain, one-click unsubscribe, spam rate under 0.3%
Microsoft Outlook.com	5,000+ messages a day to Outlook.com, Hotmail and Live addresses	May 5, 2025	SPF pass, DKIM pass, DMARC at p=none or stricter aligned with SPF or DKIM

Google recommends keeping your spam rate below 0.1% and treats 0.3% as the line you must never cross. It also said it would step up enforcement from November 2025, including temporary and permanent rejections for non-compliant mail. Microsoft rejects non-compliant bulk traffic with a specific error code, covered in the next section.

One-click unsubscribe means the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058. A footer link alone doesn’t satisfy it, though you should still include one.

List-Unsubscribe: <https://example.com/unsub?id=abc123>, <mailto:[email protected]?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Why legitimate emails get caught

When a real business email lands in spam, the cause is almost always one of these, roughly in order of how often I see them.

1. Broken or misaligned authentication. SPF that doesn’t include your email platform, DKIM signed with the vendor’s domain instead of yours, or no DMARC record at all. This is the most common and the easiest to fix.
2. A complaint rate that’s too high. Mailing people who forgot they signed up, or who never really did, drives up spam reports fast. At Gmail, crossing 0.3% is enough to hurt every message you send.
3. Old or acquired addresses. Lists that sat unused for a year contain abandoned addresses. Some of those get recycled into spam traps, which are addresses that exist only to catch senders who don’t clean their lists. Purchased lists are worse, and they also break consent rules under GDPR and many anti-spam laws.
4. Volume spikes on a cold IP or domain. Going from zero to 100,000 sends overnight looks like an attack. New IPs and domains need gradual warming.
5. Shared IP reputation. On a shared pool at an email service provider, other customers’ behaviour affects you. Good providers police this. Cheap ones don’t always.
6. Bad neighbours in your links. A blocklisted link shortener, an image host with a poor reputation or a tracking domain shared with spammers.
7. Low engagement over time. Sending to people who never open teaches the filter your mail isn’t wanted.
8. Sloppy formatting. Image-only emails, broken HTML, a missing plain-text part, or From and Reply-To domains that don’t match your brand.

Notice what isn’t on that list: “spam trigger words.” Writing “free” or “act now” in a subject line used to add points in old rule sets. Today it barely matters. Ranking lists of 400 forbidden words is a myth that wastes your time. Phrases that sound deceptive still hurt, but because recipients report the mail, not because a keyword list flagged it.

What the bounce codes tell you

When a filter rejects mail at the SMTP stage, the error code tells you which layer failed. These are the ones worth recognising.

Code	Provider	What it means
550 5.7.26	Gmail	Message failed authentication (usually DMARC). Fix SPF, DKIM and alignment.
550 5.7.25	Gmail	Sending IP has no PTR (reverse DNS) record.
550 5.7.1	Gmail	Message looks like unsolicited mail based on content or reputation.
421 4.7.28	Gmail	Unusual rate of unsolicited mail from your IP or domain. Slow down and investigate.
421 4.7.0	Gmail	Temporary block or rate limit. Retry later at lower volume.
550 5.7.515	Outlook.com	Sending domain doesn’t meet Microsoft’s authentication requirements for bulk mail.
554 5.7.1 (with a blocklist name)	Many servers	Your IP or domain is on a named blocklist such as Spamhaus ZEN.

A 4xx code is temporary and your server will retry. A 5xx code is permanent for that message. Repeated 5xx bounces need a fix, not more retries.

How to find out why your mail is being filtered

Guessing wastes days. Work through the evidence in this order.

Read the headers. In Gmail, open the message, click the three-dot menu and choose Show original. The top summary shows SPF, DKIM and DMARC as PASS or FAIL. The Authentication-Results header gives the detail, including which domain was checked. In Outlook and Microsoft 365, the X-Forefront-Antispam-Report header includes the Spam Confidence Level (SCL). A value of -1 means filtering was skipped, 0 or 1 means clean, and 5 and up means the message was judged spam. Self-hosted SpamAssassin adds an X-Spam-Status header listing every rule that fired and the total score.

Use the provider dashboards. Google Postmaster Tools shows your domain’s spam rate, authentication results and compliance status against the sender rules. Microsoft offers Smart Network Data Services (SNDS) for IP data and the Junk Mail Reporting Program (JMRP) for complaint feedback. Yahoo runs a complaint feedback loop you can sign up for.

Feed events into your own systems. Most email platforms push bounce, complaint and unsubscribe events to your app in real time. If you need the webhook definition first, it’s simply an automated HTTP message one service sends another when something happens. Wiring complaints into your CRM means you can suppress unhappy contacts everywhere, not only in one tool.

Check DMARC reports. Aggregate reports, sent to the rua address in your DMARC record, show every IP sending mail as your domain. You’ll often find a forgotten CRM, help desk or invoicing tool that was never added to SPF or set up for DKIM.

Choosing an email filter service for your business

On the receiving side, a corporate email spam filter protects your staff from phishing, malware and business email compromise, and it keeps inboxes usable. Microsoft 365 and Google Workspace include solid built-in filtering. Many businesses add a second layer because targeted phishing and impersonation attacks slip past general-purpose filters.

Here is what the main options cost. Prices are list prices at the time of writing, so confirm on vendor pages before you buy.

Option	Type	Price
Gmail, Outlook.com, Yahoo	Built-in consumer filtering	Free
Google Workspace	Built-in business filtering	Included in all Workspace plans
Exchange Online Protection	Built-in Microsoft 365 filtering	Included with Exchange Online mailboxes
Microsoft Defender for Office 365 Plan 1	Add-on: safe links, safe attachments	$2 per user per month
Microsoft Defender for Office 365 Plan 2	Add-on: Plan 1 plus threat investigation and simulation	$5 per user per month
Apache SpamAssassin	Open-source server filter	Free (Apache License 2.0)
Rspamd	Open-source server filter	Free (Apache License 2.0)
Proofpoint, Mimecast, Barracuda	Secure email gateway	Quote-based
Abnormal Security, Check Point Harmony Email	API-based cloud security	Quote-based

When you compare email filtering services, weigh these factors:

• Deployment model. Gateways need an MX change and catch threats before they reach your mailboxes. API tools deploy in minutes and can pull a malicious message back out of inboxes after delivery. Many companies pair built-in filtering with one API tool.
• Phishing and impersonation detection. Ask how the product handles messages with no malicious link or attachment, such as invoice fraud or payroll diversion requests. Pure content filters struggle with these.
• False positive handling. Blocking a customer’s purchase order costs real money. Look for clear quarantine digests, easy user release, and allow-list controls that admins can audit.
• Admin effort. A powerful filter that needs constant tuning will drift out of date if nobody owns it.
• Reporting. You want to see what was blocked, why, and which users get targeted most.

Don’t layer three filters on top of each other without a reason. Every extra layer adds false positive risk and another quarantine to check.

What recipients can do to train their filter

Filters learn from you. If a newsletter you want keeps landing in spam, mark it “Not spam” and move it to your inbox. Add the sender’s address to your contacts. In Gmail, you can also create a filter with the sender’s address and choose “Never send it to Spam.”

For genuine junk, use the “Report spam” or “Junk” button rather than just deleting it. That report trains your provider’s models and lowers the sender’s reputation for everyone. Don’t click unsubscribe links in obvious scam or phishing emails, though. That only confirms your address is live. Report them instead.

In business settings, use your company’s report-phishing button if one exists. It sends the message to the security team, who can pull identical copies out of colleagues’ inboxes before anyone clicks.

FAQ

What is e-mail spam filtering in simple terms?

It’s an automated check that receiving mail servers run on every incoming message. The filter looks at who sent it, whether the sender is authenticated, the reputation of the domains and links involved, the content, and how recipients reacted to similar mail. It then delivers, diverts or rejects the message.

Do spam filters read my emails?

They scan them automatically. Content and machine learning filters analyse text, links and attachments to classify messages, and providers state this in their terms. No person reads your mail as part of normal spam filtering.

Why do emails from my own domain go to spam?

Usually because a sending service isn’t authenticated for your domain. A website contact form, a CRM or an invoicing tool may send as your domain without being included in SPF or signing with your DKIM key. DMARC then fails. Check the headers and your DMARC reports to find the culprit.

Do spam trigger words still matter?

Very little. Modern filters lean on authentication, reputation and engagement far more than individual words. Misleading subject lines still hurt, but mainly because recipients report them as spam.

How accurate are spam filters?

The large providers are extremely accurate. Google says Gmail blocks more than 99.9% of spam, phishing and malware. The trade-off is that marginal or poorly authenticated legitimate mail sometimes gets caught, which is why sender setup matters so much.

What spam complaint rate is too high?

For Gmail, 0.3% is the hard limit, and Google recommends staying below 0.1%. Yahoo applies similar thresholds. That’s one complaint per 1,000 delivered messages. If you’re near that line, tighten your opt-in process and stop mailing people who haven’t engaged in months.