# Spam Filters Explained: How Mail Ends Up in Spam

> How spam filters decide: blocklists, authentication, content scores and reader feedback, what spam words can do, and how to check an email in AcelleMail.

- Canonical URL: https://acellesend.com/kb/articles/spam-filters-explained
- Author: Lena Hart, Email Deliverability Editor
- Category: Domain Knowledge — Email marketing fundamentals — consent, deliverability, metrics, list quality, key terms
- Content type: guide · Difficulty: beginner
- Tags: Email Marketing Basics, Inbox Placement, Spam Score, Sender Reputation
- Published: 2026-10-18 · Last updated: 2026-10-21
- Reading time: 17 min
- Publisher: AcelleMail Knowledge Base, https://acellesend.com/kb

---

A spam filter decides which incoming emails are unwanted. It does not read your email in the way a
person does. It checks who is sending the email, how the message is built, which links it contains and
how readers responded to similar emails in the past. It then decides whether to accept the email and
where to put it.

Many senders worry most about "spam words". Large mailbox providers describe their filters differently.
They focus mainly on the sender and on how their own users respond to emails. Each filter also uses its
own scoring system, so a message can pass one filter and fail another.

The sections below explain each layer of filtering in the order it happens. They also cover what you can
check before you send.

This guide covers:

1. Where filtering happens
2. Blocklists
3. Authentication and reverse DNS
4. Content scores: how a rule-based filter adds up points
5. What about spam words?
6. Readers train the filter
7. Checking before you send

It ends with the most common mistakes and a one-screen summary.

## 1. Where filtering happens

Filtering happens in layers, and each layer checks something different.

1. **At the connection.** Before the receiving server reads the message, it knows which IP address is
   connecting. It can check that address against blocklists and look up its reverse DNS.
   [Spamhaus](https://www.spamhaus.org/blocklists/spamhaus-blocklist/) notes that "The majority of
   malicious email is dropped at the SMTP transaction", which is the conversation between the two
   servers.
2. **On the message.** The filter checks whether the message actually comes from the domain it names,
   using SPF, DKIM and DMARC. It also checks the headers, links and content.
3. **In the mailbox.** The filter can learn from how readers respond to emails.
   [Gmail](https://support.google.com/mail/answer/1366858?hl=en) explains: "As you report more spam,
   Gmail identifies similar emails as spam more efficiently."

![Where filtering happens, in three layers. At the connection, before the content is read, the filter checks the sending IP address against blocklists and looks up its reverse DNS. On the message, it checks SPF, DKIM and DMARC, reads the headers and the links, and scores the content. In the mailbox, readers report spam, mark email as not spam, add senders to their contacts or unsubscribe, and the filter learns from this. The email ends up in the inbox or the spam folder, or it is refused.](https://acellesend.com/plugins/acelle/landing/images/help/kb/spam-filters-explained/01-where-filtering-happens.png)

Large mailbox providers, such as Gmail, Outlook.com and Yahoo, run their own filtering systems.
Companies that run their own mail servers can use an open-source filter such as [Apache
SpamAssassin](https://spamassassin.apache.org/). These systems work differently. Google, for example,
uses machine learning together with rules. When it announced a new layer in 2019,
[Google](https://workspace.google.com/blog/product-announcements/ridding-gmail-of-100-million-more-spam-messages-with-tensorflow)
wrote: "These new protections complement existing ML and rules-based protections".

## 2. Blocklists

A blocklist contains IP addresses or domains that its operator considers risky for email, for example
because they sent spam or should not send email directly. Most blocklists are published in DNS, so a
receiving server can check an address in a fraction of a second. The standard for these lists, [RFC
5782](https://www.rfc-editor.org/rfc/rfc5782), says: "A DNSxL is a zone in the DNS". DNSxL is its name
for both blocklists and allowlists.

To check an IP address, the receiving server reverses it and queries the list. RFC 5782 gives an
example. To look up the address 192.0.2.99 on a list called bad.example.com, the server asks for the
name 99.2.0.192.bad.example.com. If the list returns an answer, the address is listed, apart from the
error codes described in section 7. If the name does not exist, it is not.

![How a server checks a blocklist. A server with the IP address 192.0.2.99 connects. The receiving server reverses the address and asks DNS for 99.2.0.192.bad.example.com. If an answer comes back, the address is on the list. If the name does not exist, it is not. Spamhaus publishes several lists: SBL for malicious network ranges, XBL for compromised addresses, PBL for addresses that should not send directly, CSS for addresses seen sending spam, and DBL for domains with a low reputation, which also covers the domains of links.](https://acellesend.com/plugins/acelle/landing/images/help/kb/spam-filters-explained/02-a-blocklist-lookup.png)

[Spamhaus](https://www.spamhaus.org/blocklists/), one of the best-known operators, publishes several
lists. Each list targets a different problem:

| List | What it contains |
|---|---|
| Spamhaus Blocklist (SBL) | Network ranges that Spamhaus considers malicious |
| Exploits Blocklist (XBL) | Compromised IP addresses, for example hijacked devices |
| Policy Blocklist (PBL) | IP ranges that should not send email directly, such as home connections |
| Combined Spam Sources (CSS) | IP addresses seen sending spam |
| Domain Blocklist (DBL) | Domains with a low reputation |

Spamhaus ZEN combines the IP lists, so a server can check all of them with one query. A domain list such
as the DBL checks domains, including those found in a message's links. A link to a domain with a bad
reputation can therefore hurt an email from a sender with a good reputation.

How you get off a list depends on the list. Spamhaus handles removals from the XBL on its checker site,
check.spamhaus.org. An address is listed again if the problem behind the listing is not fixed. For the
SBL, Spamhaus contacts the network or hosting company. Its [SBL
page](https://www.spamhaus.org/blocklists/spamhaus-blocklist/) says that "only these companies can deal
with SBL removals."

If you send through a sending service, the IP addresses being checked usually belong to the service, as
[Email Sending Explained](https://acellesend.com/kb/articles/email-sending-explained) describes. The service needs to fix any
listing, so report it to them. If you run your own server, check its address yourself.

### In AcelleMail

The **Blacklist** under **Sending** is not a public blocklist. It is your own suppression list. Its page
says: "Blacklisted email addresses are permanently blocked from receiving any campaigns." AcelleMail
adds an address there when the address hard-bounces, and you can add addresses yourself.

## 3. Authentication and reverse DNS

SPF, DKIM and DMARC each help a filter check that a message actually comes from the domain it names.
When Gmail cannot check the sender, it can show a warning above the message: "Gmail can't confirm who
sent you the email." This text appears on the [Gmail Help
page](https://support.google.com/mail/answer/1366858?hl=en) about spam.

Large providers also expect valid reverse DNS for the sending IP address.
[Yahoo](https://senders.yahooinc.com/best-practices/) asks every sender to "Have a valid forward and
reverse DNS record for your sending IPs", and Google asks for the same.

In a rule-based filter, passing authentication earns very few points. In SpamAssassin's default scores,
a valid DKIM signature (the rule DKIM_VALID) is worth -0.1, and a passing SPF check (SPF_PASS) is worth
-0.001. Authentication mainly protects you from being treated as a forgery. Large providers also require
it. [Email Deliverability Explained](https://acellesend.com/kb/articles/email-deliverability-explained) covers the three
records, and [How to Set Up SPF, DKIM, and DMARC
Records](https://acellesend.com/kb/articles/how-to-set-up-spf-dkim-and-dmarc-records) explains how to set them up.

## 4. Content scores: how a rule-based filter adds up points

A rule-based filter such as SpamAssassin runs many tests on the headers and body of a message. Each test
that matches adds points. A test with a negative score removes points instead. If the total reaches a
threshold, the filter treats the message as spam.

SpamAssassin's own [configuration
reference](https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html) sets the default
threshold at 5. It describes the setting this way: "Set the score required before a mail is considered
spam." The same page calls 5.0 "quite aggressive" and suggests that an ISP might set a more conservative
value, "like 8.0 or 10.0". This means the same score can count as spam on one server and pass on
another.

The points for each rule come from SpamAssassin's [default score
file](https://github.com/apache/spamassassin/blob/trunk/rules/50_scores.cf). Many rules have four scores
because the points depend on whether the server also runs network tests, such as blocklist lookups, and
a learning filter, which is explained below. The following examples use network tests with the learning
filter turned off:

| Rule | What it means | Points |
|---|---|---|
| SUBJ_ALL_CAPS | The subject is written in capital letters | 0.5 |
| MISSING_HEADERS | The message has no To header | 1.207 |
| RDNS_NONE | The sending server has no reverse DNS | 1.274 |
| HTML_IMAGE_ONLY_08 | The HTML has images and only 400 to 800 bytes of text | 1.781 |
| URIBL_DBL_SPAM | A link points to a domain on the Spamhaus DBL | 2.5 |
| RCVD_IN_PBL | The message came directly from an address on the Spamhaus PBL | 3.558 |

These are SpamAssassin's defaults as of October 2026. Each site can change them.

![How a content score adds up. An example email matches four SpamAssassin rules: SUBJ_ALL_CAPS for 0.5, RDNS_NONE for 1.274, HTML_IMAGE_ONLY_08 for 1.781 and URIBL_DBL_SPAM for 2.5, a total of 6.055. That reaches SpamAssassin's default threshold of 5, so a server with the default treats the email as spam. It stays below 8, so a more conservative server does not.](https://acellesend.com/plugins/acelle/landing/images/help/kb/spam-filters-explained/03-a-content-score-adds-up.png)

The learning filter, called Bayes, learns from emails that a site has already marked as spam or not
spam. When it is on and almost certain that a message is spam (BAYES_99), it adds 3.5 points. When it is
almost certain that a message is not spam (BAYES_00), it removes 1.9 points. Bayes learns from each
site's own mail, so the same content can score differently from one site to another and from one week to
the next.

## 5. What about spam words?

Words can add points in a rule-based filter. SpamAssassin has rules for phrases often found in spam. A
few of these phrases carry at least as many points as a link to a domain on the Spamhaus DBL. With
network tests on and the learning filter off, a greeting of "Dear Friend" adds 2.604 points
(DEAR_FRIEND), and "100% guaranteed" adds 2.699 (GUARANTEED_100_PERCENT). A footer that tells people how
"to be removed from" your mailings adds 2.992 (EXCUSE_REMOVE). Each of these rules checks for a whole
phrase, not a single word. Many other phrase rules add 0.1 points or nothing.

Large mailbox providers do not publish lists of spam words. Their filters check the content too, but the
signals that Google names in section 6 are about senders and readers, not words.

Content still matters in other ways:

- **An empty message looks suspicious.** Gmail explains: "To check whether email addresses are valid,
  spammers often send emails with no content in the body or subject."
- **An email made mostly of images, with little text,** scores higher in SpamAssassin, and readers see
  little when images are not shown.
- **Links are checked**, because domain blocklists such as the DBL also cover the domains in links.

Write clearly for people who asked for your email, and make the subject line match the message. Leave
out common spam phrases, keep real text next to your images, and link to domains you trust. You do not
need to rewrite good copy just to avoid single words.

## 6. Readers train the filter

Google describes its filters in a post from May 2022, [Understanding Gmail's spam
filters](https://workspace.google.com/blog/identity-and-security/an-overview-of-gmails-spam-filters):
"These filters look at a variety of signals, including characteristics of the IP address,
domains/subdomains, whether bulk senders are authenticated, and user input. User feedback, such as when
a user marks a certain email as spam or signals they want a sender’s emails in their inbox, is key to
this filtering process, and our filters learn from user actions."

In Gmail, readers teach the filter in several ways:

- **Report spam** moves the message to Spam. Later emails from the same sender may go there too.
- **Not spam** moves the message back to the inbox. Later emails from that sender should reach the
  inbox.
- **Adding the sender to contacts** also stops Gmail from sending their messages to Spam.
- **Unsubscribing** counts too. Gmail says: "If someone sends an email after you unsubscribe, their
  emails go directly to Spam."

![What readers teach the filter. In Gmail, after Report spam, later email from the sender may go to Spam. Not spam and adding the sender to contacts help it reach the inbox, and email that still arrives after an unsubscribe goes directly to Spam. In Microsoft 365, the bulk complaint level runs from 0, not a bulk sender, through 1 to 3 for few complaints and 4 to 7 for a mixed number, to 8 and 9 for many complaints. The default threshold is 7.](https://acellesend.com/plugins/acelle/landing/images/help/kb/spam-filters-explained/04-what-readers-teach-the-filter.png)

Honour unsubscribes immediately. [Yahoo](https://senders.yahooinc.com/best-practices/) asks bulk senders
to "Honor unsubscribes within 2 days" and to keep their spam rate below 0.3%.

Microsoft gives bulk email its own number, the bulk complaint level (BCL). This number reflects how many
complaints a bulk sender generates. Its
[documentation](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)
describes the scale as follows:

| BCL | What it means |
|---|---|
| 0 | The message is not from a bulk sender. |
| 1, 2, 3 | The message is from a bulk sender that generates few complaints. |
| 4, 5, 6, 7 | The message is from a bulk sender that generates a mixed number of complaints. |
| 8, 9 | The message is from a bulk sender that generates a high number of complaints. |

The default threshold in Microsoft's anti-spam policies is 7. It is 6 in the Standard preset and 5 in
the Strict preset. A message that meets or exceeds the threshold is marked as bulk email. Microsoft
still adds an older value, the spam confidence level (SCL), to each message. However, its [SCL
page](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)
says that this value "no longer holds the same meaning in cloud organizations". The SCL does not decide
where a message goes.

These reactions also build or damage your sender reputation, explained in [Sender Reputation
Explained](https://acellesend.com/kb/articles/sender-reputation-explained). Yahoo's guidance for senders says: "The best way
to ensure your messages are delivered is to send timely and relevant email to an active and engaged
audience."

## 7. Checking before you send

A content score tells you how one rule-based filter reads your message. It cannot see your sending IP
address, so it cannot check that address against blocklists. It also cannot see your reputation or
predict how your readers will respond. Before a campaign, it helps to check a few other things:

- Check that your sending domain is authenticated.
- Check that your sending service account is in good standing.
- If you run your own server, look up its IP address on check.spamhaus.org.
- Send a test to your own Gmail and Outlook.com addresses.

If you run SpamAssassin yourself, note one detail from
[Spamhaus](https://www.spamhaus.org/resource-hub/dnsbl/using-our-public-mirrors-check-your-return-codes-now/).
Queries that arrive through public DNS resolvers get the answer 127.255.255.254. This is an error code,
not a listing. Use your own DNS resolver, or Spamhaus's Data Query Service, instead.

### In AcelleMail: Check spam score

On a campaign's **Confirm** step, click **Check spam score** to see how SpamAssassin reads the email
before you send it.

![The Spam score result in AcelleMail, with three marks: 1 the verdict Looks good and the score 1.0 of 5.0, 2 the note that the check scores the content only and cannot see the sending IP reputation, SPF, DKIM or blocklists, and 3 the rule FONT_INVIS_MSGID, Invisible text + suspicious message ID, which adds 1.0.](https://acellesend.com/plugins/acelle/landing/images/help/kb/spam-filters-explained/05-spam-score-result.png)

1. The verdict and the score. **Looks good** means that "This message scores below the spam threshold."
   The number after "of" is the threshold of the SpamAssassin server that AcelleMail uses.
2. The scope note explains what the check cannot see: "This scores your content only. It cannot see your
   sending IP reputation, SPF, DKIM or blocklists — those depend on the sending server, not on what you
   wrote."
3. **What the filter noticed** shows each rule that matched, along with its points. Here, a rule for
   invisible text adds 1.0. Rules with 0.0 are only for information.

AcelleMail does not store the score, so check again after you change the email. The same content can
also score differently after the rules are updated.

The check appears only when an administrator has switched it on. Administrators can find it under
**Settings** → **Spam Score**:

![The Spam Score settings for administrators in AcelleMail, with three marks: 1 Spam scoring set to Enabled, 2 Engine set to Direct connection, and 3 the Connection card with the host 127.0.0.1 and the port 783.](https://acellesend.com/plugins/acelle/landing/images/help/kb/spam-filters-explained/06-spam-score-settings.png)

1. **Spam scoring**: **Enabled** shows the button to customers. "When disabled, the check button is not
   shown to customers at all."
2. **Engine**: this controls how AcelleMail reaches SpamAssassin. All three engines run the same
   SpamAssassin rules.
3. **Connection**: this is the address of the SpamAssassin server.

## 8. Common mistakes

| What you see | Why it is a problem | What to do |
|---|---|---|
| You rewrite good copy to remove "spam words". | The heavier word rules look for stock spam phrases, not single words, and the providers say they rely on sender and reader signals. | Leave out stock spam phrases, write clearly for people who asked for the email, and watch your complaints. |
| You treat a content score under 5 as a promise of the inbox. | 5 is SpamAssassin's default threshold, other servers use others, and the score cannot see reputation or readers. | Use the score as one hint among several. |
| A link in your email points to a domain with a bad reputation, for example a shared link shortener. | Domain blocklists also check the domains of links, and a listed link adds points. | Link to your own domain. |
| You keep sending to people who unsubscribed. | Gmail sends later email from that sender straight to Spam. | Honour unsubscribes immediately. Yahoo asks bulk senders to do it within 2 days. |
| Your server's IP address is on the Spamhaus XBL, and you only ask for removal. | The address is listed again if the problem behind it is not fixed. | Fix the compromised machine first, then use check.spamhaus.org. |
| You read the answer 127.255.255.254 from Spamhaus as a listing. | It is an error code for queries that come through public DNS resolvers. | Use your own DNS resolver, or Spamhaus's Data Query Service. |
| You confuse AcelleMail's **Blacklist** with a public blocklist. | The **Blacklist** is your own suppression list. | Check public blocklists separately. |
| You send an email made mostly of images, with little text. | It scores higher in SpamAssassin, and readers see little when images are not shown. | Keep real text in the email. |

## Summary

1. Filtering happens in layers: at the connection, on the message and in the mailbox.
2. Blocklists check sending IP addresses and the domains of links. How you get off a list depends on the
   list.
3. Large providers expect authentication and valid reverse DNS.
4. A rule-based filter adds up points to a threshold. SpamAssassin's default is 5, and many sites change
   it.
5. Most word rules carry little weight, and the heavier ones look for stock spam phrases. Sender
   reputation and reader feedback carry much more.
6. Readers train the filter through spam reports, Not spam and unsubscribes. Microsoft rates bulk mail
   by its complaints (BCL).
7. Check before you send, but treat a content score as one hint among several.
8. In AcelleMail, use **Check spam score** on the campaign's **Confirm** step, once an administrator has
   switched it on.

Terms used here are defined in the [Email Marketing Glossary](https://acellesend.com/kb/articles/email-marketing-glossary).

---

## Related articles

- [Email Deliverability Explained: How Mail Reaches the Inbox](https://acellesend.com/kb/articles/email-deliverability-explained): Delivered is not the same as inboxed. What Gmail, Yahoo and Microsoft look at before they file your email, their sender rules, and the AcelleMail settings.
- [Email Sending Explained: SMTP, APIs and Sending Services](https://acellesend.com/kb/articles/email-sending-explained): What happens after you click Send: SMTP, reply codes, retries and bounces, SMTP or API, the three ways to send, and the AcelleMail settings.
- [Sender Reputation Explained: IP, Domain and Warm-up](https://acellesend.com/kb/articles/sender-reputation-explained): What mailbox providers mean by sender reputation, IP and domain reputation, what moves it, how to warm up, how to check it, and the AcelleMail tools.
- [Email List Quality Explained: Sources, Spam Traps and List Hygiene](https://acellesend.com/kb/articles/email-list-quality-explained): Why bought lists fail, how good addresses go bad, the three kinds of spam traps, and the routine that keeps a list clean in AcelleMail.
- [Email Consent Explained: Opt-In, GDPR, CAN-SPAM and CASL](https://acellesend.com/kb/articles/email-consent-and-opt-in-explained): What makes email consent valid, single vs double opt-in, the proof to keep, and how GDPR, CAN-SPAM and CASL differ, with the AcelleMail settings.