What’s a “false positive” and “false negative”?

A false positive is when a legitimate email lands in spam. The recipient wanted it. The filter blocked it anyway. Your password reset, your invoice, your customer's reply to a sales thread - all gone to junk.

A false negative is the opposite. Spam reaches the inbox. The filter looked at it, shrugged, and let it through. Phishing emails that mimic Microsoft login pages are the classic case.

Both are filter mistakes. They sit on opposite ends of the same dial.

The tradeoff every filter operator lives with

Spam filters score each message and compare that score to a threshold. SpamAssassin, for example, defaults to a score of 5.0 - anything above is spam, anything below is ham (legitimate mail). Drop the threshold to 3.0 and you catch more spam (fewer false negatives) but you also start flagging newsletters, transactional mail, and anything that looks vaguely promotional (more false positives). Raise it to 7.0 and clean inboxes get cleaner, but the obvious junk starts slipping through.

Gmail, Outlook, and Yahoo do not expose a single dial like this. They run ensemble models - hundreds of signals weighted by machine learning, tuned per-user, retrained constantly. But the underlying tradeoff is identical. There is no setting that gives you zero of both.

This is why filters keep retraining. Every "Report spam" click and every "Move to inbox" click is labeled training data. Gmail's filtering team has publicly described how user reports feed into TensorFlow models that re-score borderline mail. One person marking your newsletter as spam will not move the needle. A thousand people doing it in a week will.

What this looks like on the sender side

If you send email for a living, you mostly worry about false positives - your own mail wrongly classified as spam. The signals that push you across the threshold are not mysterious. They are the same header, content, and behavior signals every filter looks at: authentication failures (SPF, DKIM, DMARC), domain reputation, complaint rate, spam trap hits, content patterns, sending volume jumps.

A filter does not need a smoking gun. It needs the score to tip past the line. A weak DMARC alignment plus a new sending IP plus a subject line in ALL CAPS can be enough on its own, even though none of those three would matter in isolation.

False negatives are the recipient's problem more than the sender's, but they affect you indirectly. Every phishing email that lands in someone's inbox raises the cost of trust for every legitimate sender. That is part of why Gmail and Yahoo tightened bulk sender requirements in February 2024 - they were tired of carrying the false negative load. See the Google bulk sender guidelines for the current rules.

How to read your own data

The practical question is: which way is your mail failing right now?

• High complaint rate (above 0.3 percent on Google Postmaster Tools) means recipients are reporting you - you are causing false negatives in their view, which becomes a real positive against you next time.
• Low open rates on a previously engaged list often mean false positives - your mail is filtering to spam and recipients never see it.
• Sudden delivery drop with no content change usually means you crossed a reputation threshold. The filter retuned around you.

Run seed tests to a spread of inboxes (Gmail, Outlook, Yahoo, Apple) and watch where mail lands. If 8 out of 10 land in spam at Gmail but inbox everywhere else, the false positive is Gmail-specific and you have a reputation problem there, not a content problem broadly.

Neither error type goes to zero. The job is keeping both low enough that recipients trust the inbox and senders trust the system.