How do filters calculate a spam score?

Imagine an email from captain@deepcurrent.io arrives at someone's inbox. Before it ever shows up, a filter has already run it through a stack of checks, assigned point values to each result, and added them all up. That total is the spam score. Here's how it actually works.

Step 1: Header and authentication checks

The first thing a filter looks at is the technical envelope. Did SPF pass? Did DKIM verify? Is there a DMARC policy in place? These checks happen before the filter even reads a word of your content. A passing SPF result might subtract 1.5 points from your score (meaning it works in your favor). A hard fail could add 3 or more. Missing authentication doesn't automatically kill you, but it removes a safety net you really want.

Step 2: Content and pattern analysis

Next, the filter scans the message body. Specific phrases, formatting choices, and link patterns all carry weights. A subject line in ALL CAPS might add 0.5 points. The phrase "act now" in the body might add another 0.3. A URL that redirects through a known suspicious domain could add 4 or 5 points on its own. These weights are set by the filtering tool and adjusted constantly based on what real spam looks like in the wild.

Formatting matters too. An email with no plain-text version, a single giant image, or a broken MIME structure will pick up points. None of these signals is fatal alone. But they stack.

Step 3: Reputation lookups

While content is being scanned, the filter is also querying external databases. Is your sending IP on a blocklist? Has your domain been flagged before? These reputation checks happen in real time and can add significant weight fast. Showing up on a major list like Spamhaus could push your score over the threshold in one shot.

Step 4: Machine learning layer

Modern filters don't rely only on rules. They also pass the message through a trained model that evaluates patterns too subtle for any single rule to catch. This layer looks at the email holistically, things like the ratio of links to text, how this message compares to others sent from the same IP, and whether the content resembles emails users have marked as spam before. This score gets folded into the total alongside the rule-based points.

How thresholds work

Once all the points are added up, the filter compares the total to its thresholds. Most systems have at least two. A mid-range score (say, 5.0 in SpamAssassin) typically means the message goes to the spam folder. A higher score (often 10.0 or above) can trigger an outright rejection before delivery even happens. Below the threshold and you're fine. Just above it and you're in the junk pile. Way above it and the server may not accept the message at all.

But the key thing to understand is that no single check makes or breaks the result. It's cumulative. A well-authenticated email with a slightly promotional subject line will probably still land. A poorly authenticated email with suspicious links and a blocklisted IP almost certainly won't, because every check added points and nothing subtracted them.

Want to see how a real email scores before you send it? Our free subject line tester checks one of the biggest content signals, and if you're seeing unexpected spam folder placement, the email header analyzer can show you exactly where your authentication stands.