How is a spam score calculated?

You send an email, and somewhere along the line a filter assigns it a number. That number is a spam score, and the way it gets calculated is more logical than it might seem.

The process works like a checklist with weighted points. Every email gets run through a series of individual tests. Each test checks for something specific, and if the email trips that test, it adds a certain number of points to the total. The final score is just the sum of all those points.

The tests fall into a few broad categories:

• Authentication checks. Did SPF, DKIM, and DMARC pass? Failures here add points fast, because unauthenticated email is a classic spam signal.
• Content patterns. Phrases like "FREE MONEY" or "CLICK NOW", excessive use of capital letters, too many links, image-heavy layouts with almost no text.
• Header anomalies. Forged or missing headers, mismatched sender fields, or timestamps that don't add up.
• Reputation signals. Is the sending IP or domain on a blocklist? Has it been flagged before?

Each test has a weight that reflects how strongly it predicts spam. A failed DKIM signature might add 2.0 points. Matching a known spam phrase might add 3.5 points. Something minor, like an unusual but not suspicious header, might add 0.1. The weights come from years of analyzing real spam patterns, and tools like SpamAssassin publish most of their rules openly so you can see exactly why your score landed where it did.

The threshold that matters most is the filter's cutoff, often 5.0 by default in SpamAssassin, though mail servers and ESPs can set their own. Score below it, you pass. Score above it, you're likely flagged as spam. Some filters apply a softer zone where email gets tagged but not blocked, leaving the final call to the recipient.

One thing worth knowing: different tools use different rule sets. SpamAssassin scores won't map exactly to what Gmail or Outlook does internally. They all use scoring logic, but their weights and thresholds aren't the same. Scoring well in one tool is a good sign, not a guarantee.

If you want to see your email's actual score before you send, our free Email Header Analyzer can help you spot authentication gaps and header issues that filters flag. Catching a 2-point DKIM miss before sending is a lot easier than diagnosing spam placement after.