What tools assign spam scores (e.g., SpamAssassin)?

You send an email, and somewhere between your outbox and your recipient's inbox, a filter looks it over and assigns it a number. That number can make the difference between delivered and deleted. So which tools are actually doing that scoring?

The most well-known is SpamAssassin, an open-source tool that's been running on mail servers for decades. It runs hundreds of individual rules across your email's headers, body, links, and sending metadata. Each rule adds or subtracts points, and the total determines whether the email passes or gets flagged. A score above 5.0 is the classic default threshold for "this is spam," though server admins can tune that number up or down. A lot of shared hosting and small business mail servers still run SpamAssassin under the hood without anyone realizing it.

A faster and more modern alternative is Rspamd. It does the same rule-based scoring but adds machine learning classifiers on top, so it can adapt to new patterns rather than waiting for a rule update. It's lighter on resources too, which is why many newer server setups have switched to it.

Then there are the commercial security platforms. Barracuda, Proofpoint, and Mimecast all use proprietary scoring engines that layer rule-based checks with threat intelligence feeds, link reputation databases, and sender history. These are common in enterprise environments, and their scoring logic is not public. You can't look up exactly which rule docked you points the way you can with SpamAssassin.

Gmail and Outlook are a different category entirely. They don't publish scores at all. Both use internal machine learning systems trained on billions of signals, and they factor in things like your domain's historical sending behavior, recipient engagement patterns, and global abuse signals. You won't get a number back from them. What you get is inbox, spam folder, or bounce, and you work backwards from there.

Here's what triggers high scores across all of these tools, regardless of which one is running:

• Authentication failures: missing or broken SPF, DKIM, or DMARC records add points fast
• Spammy content patterns: ALL CAPS subject lines, excessive exclamation marks, "FREE!!!", "Act now", financial come-ons
• Broken or suspicious links: URLs that redirect through shady domains, links that don't match their anchor text
• HTML issues: image-to-text ratio that's mostly image, hidden text, invisible pixels used outside of normal tracking
• Sending behavior: sudden volume spikes, high bounce rates, sending to known spam traps

If you want to see what score your email would get before you send it, tools like Mail-Tester and Mailtrap let you send a test message and get a SpamAssassin-style breakdown. You'll see which specific rules fired and how many points each one added. That's genuinely useful for diagnosing what's wrong with a template. You can also check your authentication setup with our free SPF checker or email header analyzer to see what signals filters are reading before your email ever hits a scoring engine.