What is SpamAssassin and how does it work?

SpamAssassin is an open-source spam filtering engine maintained by the Apache Software Foundation. It's been running since 2001 and remains widely used in hosting environments, corporate mail gateways, and as the scoring engine underneath many commercial filtering products.

Here's how it actually works. Every email that passes through SpamAssassin gets run against hundreds of individual tests. Each test either adds points (bad signals) or subtracts points (good signals). At the end, those points add up to a spam score. If the score crosses a threshold (usually 5.0 by default), the message gets flagged as spam or rejected outright.

The tests fall into a few categories:

• Header checks look for malformed or suspicious fields, missing or mismatched sender info, and encoding tricks.
• Content rules scan the body for keyword patterns, formatting red flags (all-caps subject lines, excessive punctuation, certain phrasings commonly found in spam).
• DNS-based checks query blocklists like Spamhaus to see if the sending IP or domain has a bad reputation.
• Authentication checks verify whether SPF, DKIM, and DMARC pass. Failing these doesn't always trigger SpamAssassin alone, but it removes the goodwill that passing them provides.
• Bayesian filtering uses statistical learning from previously classified spam and legitimate mail to identify patterns even SpamAssassin's rules haven't explicitly anticipated.

The key thing senders often miss: SpamAssassin is a scoring engine, not a binary blocker. No single test is likely to get you flagged. It's the accumulation of small negative signals that tips you over the threshold. A slightly suspicious subject line, a missing plain-text version, a link in a URL shortener, a cold sending IP without warmup history. None of those alone kills you. Combined, they can.

What can you actually control? More than you'd think:

• Pass SPF, DKIM, and DMARC (these are the easiest points to win back)
• Avoid subject line patterns that score badly (our free subject line tester can flag obvious triggers)
• Don't use URL shorteners in the body
• Always include a plain-text version alongside your HTML
• Keep your sending IP off blocklists (you can check with our free blocklist checker)
• Don't embed download links directly in your emails. Use cloud links (Google Drive, Dropbox) that recipients navigate to intentionally

Now, does SpamAssassin run on Gmail, Outlook, or Yahoo Mail? No. Those mailbox providers use proprietary filtering systems that are far more sophisticated and heavily weighted toward reputation and engagement signals rather than rule-based scoring. SpamAssassin is most relevant at the corporate mail gateway level, shared hosting environments, and self-hosted mail servers running Postfix, Exim, or similar MTAs.

That said, understanding how SpamAssassin scores email is genuinely useful. The rules it uses reflect decades of observed spam patterns, and many of those patterns still cost you points even with modern filters. Scoring clean in SpamAssassin is a decent baseline signal that your email isn't doing anything structurally suspicious.

If you want to know your actual score before sending, check out our guide on how to check your spam score before hitting send. Or if something is actively broken right now, our SOS hotline is free.