What are content filters vs policy filters vs reputation filters?

Three filter types decide whether your mail lands in the inbox, the spam folder, or nowhere at all. They look at different things and they fail for different reasons. If you treat them as one blob called "the spam filter," you will fix the wrong problem.

Content filters

Content filters read the message. Subject line, body text, HTML structure, image-to-text ratio, link destinations, attachment types, encoding. SpamAssassin is the textbook example: it runs hundreds of rules against the message and adds up a score. A score above the threshold gets flagged. Apache documents the full rule set and how scoring works if you want to see what an engine actually checks.

What trips content filters in practice: link shorteners, mismatched display text vs href, single-image emails with no text, attached HTML files, words like "verify your account" stacked next to a suspicious URL, broken HTML that looks obfuscated.

Content filtering catches the message regardless of who sent it. A brand-new sender with a clean record can still get flagged if the message looks like phishing. See what signals do spam filters look at for the longer list.

Policy filters

Policy filters enforce rules the receiving organization wrote down. They are not trying to catch spam. They are enforcing IT policy, compliance requirements, or legal obligations.

Examples you will actually hit:

• Block all .zip and .exe attachments at the gateway.
• Require TLS for any mail containing strings that look like credit card numbers or social security numbers.
• Reject mail from external senders to the executive distribution list.
• Quarantine anything that fails DMARC when the policy is p=reject, even if the content is clean.
• Strip macros from Office documents before delivery.

Microsoft Defender for Office 365 calls these mail flow rules (transport rules) and the admin can write whatever they want. Google Workspace has the equivalent under content compliance rules. Mimecast, Proofpoint, and Barracuda all expose the same concept under different names.

If your mail is getting blocked by a policy filter, no amount of reputation work or content cleanup will fix it. You need the receiving admin to change the rule or whitelist you.

Reputation filters

Reputation filters score the sender, not the message. They check:

• IP address history (how much spam came from this IP in the last 30, 60, 90 days)
• Sending domain history and age
• Authentication results (SPF, DKIM, DMARC alignment)
• Complaint rate from recipients hitting "this is spam"
• Engagement signals (opens, replies, deletes-without-opening, time-in-inbox)
• Spam trap hits
• Public blocklist status (Spamhaus, SURBL, URIBL)

Mailbox providers like Gmail and Yahoo run their own internal reputation systems on top of public signals. Google's Postmaster Tools shows you the domain reputation Gmail has assigned you: High, Medium, Low, or Bad. Yahoo, Microsoft, and Comcast run similar internal scores you cannot see directly.

A reputation filter will block a perfectly clean welcome email if it came from an IP that sent 10,000 complaints last week. This is why warming a new IP matters and why buying a list trashes a previously good domain.

For more on this layer specifically, see spam filtering vs reputation systems.

How they stack in real systems

No modern mail system uses just one. A message hitting Gmail goes through reputation checks at the SMTP connection layer first (IP reputation can get you a 4xx temp-fail before the message body is even accepted), then content scanning, then policy rules if the recipient is a Workspace customer with custom rules, then a final reputation pass that decides inbox vs Promotions vs Spam.

When you debug a deliverability problem, ask which layer rejected you:

• Bounced with a 5xx referencing a blocklist or IP reputation: reputation filter.
• Delivered to spam folder with a clean IP: content filter or per-user reputation.
• Rejected with "attachment type not allowed" or "message violates organizational policy": policy filter.
• Bounced only at certain receivers with the exact same message: policy filter, almost always.

Mixing them up is the most common reason people spend a month "fixing" the wrong thing.