What signals do filters analyze (header, content, behavior)?

Filters analyze signals across three domains: headers, content, and behavior. Each domain reveals different aspects of message legitimacy.

Header analysis examines the technical envelope: authentication results (SPF, DKIM, DMARC), routing information, timestamps, and header consistency. Forged or malformed headers are immediate red flags.

Content analysis scans the message body for spam indicators: suspicious phrases, excessive links, URL reputation, image-to-text ratios, HTML quality, and attachment types. Filters also check for content fingerprints that match known spam campaigns.

Behavioral analysis tracks how recipients interact with mail from that sender. Opens, clicks, replies, deletions, and spam reports all feed into reputation. Filters weight recent behavior more heavily than historical patterns.

Headers tell the filter where the ship came from. Content reveals what cargo it carries. Behavior shows how other harbors have received it.