How email decides what is spam
The filter never sees one email in isolation
Every message that lands in an inbox has already been through a scoring pipeline that started before the “send” button was even pressed. Mail providers don’t evaluate a single email on its own merits. They evaluate the sender’s history, the sending infrastructure, the content, and the behavior of everyone who received similar mail before it. Spam filtering is a reputation system wearing a content filter’s clothes.
That framing matters because it explains why two nearly identical emails can have wildly different fates. One lands in the inbox, the other in spam, and the difference is rarely the words on the page. It’s everything surrounding those words: the IP the message came from, the domain’s age and history, the authentication headers, and how past recipients treated similar mail.
Authentication comes first
Before a filter reads a single word of the body, it checks whether the message is even allowed to claim it came from where it says it came from. Three protocols do most of this work.
SPF (Sender Policy Framework) lets a domain publish a list of IP addresses authorized to send mail on its behalf. When a message arrives, the receiving server checks the sending IP against that published list. A mismatch is a strong signal, though not an automatic rejection, since forwarded mail and misconfigured lists produce false positives too.
DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail, generated with a private key the sender controls. The receiving server fetches the corresponding public key from DNS and verifies the signature. If the body or key headers were altered in transit, the signature breaks. This is what stops someone from intercepting a message and tampering with it before it reaches the recipient.
DMARC ties the two together and tells receiving servers what to do when SPF or DKIM fails: quarantine the message, reject it outright, or do nothing but report the failure back to the domain owner. DMARC reports are how legitimate senders discover that someone is spoofing their domain, often before customers even notice.
None of these three protocols look at content. A perfectly written, honest message fails all of them if the sending infrastructure isn’t configured correctly, and a well-crafted phishing email passes all three if the attacker controls a domain and sets up SPF, DKIM, and DMARC correctly for it. Authentication proves identity, not intent.
Sender reputation is a running ledger
Past that gate, filters weigh reputation, which is really just a rolling scorecard for the sending IP and domain. Mailbox providers track bounce rates, spam complaint rates, how often recipients open or delete without reading, and how consistent the sending volume looks over time. A domain that sends fifty emails a day for months and suddenly sends fifty thousand in an hour looks like either a hijacked account or a spam operation, and the sudden shift itself is the signal, independent of what the fiftieth-thousand email says.
IP reputation works on a similar principle but at the infrastructure level. Shared hosting ranges and data center IP blocks carry a heavier burden of proof than a residential or long-established corporate mail server, because a meaningful share of the traffic historically originating from those ranges has been abusive. This is one of the reasons operators running any kind of outbound infrastructure at scale, whether email or otherwise, learn quickly that IP history compounds. A block of IPs previously used by a spam operation carries that reputation forward to whoever leases it next, sometimes for months.
Blocklists like Spamhaus, Barracuda’s reputation system, and provider-internal lists aggregate this data across the entire internet, not just what one mailbox provider sees. A domain or IP can get listed after abuse reports from unrelated networks, and getting delisted usually requires demonstrating the underlying cause was fixed, not just filing a request.
Content analysis still matters, just later
Once authentication and reputation clear the bar, filters do look at the message itself, but modern content analysis is far more statistical than the old keyword-blocking days. Bayesian filters, still a core technique inside many spam engines, build probability models from large corpora of known spam and known legitimate mail, then score new messages against word and phrase frequency patterns rather than a fixed blocklist of trigger words. This is why “free” and “click here” alone don’t doom a message the way they might have in 2004, and why filters adapt as spammers shift language.
Structural signals matter too: mismatched link text and destination URLs, image-heavy messages with little actual text (a technique historically used to dodge text-based filters), excessive urgency language, and HTML that renders differently than its underlying markup suggests. Filters also weigh how a message’s formatting compares to the sending domain’s own history. A domain that has only ever sent plain-text transactional receipts suddenly sending an HTML marketing blast is a deviation worth scoring.
The feedback loop that keeps filters current
What makes modern spam filtering hard to game consistently is that it’s not a static ruleset. Every “report spam” click, every message a user deletes without opening, and every message a user moves out of the spam folder feeds back into the model. Major providers process this feedback at a scale that lets them retrain scoring models continuously, which is why techniques that work for a week often stop working with no visible change on the sender’s end.
This feedback loop is also why spam operations that rotate through large numbers of sending domains and IPs exist in an arms race against providers that track reputation across those very rotations. Burning through fresh sending identities doesn’t reset the clock the way it might seem to, because reputation systems increasingly correlate behavioral fingerprints across ostensibly unrelated senders: similar sending patterns, similar infrastructure providers, similar content structure. The individual identity is disposable; the pattern underneath it is not.
Engagement is a filter input, not just an outcome
One layer that surprises people outside the industry is how much inbox placement depends on recipient behavior after delivery, not just pre-delivery scoring. If a large share of recipients open a message, reply to it, or move it from another folder into the inbox, that positive engagement signal feeds forward into how the same sender’s future mail gets treated. The inverse is also true: low open rates and quick deletions push future mail from that sender toward the spam folder, even if nothing about the content changed.
This is part of why legitimate email marketers obsess over list hygiene and sending only to people who’ve genuinely opted in. It’s not just a compliance formality. A list full of stale or uninterested addresses generates the exact behavioral signals, low engagement, high delete-without-open rates, that filters interpret as spam-like, dragging down deliverability for the sender’s future mail regardless of intent.
Why this system is hard to defeat cleanly
None of the individual mechanisms described here are secret. SPF, DKIM, and DMARC specifications are public. Bayesian filtering is a well-documented statistical technique. What makes spam filtering resilient isn’t any single layer, it’s that the layers are independent and cross-check each other. Passing authentication doesn’t help a message with bad content. Good content doesn’t help a message from a burned IP. A clean IP doesn’t help if the domain’s engagement history is poor. Defeating one layer just exposes the message to the next.
That layered, feedback-driven design is also why spam filtering keeps shifting under everyone’s feet, both spammers and legitimate senders alike. A configuration that reliably reaches the inbox today can degrade in a month as reputation models retrain on new data, which is exactly why sender reputation is something operators have to maintain continuously rather than something they set up once and walk away from.
Want more breakdowns of the systems running quietly underneath the internet’s plumbing? Head back to the Hidden Internet home page for the rest of the series.
Get new guides and videos first — join the Telegram channel.