What Spam Filters Actually Look At (and What They Don't)
Spam filters score sender identity, authentication, reputation, links, content and recipient behaviour. See which signals matter and which myths to ignore.
Much of the advice about spam filters is folklore: avoid the word "free", never use exclamation marks, keep the subject under 40 characters. Modern filters are statistical systems that look at many signals together, and the words in your message are only one of them. Knowing what they really weigh helps you spend effort where it counts.
The big picture: a score, not a rule
Most filters work by adding up evidence. Each signal pushes the message toward "good" or "bad", and the total decides where it goes: inbox, spam folder, or rejection. Open-source filters like Rspamd and SpamAssassin show this clearly, because they list the individual rules that fired and their points. The big providers use machine learning on far more data than any open-source system sees, but the principle is the same.
1. Who you are: identity and authentication
The first question is whether you are who you claim to be. The filter checks:
- SPF, DKIM and DMARC results, and whether they align with the visible From domain.
- Whether the sending IP has valid reverse DNS and a matching hostname.
- Whether the connection used TLS.
Failing here is the heaviest single penalty a message can get. It is also the easiest to fix.
2. Your history: reputation
Next, the filter asks what it already knows about you: the sending IP, the signing domain, the domains in your links, even the envelope sender. This is the sender reputation built from complaints, bounces and engagement. A good history can carry a mediocre message; a bad one sinks a perfect message.
3. Your list: signs of careless sending
Hitting known spam traps, high numbers of unknown users, or sending to addresses that have long been inactive all tell the filter that you collect addresses carelessly.
4. What you link to
Filters examine every URL:
- Domains on blocklists such as URL reputation lists.
- Link shorteners, which hide the real destination.
- Mismatches between the visible text of a link and where it goes.
- Many different domains in one short message.
Keep links honest. A link whose text says yourdomain.com/login but goes elsewhere is a classic phishing pattern.
5. The message itself
Content still counts, but in subtler ways than word lists:
| Signal | Why it matters |
|---|---|
| Missing plain-text part | Typical of bulk or poorly built mail |
| Image-only body | Hides text from filters |
| Broken or sloppy HTML | Often generated by spam kits |
| Hidden text, tiny fonts | Obvious attempt to trick filters |
| Very large attachments, certain file types | Executable and archive attachments are risky |
| Subject that shouts or misleads | "RE:" on a first message, all capitals |
| Missing headers | No Message-ID or Date looks machine-generated |
Specific words matter less than people think. A legitimate receipt can say "free shipping". What matters is the total pattern, such as a message made entirely of promotional phrases with no real information.
6. How recipients react
For large providers this is the strongest signal of all, because it measures real human judgement:
- Positive: replies, moving to a folder, marking "not spam", adding you to contacts, starring, forwarding.
- Negative: deleting without opening, ignoring for weeks, reporting spam, unsubscribing.
This is why a message from a known contact lands in the inbox even when its content looks like marketing, while the identical message from a stranger does not.
7. Behaviour over time
Sudden volume spikes, new sending IPs, and irregular patterns all look suspicious. Consistency is trustworthy. See how to warm up a new domain.
Myths to drop
- "Spam trigger word lists decide everything." They are a weak signal on their own.
- "Adding my own email to the BCC list fixes it." It does not.
- "A high open rate means inbox placement." Since Apple Mail Privacy Protection preloads images, open rates are inflated and unreliable.
- "Only content matters." Authentication and reputation outweigh wording.
- "A spam checker score of 10/10 guarantees the inbox." It only reflects one filter's rules, not the recipient's provider.
A sensible order of work
- Fix authentication and alignment.
- Clean the list and make unsubscribe easy.
- Send a consistent plain-text and HTML version with honest links.
- Warm up and monitor complaints.
- Only then polish copy.
What Mailions covers for you
Mailions takes care of the identity layer: SPF, DKIM and DMARC records per domain with a live check, and a sending path that your domain signs for. You stay in control of list quality, links and content. Webmail and the API produce standard messages, and you can send a test to a public temporary inbox or your own Gmail to inspect the headers (how to check).
Frequently asked questions
Do spam trigger words still matter?
Much less than people think. Modern filters weigh authentication, sender reputation and how recipients react far more than individual words. Misleading subjects still hurt, but swapping one word for another will not fix a deliverability problem.
Why does my email go to spam for some recipients but not others?
Each provider and each mailbox has its own filters. Personal history matters: people who open and reply to you teach their filter to trust you, while people who never engage may see the same message in spam.
Do images or links make emails go to spam?
Not by themselves. A message that is one large image with little text, links to poorly rated domains or URL shorteners can raise the spam score. Balanced text, honest links to your own domain and a plain-text version help.