What is a good spam score?

Aim well under the threshold rather than just below it. Against a common default of 5.0, a message at 2.0 has headroom to survive receivers whose rule sets differ or whose thresholds are stricter, while one at 4.8 passes today and fails after the next rule update. The absolute number matters less than the margin.

Why does the same message score differently at different receivers?

Because scores are local. Each operator chooses which rule sets to run, tunes individual rule weights, adds rules of their own, and may run a statistical classifier trained on their own users' mail. Large mailbox providers do not publish a rule-based total at all, filtering instead on proprietary reputation signals personalised to the recipient.

Does passing SPF and DKIM lower a spam score much?

Directly, only a little — the negative scores attached to authentication are small, because publishing the records is equally available to a spammer. Their importance is indirect: authentication is what allows a receiver to attribute a message to a domain and apply that domain's reputation, which influences placement far more than any individual rule.

Which parts of a spam score can a sender actually change?

Authentication results, reverse DNS, blocklist status, message structure such as a Date header and a real plain-text alternative, the image-to-text ratio, the domains you link to, and a List-Unsubscribe header on bulk mail. You cannot change the receiver's threshold, their local rules, or a classifier trained on the recipient's own mail.

Spam score: how content filters score a message

What a rule-based filter does

A rule-based content filter runs a large body of independent tests over a message. Each test is narrow — a header that is missing, a phrase in the body, an image-only message with no text alternative, a link whose domain appears on a URI blocklist — and each carries a score, positive for a spam indicator and negative for a legitimacy indicator.

Spam filter rules fall into a few families. Header rules look at structure and consistency. Body rules match text and HTML patterns. Network rules query DNS blocklists and check authentication. Statistical rules classify the message against a corpus the filter has been trained on. The total of everything that matched is the spam score, and only that total is compared to the threshold.

The consequence worth internalising is that no single rule blocks a message. A message crosses the threshold because several unremarkable things were true at once, which is also why removing the single highest-scoring rule often changes nothing.

Rules, points and a total

A filter's report lists what matched and what each match contributed. Reading one from the top gives an ordered list of things to change, and it takes very little practice to distinguish the ones you control from the ones you do not.

The values differ between filters, between rule set versions, and between installations that have tuned them, so a report is a description of one receiver's judgement rather than a universal measurement. The shape, however, is consistent everywhere.

The shape of a rule-based report. The scores shown are illustrative — every rule set and version assigns its own.

pts  rule name              description
---- ---------------------- --------------------------------------
 2.5 URIBL_LISTED           contains a URL listed in a URI blocklist
 1.4 HTML_IMAGE_ONLY_28     HTML with images and almost no text
 0.8 MISSING_DATE           message has no Date header
 0.0 HTML_MESSAGE           message has an HTML body part
-0.1 DKIM_VALID             message carries a valid DKIM signature
-0.1 SPF_PASS               SPF check passed
---- ---------------------- --------------------------------------
 4.5 total (threshold 5.0)

Rules that subtract

Not every rule adds. Valid authentication, a well-formed structure and a statistical classifier confident the message resembles legitimate mail all subtract, and those negatives are why an authenticated message survives a couple of unlucky content matches that would sink an unauthenticated one.

The negative scores attached to authentication are individually small, which surprises people who expect SPF and DKIM to carry more weight. They are small because they are cheap to obtain — a spammer publishes the same records. Their real effect is elsewhere: authentication is what lets a receiver attribute the message to a domain and apply that domain's reputation, and reputation moves far more than any rule.

The threshold

The threshold is where the total becomes a decision. A commonly used default is 5.0, with messages at or above it treated as spam, and many deployments run a second, higher threshold above which a message is rejected outright rather than filed.

Nothing obliges a receiver to use those numbers. An operator handling mail for a security-conscious organisation may set the threshold lower, one that has been criticised for lost mail may set it higher, and large mailbox providers do not use a public rule-based total at all — their filtering is proprietary, reputation-led and personalised to the recipient.

So a score is a diagnostic, not a prediction. A message scoring 2.0 against a 5.0 threshold has real headroom and will survive a receiver whose rules run a little differently; a message at 4.8 passes today and fails on the next rule set update.

What you can change

Authentication. An aligned SPF or DKIM pass is a small negative score and the precondition for domain reputation to be applied at all.
Reverse DNS on the sending address, and a listing on a blocklist, both of which are network rules with substantial weight.
Message structure: a Date header, a well-formed Message-ID, a From that parses, and a multipart message with a genuine plain-text alternative rather than a placeholder.
The HTML-to-image ratio. An image-only message is a long-standing evasion pattern and is scored as one.
Link domains. A link to a shortener, to a domain registered days ago, or to a compromised site pulls in URI blocklist rules regardless of what your own domain does.
A List-Unsubscribe header on bulk mail, which is both a scoring input and the mechanism that keeps a complaint from becoming a spam report.
List hygiene. Sending to addresses that no longer exist produces bounces and eventually spam trap hits, and both feed the reputation the rules cannot see.

What you cannot change

The receiver's threshold, and which rule sets they run.
A statistical classifier trained on the recipient's own mail, which is personal to them and can score identical messages differently for two people at the same organisation.
Local rules an operator has written for their own site, which are invisible from outside.
The reputation of a shared sending address, unless you move off it.
The recipient's own filters and their history of moving your mail out of the inbox — or not opening it, which is a signal at every large mailbox provider.

How SenderProbe reports a score

SenderProbe scores a message you actually send. The workspace gives you an address, you send a message to it, and the result is a score out of ten alongside the spam-filter total and the threshold that would have blocked it, so a total is never presented without the number it was being compared against.

The findings are grouped into four sections. Filter covers the rule matches and their scores. Authentication covers SPF, DKIM and DMARC as the receiving side evaluated them. Blacklist covers the reputation of the address that connected. Content covers the structure of the message itself — the parts, the headers, the links and the ratios.

That grouping is deliberate: it separates what you fix in DNS from what you fix in the sending host and what you fix in the message template, which are three different pieces of work usually owned by three different people.

Check this on your own domain. The blacklist check reads the live records and reports what a receiver would see.

Open the blacklist check

Common questions

What is a good spam score?: Aim well under the threshold rather than just below it. Against a common default of 5.0, a message at 2.0 has headroom to survive receivers whose rule sets differ or whose thresholds are stricter, while one at 4.8 passes today and fails after the next rule update. The absolute number matters less than the margin.
Why does the same message score differently at different receivers?: Because scores are local. Each operator chooses which rule sets to run, tunes individual rule weights, adds rules of their own, and may run a statistical classifier trained on their own users' mail. Large mailbox providers do not publish a rule-based total at all, filtering instead on proprietary reputation signals personalised to the recipient.
Does passing SPF and DKIM lower a spam score much?: Directly, only a little — the negative scores attached to authentication are small, because publishing the records is equally available to a spammer. Their importance is indirect: authentication is what allows a receiver to attribute a message to a domain and apply that domain's reputation, which influences placement far more than any individual rule.
Which parts of a spam score can a sender actually change?: Authentication results, reverse DNS, blocklist status, message structure such as a Date header and a real plain-text alternative, the image-to-text ratio, the domains you link to, and a List-Unsubscribe header on bulk mail. You cannot change the receiver's threshold, their local rules, or a classifier trained on the recipient's own mail.

Keep reading

Related checks, definitions and guides.

What a rule-based filter measures, and what you control