What a spam filter is deciding
Every message that reaches a mail provider has to be sorted: deliver to the inbox, send to the junk folder, hold for review or reject outright. A spam filter makes that call automatically, usually in a fraction of a second, for a very large volume of mail.
A filter does not read a message and know whether it is wanted. It looks at many signals and estimates how likely the message is unwanted or dangerous. Because it is working with probabilities, it will sometimes be wrong in both directions: a harmless message flagged as junk (a false positive) and a bad one let through (a false negative). Reducing one kind of mistake tends to increase the other, so providers choose a balance.
Signals that are commonly weighed
Providers keep the details private, partly because spammers would adapt, and the weighting changes over time. The categories below are widely described, though, and give a good picture.
Sender authentication. Does the message pass checks such as SPF, DKIM and DMARC, which help verify that the sending server is allowed to use the domain? Messages that fail these checks are more suspect. The mechanics are covered in the account of email delivery.
Sender reputation. Servers and domains build a track record. If a sending address has produced lots of complaints or bounced mail, or is new with no history, its messages may be treated cautiously. Mail from shared servers can be affected by the behaviour of other senders on the same system.
Recipient behaviour. When many users mark messages from a sender as spam, filters learn to treat the sender’s next messages the same way. When users open, reply to or move messages from a sender to the inbox, that suggests the mail is wanted. Your own actions teach your provider’s filter.
Message content. Wording, formatting and structure can matter: heavy use of capital letters, misleading subject lines, odd mixes of fonts, images with little text, and phrases common in scams. Content on its own is a weaker signal than it used to be, but it still contributes.
Links and attachments. Links to domains known for abuse, shortened links that hide a destination, or attachment types associated with malware raise suspicion. This is part of why email attachments and links deserve care.
Technical oddities. Mismatched headers, a sending server with no proper identifying name, or a message that appears to come from one place while its technical path suggests another can all count against it.
Patterns across many users. If the same message is arriving at thousands of mailboxes at once, a provider can recognise a mass mailing and react quickly.
Scoring in simple terms
A common way to picture it is as a score. Each signal adds or subtracts points, and the total determines the outcome. A message that passes authentication, comes from a long-established sender and is often opened by recipients scores low and goes to the inbox. A message that fails checks, uses a brand-new domain and contains a suspicious link scores high and goes to junk or is blocked. Messages in the middle might be delivered with a warning banner or placed in the junk folder.
Modern filters usually rely on machine learning trained on large amounts of mail, so they do not apply a simple fixed list of rules. This helps them keep pace with new tactics, but it also makes their decisions hard to explain for any single message.
Why some junk still gets through
- Attackers adapt. Spammers test messages against filters, rotate domains and change wording. A message that is new to the filter has no history to judge.
- Compromised accounts. Mail sent from a real person’s hijacked account has a good reputation and passes authentication, so it may arrive in the inbox.
- Targeted messages. A carefully written message sent to few people produces little signal. Many phishing emails are built this way.
- Legitimate-looking services. Scammers sometimes send from real platforms, such as shared documents or invoice tools, so the sending domain is trusted.
- Settings and trade-offs. A provider that blocks aggressively risks losing real mail, so it may let borderline messages through.
For this reason, a filter is a safety net and not a substitute for your own caution.
Why genuine mail goes to junk
False positives are frustrating, especially for important messages. Common causes include:
- The sender’s domain lacks proper authentication records.
- The sender is new, or sends rarely, so it has no reputation.
- The message resembles bulk marketing, with many links, images and promotional wording.
- Many recipients have previously marked similar mail as spam.
- The message is sent from a personal address through an unusual route.
- A first-time contact from someone you have never emailed before.
What you can do as a recipient
- Check the junk folder occasionally, especially if you are expecting something.
- Use “Not spam” or “Report not junk” for wanted messages, and move them to the inbox. This trains your filter.
- Add important senders to your contacts. Many providers treat contacts more favourably, though this is not a guarantee.
- Create a filter that always keeps messages from a particular sender or address out of junk, if your provider allows it.
- Mark real junk as spam rather than unsubscribing from senders you do not know. More on this in the guide to inbox management.
What you can do as a sender
If you run a small business or a newsletter, a few points help legitimate mail arrive:
- Set up SPF, DKIM and DMARC for your domain.
- Send only to people who have asked to hear from you, and make unsubscribing easy.
- Keep lists clean by removing addresses that bounce.
- Avoid misleading subject lines and an overload of links or images.
- Send from a consistent address and, where possible, a consistent volume.
Even with all this done, some mail will still be filtered, since no setup guarantees delivery.
A realistic expectation
Spam filtering is a large, constantly changing contest, and it works well enough that most people see only a small amount of junk. Occasionally a wanted message goes missing or an unwanted one slips through. Treating the junk folder as worth a glance, and unexpected messages as worth a second look, covers most of the gap that filters leave.