How do spam filters work?

A spam filter is a series of checks, not a single switch. Each check adds evidence for or against a message, and the filter combines that evidence into one decision. Knowing the layers helps you read headers, fix false positives and choose between the filtering built into your mailbox and a separate gateway.

What happens to an email before it reaches your inbox?

Inbound filtering runs in roughly this order. Different products name the steps differently, but the shape is the same.

Cheap checks run first. Rejecting a bad connection costs almost nothing. Scanning a large attachment costs much more. So filters drop the obvious junk early and save the heavy work for what's left.

Connection checks: who is knocking?

Before a message's content is even sent, the receiving server knows the sending server's IP address. That alone carries a lot of information.

IP blocklists

Many filters query DNS-based blocklists. RFC 5782 describes how they work: the filter reverses the IP address, adds the list's domain, and looks it up in DNS. If an answer comes back, the address is listed. For example, 192.0.2.99 is checked as 99.2.0.192.bl.example. Lists are run by different organizations with different listing rules, so filters usually weigh several of them rather than trusting one.

Server hygiene

Filters also look at basic signs of a properly run mail server:

• Does the IP address have reverse DNS, and does it match a forward lookup?
• Does the server greet with a sensible host name?
• Is it sending at a normal rate, or hammering many recipients at once?
• Does it follow the SMTP protocol correctly, or cut corners the way some spam software does?

None of these proves a message is spam. Together they help separate real mail servers from infected home computers and throwaway servers.

Recipient validation

Ideally, a filter knows which addresses exist on your domain and rejects mail to the rest during the SMTP conversation. Not every service does this, so ask your provider. Rejecting at this stage matters. If a filter accepts mail for unknown users and bounces it later, it sends bounce messages to forged addresses. That's backscatter, and it can hurt your own reputation.

Reputation: has this sender behaved before?

Reputation is history. A filter builds or buys knowledge about IP addresses, sending domains and the domains of links inside messages. A domain registered yesterday, linked from a message sent by a server with no track record, starts with little trust.

Bulk mail gets its own handling. Microsoft 365, for example, assigns a bulk complaint level to messages from bulk senders, and acts on messages that meet or exceed a threshold you configure. Newsletters aren't malicious, but people often don't want them, so many filters treat them as a separate category.

Authentication: is the sender who it claims to be?

Next, the filter checks whether the domain in the message is real:

• SPF checks whether the sending server is allowed to send for the envelope sender's domain.
• DKIM checks a cryptographic signature added by the sending domain.
• DMARC, now defined in RFC 9989, checks that SPF or DKIM passed for a domain aligned with the visible From address. It also tells receivers what the domain owner wants done with failures: nothing, quarantine or reject.

The results are written into an Authentication-Results header, described in RFC 8601. That header is the first place to look when you want to know why a message was treated the way it was. Paste a message's headers into the Email Header Analyzer to read it without decoding by hand.

Authentication proves where a message came from. It doesn't prove the message is safe. A phishing email from a newly registered lookalike domain can pass SPF, DKIM and DMARC perfectly. For what the three records stop and don't stop, see what is email spoofing.

Content and heuristics: what does the message look like?

Once a message passes the early checks, the filter looks inside it. Common signals include:

• Headers that are malformed, missing or inconsistent with each other.
• Links whose visible text doesn't match the real destination, or links to domains with a bad reputation.
• Phrases, layouts and images associated with known campaigns.
• Language or country of origin, where an admin has chosen to filter on them. Microsoft 365 offers both as optional anti-spam settings.
• Signs of mass mailing, such as many near-identical messages arriving at once.

Each signal adds to or subtracts from a score. Microsoft says its spam filtering "learns from known spam and phishing threats and user feedback from our consumer platform, Outlook.com," and that feedback from admins and users keeps it trained, which is why reporting missed spam and false positives helps over time. The final score is compared with thresholds to pick an action.

Heuristics cause most false positives. A legitimate invoice can look a lot like a fake one. If good mail is getting caught, our guide on false positives explains how to find the cause.

Attachment scanning: is the file dangerous?

Attachments get their own layer, because they're a common way to deliver malware.

1. File-type rules. Many filters block risky types outright. Microsoft's common attachments filter uses best-effort true type matching, which reads the file's contents rather than trusting the extension, so renaming invoice.exe to invoice.pdf usually doesn't help the attacker.
2. Signature scanning. Antivirus engines compare files with known malware.
3. Macro checks. Office documents with macros can be blocked or flagged, since macros can run code.
4. Sandboxing. Some products open the file in an isolated virtual machine and watch what it does. Microsoft calls this detonation in Safe Attachments, part of Defender for Office 365, and notes that scanning typically completes within 15 minutes.

Password-protected archives are a known gap: a scanner can't look inside a file it can't open. Treat unexpected encrypted attachments with suspicion. Our guide to dangerous email attachment types lists the file types worth blocking.

What happens after the verdict?

The filter now picks an action:

• Reject during SMTP. The sender gets an error and knows the mail wasn't delivered.
• Deliver to the inbox.
• Deliver to junk. The user sees it in a separate folder.
• Quarantine. The message is held outside the mailbox until someone releases it or it expires.
• Delete silently. Most products allow this, but it's hard to audit, so use it sparingly.

Quarantine is the safety net for uncertain verdicts. In Microsoft 365, malware and high-confidence phishing are always quarantined, and spam is kept for 15 days by default in the default policy, configurable from 1 to 30 days, according to Microsoft Learn. Users only find mistakes if they look, which is why quarantine digests matter. For more, read what is email quarantine.

Built-in filtering vs a gateway: what's the difference?

Microsoft 365 and Google Workspace both filter mail by default. A gateway is a separate service that your MX records point to, so it filters mail before your mailbox provider receives it.

A gateway changes what the mailbox provider sees. Every message now arrives from the gateway's IP address. Microsoft strongly recommends Enhanced Filtering for Connectors in this setup, and warns that skipping it leads to misclassified inbound mail. Google's inbound gateway setting does a similar job, and Google notes that Gmail doesn't enforce the sender's DMARC policy for mail arriving from the gateway, so the gateway must do it.

Both providers also let you reject mail that doesn't come through the gateway. Do that, or attackers can deliver straight to your mailbox provider and skip the gateway. Our comparison of Microsoft 365 built-in filtering vs a gateway and the guide to secure email gateways vs API-based tools go deeper.

Next steps

1. Open the headers of a recent spam message and a recent false positive in the Email Header Analyzer. Note which checks passed and failed.
2. Check your quarantine settings: who gets notified, how often, and how long messages are kept.
3. If you use a gateway, confirm your mailbox provider rejects mail that doesn't come through it.
4. Run MX Lookup to see which service receives your mail first. If you're considering an MX-level filter, how iBlockSpam works explains the setup.

To see what an MX-level filter looks like from the customer side, the iBlockSpam portal demo shows a dashboard with sample data: mail delivered and held, quarantine counts and the setup checklist.

Read more email security basics.