What is a spam score?

Most spam filters don't make a yes-or-no decision about a message in one step. They run dozens or hundreds of checks, give each one a weight, and add them up. That total is the spam score. Knowing how the main filters score, and where they write the result, makes it much easier to work out why a message was junked or why spam got through.

What is a spam score?

A spam score is the combined result of a filter's tests on one message. Each test that matches adds or subtracts points: a failed authentication check, a sending IP on a blocklist, a suspicious link, a phrase common in spam. The filter compares the total with a threshold, then delivers, junks, quarantines or rejects the message. Our guide to how spam filters work describes the layers those tests come from.

Three things are true of every spam score:

• It belongs to one filter. A score of 4 in one system means nothing in another.
• It isn't the only input. Most filters also apply allow and block lists, reputation and policy before or after scoring.
• It's per message, per recipient system. The same newsletter can score differently at two companies.

How does SpamAssassin calculate a spam score?

Apache SpamAssassin, the open-source filter used by many hosting providers and gateways, is the clearest example. Each rule has a score, and the configuration documentation says "Scores can be positive or negative real numbers or integers." Rules meant to offset common false positives are given negative scores.

The threshold is required_score, which the documentation describes as the "score required before a mail is considered spam." Its default is 5. Administrators can raise or lower it, so a host may treat 3 or 8 as its line instead.

Rule scores aren't picked by hand one at a time. The SpamAssassin project assigns them with a trained model over real mail. The project's wiki says "The scores are assigned using a neural network trained with error back propagation", using statistics from contributors' mail spools, and that "rules are not related to one another"; a message is spam "due to the sum of all rule scores" (SpamAssassin Wiki).

What does the SpamAssassin header look like?

SpamAssassin writes its result into headers that all begin with X-Spam-. The default header lines include:

add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
add_header all Level _STARS(*)_

In a delivered message, that becomes something like:

X-Spam-Flag: YES
X-Spam-Status: Yes, score=7.2 required=5.0 tests=BAYES_99,HTML_MESSAGE,
  RDNS_NONE,URIBL_BLOCKED autolearn=no version=4.0.1
X-Spam-Level: *******

The example values are illustrative. The important parts are score, required and the list of tests that matched. The test names tell you why, which is far more useful than the total. Many hosting control panels and gateways built on SpamAssassin use these headers, sometimes renamed.

How does Microsoft 365 score spam?

Microsoft 365 writes two numbers into its headers, but neither is a simple spam score.

Spam confidence level (SCL)

The SCL appears in the X-Forefront-Antispam-Report header with a value of -1 or 0 to 9. Microsoft says "An SCL value of 5 or higher generally indicates the message is considered bad" (Microsoft Learn).

Then comes the caveat. In cloud organizations, the SCL "doesn't determine whether spam filtering identifies a message as Spam or High confidence spam, and it doesn't determine the action taken on the message." Microsoft says the same SCL can appear on messages with different verdicts. Its main remaining uses are:

Microsoft also notes that even when a rule requests -1, the stamped value "might not be -1 (for example, 0 or 1 ...)".

Bulk complaint level (BCL)

The BCL rates bulk mail, such as newsletters and marketing, by how likely it is to draw complaints. It's in the X-Microsoft-Antispam header (Microsoft Learn):

Messages at or above the policy threshold are treated as bulk. The threshold is 7 in the default anti-spam policy, 6 in the Standard preset policy and 5 in the Strict preset policy.

What to read instead of SCL

To see what Microsoft 365 actually decided, read SFV (which component decided) and CAT (which protection applied) in X-Forefront-Antispam-Report (Microsoft Learn). Our Microsoft 365 spam headers guide decodes every field.

Does Gmail use a spam score?

Gmail certainly weighs many signals, but it doesn't show recipients or senders a per-message number. What you can see:

• Show original. In Gmail on the web, open the message, select More > Show original to see the full headers (Gmail Help). They include SPF, DKIM and DMARC results, but no score.
• The Spam folder banner. Gmail shows a warning at the top of each message in Spam explaining why it was filed there (Gmail Help).
• Postmaster Tools. For mail you send, Google reports domain-level data rather than message scores. Google's sender guidelines say to "Keep spam rates reported in Postmaster Tools below 0.3%." See our Postmaster Tools guide and spam complaint rate explained.

How do the main filters compare?

How do you find the spam score in a message?

1. Get the full headers. In Outlook, use View message details or File > Properties. In Gmail, use Show original. Our guide to how to read email headers covers other clients.
2. Search for the filter's headers. X-Spam- for SpamAssassin-based filters, X-Forefront-Antispam-Report and X-Microsoft-Antispam for Microsoft 365, and any vendor-specific header from your gateway.
3. Read the reasons, not just the number. In SpamAssassin, the tests= list. In Microsoft 365, SFV, CAT and BCL.
4. Check authentication too. The Authentication-Results header shows SPF, DKIM and DMARC, which often explain a high score.

Paste the headers into our Email Header Analyzer to pull these fields out. It runs in your browser, so nothing is uploaded.

Remember that a message can pass through several filters. A message filtered by a gateway and then by Microsoft 365 carries both sets of headers. Read the ones added by the system that made the final decision.

Why are spam score checkers of limited value?

Online "spam score" checkers usually run one engine, often SpamAssassin rules, over a test message you send them. They're good at spotting obvious problems:

• missing or failing SPF, DKIM or DMARC
• a sending IP on a public blocklist
• broken HTML, no plain-text part, or a missing Message-ID or Date header

They're much weaker at predicting inbox placement at the big providers:

• Different filters, different rules. A 0.0 in one engine says nothing about Gmail or Microsoft 365.
• Reputation dominates. Large providers weigh your domain and IP history and how recipients react. A one-off test can't measure that.
• Content tweaks rarely fix reputation problems. Removing the word "free" won't help a domain with a high complaint rate.
• Bulk is a separate judgment. A newsletter can score cleanly and still carry a high BCL in Microsoft 365.

Use a checker as a smoke test before a campaign or after a DNS change. For deliverability problems, look at authentication, list quality and complaint rates first. Our guide to why emails go to spam works through the usual causes.

Our free Deliverability Test is one example. You send one message and it reports SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and our filter's spam verdict. A clean result is a good sign, not a guarantee for every inbox.

Next steps

1. Pull the headers from one message that landed in junk and one that didn't, and compare the scores and test names in the Email Header Analyzer.
2. Check your own domain's SPF and DMARC with the SPF Checker and DMARC Checker, since failed authentication is one of the most common reasons scores rise.
3. Send a test through the Deliverability Test after any change to how you send.
4. If wanted mail is being caught, read false positives: legitimate email flagged as spam before adding broad allow rules.

Read more email security basics.