# What is a spam score?

URL: https://iblockspam.com/blog/what-is-a-spam-score
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Email security basics
Author: iBlockSpam Team

> What an email spam score is, how SpamAssassin scores and Microsoft SCL and BCL work, why Gmail shows none, how to find scores in headers, and checker limits.

## Short answer

A spam score is a number a filter adds up from many checks to decide whether a message is spam. SpamAssassin sums rule scores and treats 5.0 or more as spam by default. Microsoft 365 stamps an SCL from -1 to 9 and a bulk complaint level (BCL) from 0 to 9. Gmail doesn't show a score. Each filter scores differently.

Most spam filters don't make a yes-or-no decision about a message in one step. They run dozens or hundreds of checks, give each one a weight, and add them up. That total is the spam score. Knowing how the main filters score, and where they write the result, makes it much easier to work out why a message was junked or why spam got through.

## What is a spam score?

A spam score is the combined result of a filter's tests on one message. Each test that matches adds or subtracts points: a failed authentication check, a sending IP on a blocklist, a suspicious link, a phrase common in spam. The filter compares the total with a threshold, then delivers, junks, quarantines or rejects the message. Our guide to [how spam filters work](https://iblockspam.com/blog/how-spam-filters-work) describes the layers those tests come from.

Three things are true of every spam score:

- **It belongs to one filter.** A score of 4 in one system means nothing in another.
- **It isn't the only input.** Most filters also apply allow and block lists, reputation and policy before or after scoring.
- **It's per message, per recipient system.** The same newsletter can score differently at two companies.

## How does SpamAssassin calculate a spam score?

Apache SpamAssassin, the open-source filter used by many hosting providers and gateways, is the clearest example. Each rule has a score, and the [configuration documentation](https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html) says "Scores can be positive or negative real numbers or integers." Rules meant to offset common false positives are given negative scores.

The threshold is `required_score`, which the documentation describes as the "score required before a mail is considered spam." Its default is 5. Administrators can raise or lower it, so a host may treat 3 or 8 as its line instead.

Rule scores aren't picked by hand one at a time. The SpamAssassin project assigns them with a trained model over real mail. The project's wiki says "The scores are assigned using a neural network trained with error back propagation", using statistics from contributors' mail spools, and that "rules are not related to one another"; a message is spam "due to the sum of all rule scores" ([SpamAssassin Wiki](https://cwiki.apache.org/confluence/display/SPAMASSASSIN/HowScoresAreAssigned)).

### What does the SpamAssassin header look like?

SpamAssassin writes its result into headers that all begin with `X-Spam-`. The default header lines include:

```text
add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
add_header all Level _STARS(*)_
```

In a delivered message, that becomes something like:

```text
X-Spam-Flag: YES
X-Spam-Status: Yes, score=7.2 required=5.0 tests=BAYES_99,HTML_MESSAGE,
  RDNS_NONE,URIBL_BLOCKED autolearn=no version=4.0.1
X-Spam-Level: *******
```

The example values are illustrative. The important parts are `score`, `required` and the list of `tests` that matched. The test names tell you why, which is far more useful than the total. Many hosting control panels and gateways built on SpamAssassin use these headers, sometimes renamed.

## How does Microsoft 365 score spam?

Microsoft 365 writes two numbers into its headers, but neither is a simple spam score.

### Spam confidence level (SCL)

The SCL appears in the `X-Forefront-Antispam-Report` header with a value of -1 or 0 to 9. Microsoft says "An SCL value of 5 or higher generally indicates the message is considered bad" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)).

Then comes the caveat. In cloud organizations, the SCL "*doesn't* determine whether spam filtering identifies a message as **Spam** or **High confidence spam**, and it *doesn't* determine the action taken on the message." Microsoft says the same SCL can appear on messages with different verdicts. Its main remaining uses are:

| SCL | Main use today |
| --- | --- |
| -1 | Requested by a mail flow rule to bypass most spam filtering |
| 5 or 6 | Requested by a mail flow rule to treat a message as spam |
| 9 | Requested by a mail flow rule to treat a message as high confidence spam |
| Any | Junk thresholds in on-premises and hybrid Exchange |

Microsoft also notes that even when a rule requests -1, the stamped value "might not be -1 (for example, 0 or 1 ...)".

### Bulk complaint level (BCL)

The BCL rates bulk mail, such as newsletters and marketing, by how likely it is to draw complaints. It's in the `X-Microsoft-Antispam` header ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)):

| BCL | Microsoft's description |
| --- | --- |
| 0 | The message isn't from a bulk sender |
| 1, 2, 3 | Bulk sender that generates few complaints |
| 4, 5, 6, 7 | Bulk sender that generates a mixed number of complaints |
| 8, 9 | Bulk sender that generates a high number of complaints |

Messages at or above the policy threshold are treated as bulk. The threshold is 7 in the default anti-spam policy, 6 in the Standard preset policy and 5 in the Strict preset policy.

### What to read instead of SCL

To see what Microsoft 365 actually decided, read `SFV` (which component decided) and `CAT` (which protection applied) in `X-Forefront-Antispam-Report` ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)). Our [Microsoft 365 spam headers guide](https://iblockspam.com/blog/microsoft-365-spam-headers-explained) decodes every field.

## Does Gmail use a spam score?

Gmail certainly weighs many signals, but it doesn't show recipients or senders a per-message number. What you can see:

- **Show original.** In Gmail on the web, open the message, select **More** > **Show original** to see the full headers ([Gmail Help](https://support.google.com/mail/answer/29436)). They include SPF, DKIM and DMARC results, but no score.
- **The Spam folder banner.** Gmail shows a warning at the top of each message in Spam explaining why it was filed there ([Gmail Help](https://support.google.com/mail/answer/1366858)).
- **Postmaster Tools.** For mail you send, Google reports domain-level data rather than message scores. Google's [sender guidelines](https://support.google.com/mail/answer/81126) say to "Keep spam rates reported in Postmaster Tools below 0.3%." See our [Postmaster Tools guide](https://iblockspam.com/blog/google-postmaster-tools-guide) and [spam complaint rate explained](https://iblockspam.com/blog/spam-complaint-rate-explained).

## How do the main filters compare?

| Filter | Score shown? | Where | Scale and threshold |
| --- | --- | --- | --- |
| SpamAssassin and filters built on it | Yes | `X-Spam-Status`, `X-Spam-Level`, `X-Spam-Flag` | Sum of rule scores; spam at `required_score`, default 5 |
| Microsoft 365 | Partly | `X-Forefront-Antispam-Report` (SCL), `X-Microsoft-Antispam` (BCL) | SCL -1 or 0 to 9, not the verdict; BCL 0 to 9 against a policy threshold |
| Gmail | No | Headers show authentication only | Not published |
| Commercial gateways | Varies | Product-specific headers | Product-specific |

## How do you find the spam score in a message?

1. **Get the full headers.** In Outlook, use **View message details** or **File** > **Properties**. In Gmail, use **Show original**. Our guide to [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers) covers other clients.
2. **Search for the filter's headers.** `X-Spam-` for SpamAssassin-based filters, `X-Forefront-Antispam-Report` and `X-Microsoft-Antispam` for Microsoft 365, and any vendor-specific header from your gateway.
3. **Read the reasons, not just the number.** In SpamAssassin, the `tests=` list. In Microsoft 365, `SFV`, `CAT` and `BCL`.
4. **Check authentication too.** The `Authentication-Results` header shows SPF, DKIM and DMARC, which often explain a high score.

Paste the headers into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to pull these fields out. It runs in your browser, so nothing is uploaded.

Remember that a message can pass through several filters. A message filtered by a gateway and then by Microsoft 365 carries both sets of headers. Read the ones added by the system that made the final decision.

## Why are spam score checkers of limited value?

Online "spam score" checkers usually run one engine, often SpamAssassin rules, over a test message you send them. They're good at spotting obvious problems:

- missing or failing SPF, DKIM or DMARC
- a sending IP on a public blocklist
- broken HTML, no plain-text part, or a missing Message-ID or Date header

They're much weaker at predicting inbox placement at the big providers:

- **Different filters, different rules.** A 0.0 in one engine says nothing about Gmail or Microsoft 365.
- **Reputation dominates.** Large providers weigh your domain and IP history and how recipients react. A one-off test can't measure that.
- **Content tweaks rarely fix reputation problems.** Removing the word "free" won't help a domain with a high complaint rate.
- **Bulk is a separate judgment.** A newsletter can score cleanly and still carry a high BCL in Microsoft 365.

Use a checker as a smoke test before a campaign or after a DNS change. For deliverability problems, look at authentication, list quality and complaint rates first. Our guide to [why emails go to spam](https://iblockspam.com/blog/why-are-my-emails-going-to-spam) works through the usual causes.

Our free [Deliverability Test](https://iblockspam.com/tools/deliverability-test) is one example. You send one message and it reports SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and our filter's spam verdict. A clean result is a good sign, not a guarantee for every inbox.

## Next steps

1. Pull the headers from one message that landed in junk and one that didn't, and compare the scores and test names in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
2. Check your own domain's SPF and DMARC with the [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), since failed authentication is one of the most common reasons scores rise.
3. Send a test through the [Deliverability Test](https://iblockspam.com/tools/deliverability-test) after any change to how you send.
4. If wanted mail is being caught, read [false positives: legitimate email flagged as spam](https://iblockspam.com/blog/false-positives-legitimate-email-flagged) before adding broad allow rules.

Read more [email security basics](https://iblockspam.com/blog/topic/basics).

## Frequently asked questions

### What is a good spam score?

It depends entirely on the filter. In SpamAssassin, lower is better, and a total under the required score, 5.0 by default, isn't marked as spam. Negative totals are possible. In Microsoft 365, the bulk complaint level is the more useful number: 0 means the message isn't from a bulk sender. There's no universal scale.

### What does SCL 5 mean in Microsoft 365?

Microsoft says an SCL of 5 or higher generally indicates the message is considered bad. But in cloud organizations the SCL no longer decides whether a message is marked spam or what happens to it. Read the CAT and SFV fields in the same header to see the real verdict.

### How do I check the spam score of an email I received?

Open the full message headers. Look for X-Spam-Status or X-Spam-Score from SpamAssassin-based filters, and X-Forefront-Antispam-Report and X-Microsoft-Antispam in Microsoft 365. Paste the headers into an analyzer such as our Email Header Analyzer to read them without decoding by hand.

### Does Gmail give emails a spam score?

Not one you can see. Gmail's Show original view shows the full headers and authentication results, and messages in Spam carry a short explanation, but Google doesn't publish a numeric spam score for each message. For your own sending, Google Postmaster Tools reports domain-level data such as the user-reported spam rate.

### Are online spam score checkers accurate?

They're accurate about their own rules, usually a single engine scanning one test message. They can't tell you how Gmail or Microsoft will treat your real mail, because those decisions depend heavily on your sending reputation, authentication and how recipients respond. Use them to catch obvious problems, not to predict inbox placement.

## Sources

- [Apache SpamAssassin: Mail::SpamAssassin::Conf (required_score, score, add_header)](https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html)
- [Apache SpamAssassin Wiki: How scores are assigned](https://cwiki.apache.org/confluence/display/SPAMASSASSIN/HowScoresAreAssigned)
- [Microsoft Learn: Spam confidence level (SCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-spam-confidence-level-scl-about)
- [Microsoft Learn: Bulk email detection and the bulk complaint level (BCL)](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-bulk-complaint-level-bcl-about)
- [Microsoft Learn: Anti-spam message headers](https://learn.microsoft.com/en-us/defender-office-365/message-headers-eop-mdo)
- [Gmail Help: Email sender guidelines](https://support.google.com/mail/answer/81126)
- [Gmail Help: Trace an email with its full headers](https://support.google.com/mail/answer/29436)
- [Gmail Help: Report spam in Gmail](https://support.google.com/mail/answer/1366858)

## Free tools for this guide

- [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test): Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/what-is-a-spam-score (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt