Email spam statistics 2026: what our filters held

Almost one in five inbound messages sent to the business domains we filter is spam, phishing or malware. From 1 September to 18 October 2026, iBlockSpam held 21,837 of 121,595 inbound messages (18.0%) across six business domains before they reached anyone's inbox. This page publishes those figures each month, with the method, the limits and a free CSV.

How much business email is spam?

In September 2026, 17.9% of inbound mail to the domains we filter was held as spam, phishing or malware. The first 18 days of October came in at 18.0%. The two periods are close, which suggests a fairly steady background level of unwanted mail rather than a one-off campaign.

"Held" means the filtering service stopped the message before delivery: spam, phishing, malware and spoofed mail. Held messages go to each user's personal quarantine, where they can be reviewed and released. "Delivered" is everything that passed the filters.

Does the spam rate differ between businesses?

Yes, a great deal. In September the held share ranged from 2.1% to 71.1% across the four domains that received more than 1,000 messages. Two businesses of similar size can have completely different spam problems.

Two further domains received fewer than 200 messages each in September and are included in the totals but not shown. Common reasons for a high rate are addresses published on websites for years, catch-all mailboxes that accept mail for any address, and old domains that still receive mail for former staff. Domain D is that kind of domain: most of what arrives is unwanted. A low rate usually means few public addresses and a domain that is not widely known.

Which day of the week gets the most spam?

Mondays get the most spam by volume, and Saturdays have the highest spam share. Legitimate business mail falls sharply at weekends, while spam falls much less, so the proportion of spam goes up when offices are closed.

Averages are over the 48 days, so each weekday appears six or seven times. On a typical weekday the service held about 514 messages, compared with about 314 a day at weekends. That matters for weekend cover: fewer people are watching inboxes, and a larger share of what does arrive is unwanted. Phishing that lands on a Saturday can sit unread, and unreported, until Monday.

Busiest and quietest days

• Most mail held: Tuesday 8 September 2026, 678 of 3,188 messages (21.3%).
• Least mail held: Sunday 4 October 2026, 220 of 1,972 messages (11.2%).
• Highest held share: Saturday 12 September 2026, 309 of 1,129 messages (27.4%).
• Lowest held share: Thursday 24 September 2026, 444 of 4,063 messages (10.9%).

How often are real emails blocked by mistake?

Rarely, by the measure we have. Users reported 6 messages as false positives out of 121,595 inbound messages over the 48 days: about 1 in 20,000, or 0.03% of held mail. A false positive is a legitimate message the filter held as spam.

This figure counts only false positives that users reported. Someone who finds a real message in their quarantine digest and releases it without reporting it is not counted, so the true rate is higher than the reported one. That is why every user gets a personal quarantine and a digest email: a wrongly held message stays recoverable. See quarantine and digests for how release works.

How is this data collected?

The figures are the daily statistics the filtering service records for each domain. iBlockSpam reads them through the same read-only statistics feed that powers the mail stats in our customer portal. We add the domains together and remove every domain name before publishing. No message content, sender or recipient is used.

1. Sample: six business domains whose inbound mail is filtered by iBlockSpam, including our own. Four received more than 1,000 messages in September; most of the volume comes from two.
2. Period: 1 September to 18 October 2026, one row per calendar day (UTC).
3. Counts: inbound total, delivered, held, and false positives reported by users.
4. Held: spam, phishing and malware, counted together as the service reports them. We don't publish a breakdown by threat type because the daily statistics don't separate them.
5. Updates: we add each full month in the first days of the next month and keep the older months in the CSV.

What this data can't tell you

• It's a small sample. Six domains are not the internet. Large mailbox providers see far more mail and different mixes of spam. Treat these figures as what a set of small and medium business domains experiences, not a global rate.
• Missed spam isn't measured here. The statistics include missed-spam reports, but users rarely file them, so we don't publish a missed-spam rate.

Download the data

The daily figures are in a CSV: email-spam-statistics.csv. Columns: date, weekday, inbound total, delivered, held, held share and reported false positives. The data is licensed under CC BY 4.0: you may reuse it with credit to iBlockSpam and a link to this page.

For a different kind of data, our study of email security at the top 1,000 websites measures how many large sites publish SPF, DMARC and MTA-STS records.

What should a business do with these numbers?

Plan for roughly one inbound message in five being unwanted, and much more if your addresses have been public for years. A filter in front of your mailboxes removes most of it before anyone has to judge a suspicious link.

1. Check your current setup. Run the free email health check to see your MX, SPF and DMARC records.
2. Find out what your platform already does. Compare Microsoft 365's built-in filtering with a gateway or Google Workspace's.
3. Close the domains nobody uses. Old and parked domains attract spam and spoofing; see how to protect parked domains.
4. Train for weekends and Mondays. Ask staff to report suspicious mail, and to be most careful with anything that arrived while the office was closed. Our guide to spotting a phishing email is a good start.

iBlockSpam filters inbound mail at the MX level, in front of the platform you already use, for one price per domain with unlimited mailboxes. See pricing.