What Is a Spam Score and How Do Email Filters Decide?

A spam score is a number a filter assigns to an incoming email by adding up the results of many individual tests, each worth a positive or negative amount. If the total crosses a threshold, the message is sent to spam or rejected. Open-source filters such as SpamAssassin and Rspamd show the score in an X-Spam-Status header; Gmail, Outlook and Yahoo use similar scoring internally but never show the number.

Quick summary

• authentication (proof that email really comes from your company): SPF, DKIM and DMARC results. A missing or failing check adds points; aligned passes reduce them and unlock reputation-based trust.
• Reputation: the history of the sending IP, the sending domain, the DKIM domain and the domains in links. Complaints, bounces and blocklist hits push this up; consistent wanted mail pushes it down.
• Content and structure: subject line patterns, HTML quality, image-to-text ratio, link shorteners, attachments, mismatched display names, all-caps and currency symbols, missing List-Unsubscribe on bulk mail.
• The connection is checked first: reverse DNS, blocklists, and rate. A bad enough result rejects before content is even read.
• authentication (proof that email really comes from your company) is evaluated and recorded in Authentication-Results.

The three inputs every filter weighs

• authentication (proof that email really comes from your company): SPF, DKIM and DMARC results. A missing or failing check adds points; aligned passes reduce them and unlock reputation-based trust.
• Reputation: the history of the sending IP, the sending domain, the DKIM domain and the domains in links. Complaints, bounces and blocklist hits push this up; consistent wanted mail pushes it down.
• Content and structure: subject line patterns, HTML quality, image-to-text ratio, link shorteners, attachments, mismatched display names, all-caps and currency symbols, missing List-Unsubscribe on bulk mail.

Example: a SpamAssassin verdict header

X-Spam-Status: No, score=1.8 required=5.0
  tests=DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, HTML_MESSAGE=0.001,
        HTML_IMAGE_ONLY_16=1.6, URI_SHORTENER=0.3

X-Spam-Status: Yes, score=7.4 required=5.0
  tests=SPF_FAIL=0.9, DKIM_INVALID=0.1, RDNS_NONE=1.3,
        SUBJ_ALL_CAPS=1.5, MONEY_ATTACHMENT=2.5, MISSING_MID=1.1

How the decision is made

1. The connection is checked first: reverse DNS, blocklists, and rate. A bad enough result rejects before content is even read.
2. authentication (proof that email really comes from your company) is evaluated and recorded in Authentication-Results.
3. Content rules run and each match adds its weight.
4. Reputation data for the domain and IP adjusts the total, often by more than any single content rule.
5. At Gmail and Outlook, engagement is added: whether people open, reply, delete unread, or mark as spam. This is the biggest factor once the basics are right.
6. Score above threshold goes to spam; far above may be rejected with a 550.

How to check your score

• Send to a mailbox running SpamAssassin or Rspamd and read X-Spam-Status. Some hosting control panels expose this.
• Use mail-tester.com: send one message to the address it gives and read the itemised report.
• At Gmail, use Show original for the authentication summary, then watch which folder the message lands in with a fresh test account.
• Read your delivery logs. A 5xx mentioning spam content or reputation tells you which input failed.

Common mistakes that raise a score

• Sending an image-only email with almost no text.
• Using a display name that mentions a different brand than the From domain.
• Linking to a tracking domain or shortener that has been abused by others.
• Sending bulk mail without List-Unsubscribe and expecting the same treatment as one-to-one mail.
• Chasing tiny content rules while ignoring a failing DKIM signature or a 5% bounce rate.

Keeping scores low with OquMail

OquMail handles the parts that carry the most weight: aligned SPF, DKIM and DMARC through the guided DNS setup, sending IPs with correct reverse DNS and monitored reputation, and a delivery log for each message so a rejection is never a mystery. What remains is yours: write plain, useful messages, keep your list clean, and use the send API for transactional mail so receipts and alerts come from your own domain with a consistent identity.

Reading the score before you change anything

The tests listed in an X-Spam-Status header are ranked by weight, and the largest two or three usually explain the verdict on their own. Fix those first. A reverse DNS or authentication rule is worth more than any number of wording tweaks, and once it passes, the smaller content rules often stop mattering because the reputation adjustment moves the total below the threshold.

Common questions

Is there a single spam score threshold?

No. SpamAssassin defaults to 5.0, corporate gateways are tuned by their admins, and the big webmail providers use models rather than a fixed number.

Do spam words still matter?

Far less than a decade ago. A well-authenticated sender with good reputation can write "free" in a subject. A new or unauthenticated sender is judged harshly on everything.

Why does the same email land in the inbox for one person and spam for another?

Personal signals. Filters learn from each user: previous replies, contacts, and past spam reports adjust the verdict per mailbox.