How does a spam filter work?
What is a spam filter?
A spam filter is the doorman of your mailbox. Every mail that comes in is checked before it reaches your inbox. If the filter recognises a message as spam, phishing or malware, it goes to the spam folder or is rejected. The rest simply comes through.
"Spam" is unsolicited bulk mail: advertising, scams, fake invoices. The filter tries to separate that from the mails you do want: an order, a quote, a message from a customer. Making that distinction is trickier than it sounds, because senders of spam do their best to look genuine.
How exactly does a spam filter work?
A filter doesn't look at one thing, but at a combination of signals. Roughly in three layers:
- The sender and the connection. Is the sender's domain correct? Does the mail come from a server that really belongs to it? Here technical checks such as SPF, DKIM and DMARC play a role: arrangements that confirm a sender is who they claim to be. If a sending server is known for spam, that counts too.
- The content. The filter reads the text, the subject line, links and attachments. Certain patterns (urgent payment requests, suspicious links, lots of spelling mistakes, misleading formatting) increase the chance that something is spam.
- The behaviour and reputation. Does a sender suddenly send thousands of identical mails? Do recipients mass-click "this is spam"? Such signals build up a reputation score.
Each signal gets a weight. Together they produce a score. If it's above a threshold, the mail ends up in the spam folder.
Where machine learning comes in
In the past, filters worked mainly with fixed rules ("contains the word X? then spam"). Spammers easily circumvented those rules. That's why modern filters use machine learning: the system is trained on millions of examples of real mail and spam, and as a result recognises patterns that no human can capture in rules in advance.
The big advantage is that such a filter grows along. If new tricks appear, the system learns to recognise them without anyone having to manually add a rule. It weighs the hundreds of signals more cleverly than a fixed rule list ever could, and it adapts to what's going around today instead of to what applied yesterday.
Why it matters
For an office manager or small business, a good spam filter is pure time savings and safety. Without a filter your inbox is a jumble of real mail and junk, and something dangerous slips through more easily: a fake invoice, a phishing link, an attachment with malware.
There are two kinds of mistakes a filter can make, and you want to keep both low:
- False positive: a real mail wrongly ends up in the spam folder. Annoying, because you might miss an order or a message from a customer.
- False negative: a spam or phishing mail comes into your inbox after all. Risky, because then you have to recognise it yourself.
A strong filter seeks the balance: hold back as much junk as possible without blocking real mail. If you find that your own mail ends up in other people's spam, read why email ends up in spam and how to prevent it.
What to watch out for
A filter does a lot automatically, but you can help it become smarter:
- Check your spam folder now and then. That way you catch the occasional false positive in time, and you see straight away whether the filter is working well.
- Flag mistakes. If you move a real mail back to your inbox or mark something as spam, you give the filter a learning signal. Whitelist regular senders that are wrongly held back.
- Don't just click "unsubscribe" in real spam. With fake mail that actually confirms your address is active. Just mark it as spam.
- Be sparing with your address. The less your main address is scattered around public places, the less spam you attract. An alias for sign-ups helps.
How to fine-tune your own filter and whitelist senders is covered in managing your spam filter.
And at Mailflux
At Mailflux, spam filtering is included as standard in every plan, and it's ML-driven: the system recognises spam, phishing and malware based on learned patterns and grows along with new tricks. You don't have to install anything for it or keep anything up to date yourself. It works from day one.
On top of that, every plan includes antivirus, antispam and antimalware. If you choose Pro or Premium, you get premium antimalware for an extra solid layer. Everything runs on mailboxes hosted in Europe and GDPR-compliant. More about the basics can be found in email on your own domain.
FAQ
Frequently asked questions
Why does good email sometimes end up in my spam folder?
No filter is perfect. A real mail can show spam characteristics: for example lots of links, an unknown sender or missing technical verification. Take the mail out of the spam folder and mark the sender as trusted; the filter learns from that and lets that sender through from then on.
Can I turn a spam filter off completely?
That's rarely wise. Without a filter, all spam, phishing and malware comes straight in, and you have to judge everything yourself. It's better to keep the filter on and steer it: whitelist regular senders and flag mistakes, so it fits your mail better and better.
Does a spam filter also stop phishing?
Largely yes. A good filter recognises many phishing attempts by suspicious links, senders and patterns, and sets them aside. Still, something occasionally slips through, because phishing keeps getting more sophisticated. Stay alert yourself to unexpected payment requests and strange links: the filter and you together are strongest.