# What is email filtering and how does it prevent spam?

> Email filtering blocks spam by checking sender reputation, authentication records, and message content. Learn how spam filters work and prevent false positives.

**Email filtering is the automated process of evaluating every inbound message against reputation, authentication, and content signals to decide whether it should be delivered to the inbox, routed to spam, or blocked outright.**

Despite decades of filtering technology, spam still makes up roughly 45–52% of all email traffic worldwide. Filters have improved dramatically, but so have the techniques attackers use to evade them. Understanding how filtering works — and what it looks for — is the foundation for keeping your domain's mail out of the junk folder while keeping threats away from your users.

## What email filtering actually checks

Modern filters run a message through several layers of analysis before it reaches a recipient. Each layer adds a signal; together they determine a spam score.

### 1. Sender reputation and IP reputation

The first gate is the sending IP's reputation. Mailbox providers maintain real-time databases of IP addresses and domains associated with spam campaigns, known as blocklists. If the sending server's IP appears on a major blocklist, the message may be rejected before filtering even begins. You can check whether your sending IPs are listed with a [blocklist checker](/tools/blocklist-checker) or verify your domain's current reputation with a [domain reputation lookup](/tools/domain-reputation).

### 2. DNS authentication records

After reputation, filters check three DNS-published authentication records that confirm the sending server is authorized and that the message hasn't been altered in transit.

![Authentication records that filters check](/images/figures/what-is-email-filtering-software-services-prevent-spam-fig1.webp)
*Filters query SPF, DKIM, and DMARC records in DNS to verify the sender before evaluating content.*

- **[SPF](/tools/spf) (Sender Policy Framework)** — a DNS TXT record listing every IP address and mail service authorized to send on behalf of your domain. A receiving server checks whether the sending IP is in that list.
- **[DKIM](/tools/dkim) (DomainKeys Identified Mail)** — a cryptographic signature added to the email header. The receiving server fetches your public key from DNS and verifies the signature, confirming the message wasn't modified after leaving your server.
- **[DMARC](/tools/dmarc) (Domain-based Message Authentication, Reporting, and Conformance)** — a policy record that ties SPF and DKIM together. It tells receiving servers what to do when authentication fails — deliver, quarantine, or reject — and where to send reports. Learn more about [what DMARC is and how it works](/learning/what-is-dmarc).

Failing any of these checks raises a message's spam score significantly. Since Google and Yahoo enforced bulk sender requirements starting February 2024 — with Gmail moving to hard rejection of non-compliant mail from November 2025 — passing SPF, DKIM, and DMARC alignment is no longer optional for senders who want reliable inbox placement. You can audit your full authentication posture with an [email security score check](/tools/email-security-score).

### 3. Content and structural analysis

Once authentication passes, filters analyze the message itself. Early content filters relied on keyword lists ("free," "act now"), but modern systems use machine learning models trained on billions of spam examples. They evaluate:

- The ratio of text to images
- Link destinations — whether URLs point to known malicious domains
- HTML structure anomalies common in bulk-sent or obfuscated mail
- Header inconsistencies (for example, the visible From address not matching the envelope sender)

You can inspect a suspicious message's headers directly with an [email header analyzer](/tools/email-header-analyzer) to see what signals filters see.

### 4. Engagement signals

Consumer mailbox providers like Gmail weight user engagement heavily: open rates, replies, moves-to-inbox, and "not spam" clicks all contribute to a sender's reputation over time. A consistent pattern of recipients marking messages as spam degrades deliverability for future sends, even for fully authenticated senders. Gmail's guidelines recommend keeping user-reported spam rates below 0.1% and emphasize never exceeding 0.3%, at which point automated enforcement actions begin.

## Why filters still let spam through (and block legitimate mail)

No filter is perfect because spam and legitimate mail often share surface-level characteristics. A promotional offer from a trusted vendor looks similar to a phishing attempt at the structural level. Three failure modes matter most for businesses:

**False negatives (spam that reaches the inbox):** Attackers constantly probe filter behavior to find language and sending patterns that evade detection. Newly registered domains and IPs have no reputation history, making it easier to land in the inbox briefly before reputation catches up.

**False positives (legitimate mail flagged as spam):** Transactional emails — password resets, receipts, account alerts — are especially vulnerable if the sending domain lacks proper authentication. A missing [SPF record](/tools/spf) or broken DKIM signature is enough to trip filters even when the content is entirely benign. Understanding [what email deliverability means](/learning/what-is-email-deliverability) explains why authentication gaps cause real business impact.

**Phishing that passes filters:** A spoofed message that fails DMARC authentication can still land if the receiving domain has no DMARC policy to enforce, or if the attacker uses a lookalike domain not covered by your records. This is the gap that [email spoofing](/learning/what-is-email-spoofing-and-how-can-you-prevent-it) and [email impersonation](/learning/what-is-email-impersonation-and-how-can-you-prevent-it-in-2025) attacks exploit.

## Standalone software vs. integrated cloud filtering

Organizations choosing a filtering solution face two broad categories:

**Standalone (on-premise) software** installs on servers you control. It offers deep customization, works without internet access for air-gapped environments, and typically involves a one-time license. The trade-off is maintenance burden: threat intelligence updates, rule tuning, and infrastructure upkeep fall on your team.

**Integrated cloud services** sit in front of your mail flow as a gateway or are built into your email platform. They update continuously with live threat intelligence, require minimal setup, and scale automatically. The limiting factor is that you depend on the vendor's filtering logic, which you cannot fully customize.

For most businesses, cloud-based filtering is the practical choice. Built-in filters in Microsoft 365 and Google Workspace provide a reasonable baseline, but organizations with stricter requirements often layer a dedicated email security gateway on top.

## How authentication reduces false positives

The most reliable way to improve filtering outcomes on both sides — fewer spam messages landing and fewer legitimate messages blocked — is strong sender authentication. When your [SPF record](/tools/spf-generator) authorizes every sending service, DKIM signs every outbound message, and [DMARC](/tools/dmarc-generator) enforces rejection of failures, filters have high-confidence signals to work with. Authenticated mail from reputable domains is far less likely to be flagged as spam. Unauthenticated mail that claims to be from your domain is far more likely to be blocked or [identified as phishing](/learning/what-is-phishing).

## Frequently asked questions

### Does email filtering work the same way for all mailbox providers?

No. Each provider operates its own filtering stack with different weights for reputation, authentication, and engagement signals. Gmail, Microsoft 365, and Yahoo all enforce SPF, DKIM, and DMARC requirements, but the exact thresholds, enforcement timelines, and quarantine behaviors differ. What clears Gmail's filters cleanly may still be flagged by a stricter corporate gateway running additional anti-spam software.

### Can a message pass spam filtering and still go to the promotions tab?

Yes. Promotional tab placement in Gmail is separate from spam filtering. Gmail's tabbed inbox categorizes mail by content type — newsletters and marketing messages often land in Promotions even when fully authenticated and reputation-clean. Spam filtering decides whether mail is safe to deliver; tab placement decides where to put it. The best way to move out of Promotions is recipient engagement: subscribers who reply or move messages to the primary tab signal to Gmail that the mail belongs there.

### Do spam filters check links inside the email?

Yes. Most modern filters follow links in the message body and compare destinations against databases of known malicious URLs, phishing pages, and recently registered domains. Some enterprise gateways rewrite links to route clicks through a proxy that checks the destination in real time, even after delivery. If you receive a suspicious message, use a [phishing link checker](/tools/phishing-link-checker) before clicking anything.

### Why do authenticated emails sometimes still land in spam?

Authentication is a necessary condition for good deliverability, not a sufficient one. A domain can have perfect SPF, DKIM, and DMARC alignment and still get filtered if its sending IP is new with no reputation history, if recipients have previously marked similar messages as spam, or if the content triggers machine-learning models. Authentication removes a major barrier; sender reputation and engagement history determine what happens after that barrier is cleared.

### What is a spam trap and how does it affect filtering?

A spam trap is an email address operated by a blocklist provider or mailbox provider specifically to catch senders who acquire addresses from scraped or purchased lists. Spam traps never opt into anything, so any message sent to one indicates the sender doesn't maintain a clean, consent-based list. Hitting spam traps can result in the sending IP or domain being added to blocklists, which causes delivery failures across all recipients — not just the trap address.

## Related reading

- [What is email spoofing and how can you prevent it?](/learning/what-is-email-spoofing-and-how-can-you-prevent-it)
- [What is email impersonation and how can you prevent it in 2025?](/learning/what-is-email-impersonation-and-how-can-you-prevent-it-in-2025)
- [Understanding spam emails](/learning/understanding-spam-emails)
- [What is IMAP?](/learning/what-is-imap)