Understanding Email Spam Filters: How They Work

[Rajat K]

What are spam filters?
At their core, spam filters are software systems designed to detect and block unwanted, unsolicited, or malicious emails. They scan emails for signs with spam, including anything from suspicious sender details to spammy language, malicious links, or attachments.

Outbound email filters check outgoing emails. If your message looks suspicious with too many links, missing subject line, spam-triggering phrases it may be rejected or flagged, protecting your domain from being blacklisted.

Types of spam filters based on setup
1. On-Premises (Gateway) spam filters:
These are hardware or virtual appliances installed within your network and operate through pre-defined rules set by your team, filtering mail before it reaches your mail server.
2. Cloud-based (hosted) spam filters:
These are hosted by third-party providers. Your domain's MX records are redirected to these servers, so the cloud service filters mail before the email is delivered to your mailbox.

3. Client-side (software-based) spam filters:
Installed on individual computers, these work alongside email applications (like Outlook).
Types of spam filters based on how they analyze the emails:
Spam filters can be classified as follows based on their detection method:

1. Content Filters: Scan email text, subject lines, and attachments for spam-like content or language.
2. Header Filters: Analyze metadata like sender info, IP address, routing paths, for anomalies.
3. Blacklist Filters: Block emails from IPs/domains on known spammer lists.
4. Rule-Based Filters: Use predefined or custom rules (e.g., flag emails with certain keywords).
5. Bayesian/AI Filters: Use machine learning to detect spam based on patterns in previous emails.

How spam filters work:
Most spam filters don’t rely on one method. They use multiple layers of checks to decide whether to let an email through. Here's how they typically work:

1. Sender reputation:
   • The sender’s IP and domain are checked against DNS-based blacklists (DNSBLs).
   • If they appear on a known spammer list, the email may be blocked outright.
2. Authentication checks:
   • Filters whether the sender’s domain has valid SPF, DKIM, and DMARC records.
   • Failing these tests increases the chance of being flagged as spam or sometimes rejected.
3. Header & metadata inspection:
   • Looks for forged email headers or inconsistencies between sender identity and server origin.
4. Content & attachment analysis:
   • Scans the body for spammy language, phishing links, or executable files.
   • Links are checked against databases of known malicious URLs.
5. Heuristic & Rule-Based Scoring:
   • Spam filters assign scores based on suspicious traits. For example:
   • SpamAssassin, a popular open-source filter, adds points for:
     • ALL CAPS in subject (+1.0)
     • No subject line (+2.0)
     • Link obfuscation (+2.5)
     • Spammy phrases like “Act Now!” (+1.5)
   • If the total score exceeds a threshold (e.g., 5.0), the email is marked as spam.
6. AI & Machine Learning:
   • Advanced filters use ML to identify patterns across millions of emails.
   • They adapt to new spam techniques and get better over time using user feedback (“Mark as Spam” actions).
7. Permission and Challenge based filters:
   • Some systems require senders to pass a challenge (like CAPTCHA) or be on an approved sender list before emails are delivered. (This system has become outdated since Email authentications like SPF, DKIM, and DMARC handle this)

Limitations of spam filters:
Despite their sophistication, no spam filter is foolproof. Common issues include:

• False positives: Some legitimate emails with words like "free" or "money" may be marked as spam.
• False negatives: Illegitimate emails may still slip through filters by fabricating or avoiding the spam words.
• Filters may struggle with brand-new or zero-hour threats (A zero-hour threat refers to a brand-new spam or malware campaign that hasn't yet been seen by traditional filters)

Some of the popular spam filters:

• SpamAssassin
• Mimecast
• Barracuda
• Microsoft defender for outlook 365

Remember: The human verification still matters. Always be cautious before clicking links or downloading attachments, even if an email looks clean.