What a typical spam filter checks for can be divided into three categories:
Where the message came from
Anti-spam organisations have created special network lists called RBLs (Real-time blackhole lists). Spam filters check such lists for the IP address and domain name from which the message was sent. If the IP address matches one on the list, the spam score of the message increases, and that is why the email may land in spam.
Who sent the message
Using email headers, spam filters check whether the email was sent by a spam engine or by a real sender. Every email has a unique ID, but when spammers send mass emails, they all have the same ID.
What the message looks like
The spam filter analyses the body and subject of the email. Strings that can be identified as spam include 'buy now', 'lowest prices', 'click here', etc. It also looks for flashy HTML such as large fonts, blinking text, bright colours, and so on. Many spam filters compare the whole text to the number of suspicious words. So, for example, if your email is long, it will not be identified as spam because of a few suspicious words.
Valid Sender Information
Use a recognisable and legitimate sender email address. Avoid generic or suspicious sender names.
Ensure that the “From” field accurately represents your organisation or brand.
Clear Subject Line
Write a subject line that reflects the email’s purpose concisely.
Avoid misleading or clickbait-style subject lines.
Do not end a subject with a question mark or space.
Do not use only uppercase letters.
Do not use words like Test/Testing in the subject.
Structured Email Body
Organise your email content into paragraphs or sections.
Use headings, bullet points, and numbered lists to improve readability.
Do not use too many special symbols, especially at the beginning or end of the sentence.
Signature and Contact Information
Include a professional email signature with your name, job title, and contact details.
A well-formatted signature adds credibility to your email.
Avoid Excessive Links and Attachments
Limit the number of hyperlinks in your email.
Avoid overloading the email with files.
Be careful with images. It is recommended not to send emails containing only images. Make sure you have no fewer than two lines of text per image.
Do not use shortened URLs. Spammers often use these to hide their real URLs.
Avoid some types of attachments such as .exe, .zip, .swf. It is fine to use .jpg, .gif, .png and .pdf.
NOTE: Attachments are an important factor in spam filtering and overall message evaluation. Certain file types in attachments can increase the spam score of an email. As a result, messages containing such attachments are more likely to be rejected or filtered. These file types are not directly prohibited, but they are commonly associated with higher risk, which can affect deliverability.
Below you can check a list of attachment extensions that can negatively impact email delivery:
.ace .arj .cue .smi .zpaq .ade .adp .apk .appx .appxbundle .Bat .cab .chm .cmd .cpl .diagcab .diagcfg .diagpack .dll .dmg .ex .ex_ .exe .hta .img .ins .iso .isp .jar .jnlp .js .jse .lib .lnk .mde .mjs .msc .msi .msix .msixbundle .msp .mst .nsh .pif .ps1 .scr .sct .shb .sys .vb .vbe .vbs .vhd .vxd .wsc .wsf .wsh .xll .app .application .appref-ms .msh .msh1 .msh2 .msu .pl .ps2 .py .pyc .pyo .pyw .pyz .pyzw .reg .scf .shs .theme .vhdx .vsmacros .website .ws
Unsubscribe Option
The email should be identified as an advert if that is what you are sending.
Include an easy-to-find unsubscribe link. Compliance with anti-spam regulations is crucial. Honouring unsubscribe requests builds trust with recipients.
Plain Text Version Alongside HTML
Some email clients may not render HTML properly. Including a plain text version ensures accessibility for all recipients.
If possible, avoid using different font colours.
Domain Configuration
Check SPF, DKIM, and DMARC records. Sender Policy Framework (SPF) records allow domain owners to publish a list of IP addresses that are authorised to send emails on their behalf. The goal is to reduce the amount of spam and fraud by making it much harder for malicious senders to disguise their identity. DomainKeys Identified Mail (DKIM) helps you protect your company from email spam and phishing attempts. It provides a method for validating a domain name identity that is associated with a message through cryptographic authentication. Domain-based Message Authentication, Reporting, and Conformance (DMARC) helps protect your domain from email spoofing and phishing by defining how unauthorised emails should be handled. Domains without properly configured authentication records are significantly more likely to experience:
- placement in the spam folder;
- delivery delays;
- reputation-related restrictions;
- or message rejection by receiving providers.
We strongly recommend configuring all three authentication methods for any domain used for sending email.
Check your IP and domain in blacklists. If your IP or domain is blacklisted, you should whitelist it or contact your email service provider before sending emails.
If you use a newly registered domain name or it has not been used for sending emails before, it is necessary to warm it up for better deliverability. Feel free to check this guide: How to warm up your email sending domain
Other recommendations
We do not recommend purchasing email lists. It is common practice to purchase lists of potential clients. However, many email addresses in such lists are incorrect, and your IP/domain can get blacklisted for mass mailing very quickly. It is better to send individual emails to real people.
Check how your emails are delivered. You can create different email accounts with popular email providers such as Google, Yahoo, and so on, and send test emails to them.
Send emails to your clients on a regular basis and instruct your recipients on how to whitelist your email address.
Although anti-spam systems are quite advanced nowadays and should block about 90.9% of spam emails, it is important to note that no system is perfect enough to block 100% of spam emails for all users (at least for now).
When an email containing spam is incorrectly identified as a legitimate one and is delivered to the Inbox, it is called a false negative. For example, links that appear to be from familiar websites but in fact lead to phishing websites. So what factors contribute to false negatives?
A new spam pattern that is not yet known to the system. Since most anti-spam filters use machine learning technology, they constantly learn as they go, meaning that new spam patterns are added to their database for identifying such emails and blocking them. At the same time, spammers do this as well. As they constantly try to adapt to new realities to deceive anti-spam filters, they create new patterns that systems may not identify at once.
Subjective content filtering. In some cases, content filtering may be tricky. While some things are easy to identify, email content is not black and white. Of course, there are known indicators of spam: blocklisted domains, TLDs that are most often used for sending spam, executable file attachments, or known spam keywords contained in the email. However, content guidelines for spam are always changing, much like our world. That is what sometimes makes it difficult for anti-spam systems to distinguish whether an email is spam or ham.
Users may have different opinions about what is considered spam. The definition of spam can be very subjective for most recipients. Some refer to it as simply unwanted communication (including legitimate advertisements that they no longer wish to receive), even if such emails do not possess spam factors.
These types of emails are not usually considered spam by anti-spam systems and therefore can get to your inbox:
Direct marketing and newsletter emails that users agreed to receive (e.g. subscribed to);
Transactional emails (e.g. receipts, confirmations, invoices, etc.);
Auto-renew or "up for renewal" notices (for services that you willingly purchased);
Email bounce notifications;
Messages sent to the recipient by mistake.
At the same time, spam can be recognised by its exaggerated promises, sense of urgency, and commercial aims. Here are a few things to pay close attention to when checking a potential spam email:
Sender
First of all, spammers use long email addresses (using free email services such as Gmail, Yahoo, etc.) that contain a random collection of letters and numbers. For example, ell45704truiw@gmail.com.
In addition, they may impersonate reputable organisations to gain access to your data. For example, you may come across fake email addresses that resemble real ones (such as @paypai.com for PayPal or @nelflix.com for Netflix, which are not their domains). It is sometimes difficult to spot the difference at once, which is why it is very important to look closely at the sender, especially before clicking links in the email or replying to it.
Language
Typos, incorrect spelling, obvious grammatical mistakes, or resemblance to a poorly translated text from another language are also obvious signs of a spam email. Valid promotional emails from reputable sources do not usually contain such mistakes, since they take care with their copy.
Links
In general, if you receive an unknown email, do not rush to click on any links since it can lead to your data being leaked or you may simply download a virus. Spammers can use shortened URLs (such as bit.ly, tinyurl.com, tiny.cc, etc.) to disguise links to fraudulent resources that they use to obtain your personal information, credit card details, passwords, etc. In some cases, these links may lead to downloading a file on your PC. To protect yourself, it is recommended not to open the links at all if you are not sure about the sender, or to check them in an online link checker.
Unrealistic claims
If you get an email offering to purchase something at a ridiculously low price or offering a money reward/prize, you are most likely looking at a spam message. The best course of action would be to delete the email and report it as spam.