SpamAssassin Scores Explained

Short answer: SpamAssassin is an open-source spam filter that runs many small tests on each message. Every test that matches adds or removes points, and when the total reaches a limit set by the mail server, the message is marked as spam. The default limit is 5.0. Reading the score and the list of matched tests in a message header shows exactly what to fix.

What SpamAssassin is

SpamAssassin is a long-established filter that many hosting companies, universities and businesses run on their own mail servers. It is not the filter used by the largest mailbox providers, which have their own systems. Still, it is widely deployed, and its way of thinking, scoring many weak signals together, reflects how many filters work.

It does not decide on a single clue. A message that is a little unusual in many ways collects a high score, while a message with one odd feature may pass. This is why the tests are called rules, and why each rule carries a score.

How the scoring works

Each rule has a name and a score. The score can be positive, which makes a message more suspicious, or negative, which makes it look more trustworthy.
The scores are added together. The total is the message’s spam score.
The server compares the total with a threshold. The default threshold is 5.0, which many servers keep. Administrators can set it lower or higher.
The server decides what to do. It may add a tag to the subject line, move the message to a spam folder, hold it, or reject it.

The numbers are tuned by the project from large sets of real spam and legitimate mail. They change between versions, and administrators can change them again. For that reason, do not treat any single score value as fixed. Look at the structure and read the rule names for the real clues.

Where to see the score

If a message went through SpamAssassin, the server usually adds headers that show the result. Open the full headers of a received message, as described in the guide to reading email headers, and look for lines such as these.

X-Spam-Status. Shows whether the message was treated as spam, the score, the threshold and the list of tests that matched. For example: No, score=2.3 required=5.0 tests=...
X-Spam-Score or X-Spam-Level. A shorter form of the score. The level may use stars, one for each point.
X-Spam-Flag. A yes or no flag.
X-Spam-Report. On some servers, a longer list of the rules, their points and a short description of each.

The names of the headers can differ by server. If you send mail to a test address on your own server, or to a service that reports the score, you get the list without needing to guess.

Common rules and what they mean

There are hundreds of rules. These examples show the kinds of checks, and the names will be familiar when you read a report.

Authentication rules. Names beginning with SPF or DKIM, such as SPF_PASS, SPF_FAIL, DKIM_SIGNED and DKIM_VALID. A valid signature slightly lowers the score, and a failure raises it. The guide to SPF, DKIM and DMARC explains these records.
Blocklist rules. Names with RCVD_IN or URIBL show that the sending address, or a link in the message, was found on a public list. Read about this in email blocklists.
Content rules. Patterns in the text and HTML, such as odd formatting, hidden text, very large fonts or phrases that are common in spam. See the myths and facts in spam trigger words.
Structure rules. Problems in the message format, such as a missing date, a missing message identifier, or HTML with no plain text part. See Message-ID and Date headers.
Image rules. Messages that are almost all image, with little text. The article on image-only emails explains why this looks suspicious.
Sender rules. A free mail address in the From line combined with other signals, or a mismatch between visible and real sender.
Learning rules. The Bayesian classifier assigns a score based on how similar the words in a message are to the server’s known spam and known good mail. Its rules have names that begin with BAYES, followed by a probability band, and the top bands can add a large number of points on their own.

How to read a report step by step

Find the total and the threshold. A score of 3 against a limit of 5 leaves little room for error. A score of 0 or below is comfortable.
Sort the matched rules by points. The biggest numbers matter most.
Group them by cause. Authentication, reputation, content and structure.
Fix the cause, not the rule. A rule name tells you what was seen. The fix is in your setup or content.
Send again and compare. Change one or two things at a time, so that you know which one helped.

How to lower the score

Authenticate properly. SPF, DKIM and DMARC that pass and align remove a whole group of penalties. Check them with the DMARC overview and fix any failures first.
Send from a clean address. Make sure that your sending address is not on a blocklist, and that reverse DNS and the HELO name are correct, as in the guide to the HELO and EHLO hostname.
Include a plain text part. Send both text and HTML, rather than HTML only. See plain text vs HTML email.
Write clean HTML. Avoid broken tags, hidden text and bulky code copied from a word processor. The article on broken HTML and encoding shows what to look for.
Balance text and images. Keep a good amount of real text, and give images alt text.
Use links carefully. Avoid link shorteners and mismatched link text, and use your own domain for links. See links in emails.
Keep the list clean. A message sent to dead addresses and spam traps gives the server and its learning system reasons to distrust your domain.
Write like a person. Clear language, a real signature and a reasonable subject line avoid most content rules.

Do not chase the score alone

A low score does not guarantee delivery. The large mailbox providers use their own systems, which weigh sender reputation and recipient behaviour heavily, and which do not publish a score. A message may pass SpamAssassin easily and still land in a junk folder at another provider, and the reverse is also true.

Use the score as one diagnostic among several. It is especially useful when you send to small business servers, hosting-based mailboxes and security gateways that run the filter. See the discussion of business email gateways. For a broader view, work through the email deliverability checklist, and test real messages with the methods in how to test email deliverability.

A worked example

Suppose you receive this header on a test message sent from a small online shop: score 6.1, required 5.0, with matches for missing DKIM signature, an HTML-only message, a blocklisted link domain and a high Bayesian band. The total is over the limit, so the message would be treated as spam. Reading the list shows four separate causes.

The missing signature is fixed in the sending service by enabling DKIM for your domain. This one change removes a penalty and may also add a small credit for a valid signature.
The HTML-only structure is fixed by turning on the plain text version in the template settings.
The blocklisted link domain is more serious. The shop used a shared tracking domain that other senders had abused. Switching to a custom tracking domain on its own site removes the penalty and keeps the reputation under its control.
The Bayesian band reflects wording and layout similar to known spam, often a result of the other problems. After fixing the first three, rewriting the heavy sales language and adding more real text lowers it.

After the changes, the next test shows a score of 0.8. Nothing about the offer changed. What changed was the technical setup and the structure, which are exactly the parts that a scoring filter measures. This is also why a single “magic word” never explains a high score. The total is built from several small causes, and each can be traced in the list.

Keep a copy of the headers before and after each change. A short log makes it easy to see which edits helped, and it is useful again when you change your email provider, or when a new template is added.

How Site AI Audit helps

Site AI Audit does not score the content of individual emails, so it cannot give you a SpamAssassin result. It checks the records that filters of this kind look at first: SPF with its lookup limit, DKIM, your DMARC policy and your MX records. Passing authentication removes some of the penalties before the content is even read. The free check covers up to 50 pages and needs no sign-up. You can run a free check of your website or see the plans for weekly monitoring and alerts.

The bottom line

A spam score is simply a sum of many small observations. Read the matched rules, fix the causes in your authentication, sending address and content, and test again. Keep in mind that this filter is only one of many, so use it as a guide rather than as a promise of inbox placement.

SSS

What score counts as spam?

The default threshold is 5.0, but each server can change it. A message is treated as spam when its score reaches the limit set by that server.

Does Gmail use SpamAssassin?

No, large mailbox providers use their own systems. SpamAssassin is common on hosting and company servers, so its score helps mainly for those recipients.

Can a negative score be good?

Yes. Some rules subtract points, for example for valid signatures or a trusted sender list. A total at or below zero is a strong result.

How can I see the score of my own email?

Send a message to a mailbox on a server that runs the filter and open the full headers, or use a testing service that shows the list of rules.

Will removing spam words fix a high score?

Rarely. Authentication, reputation and structure usually matter more than single words. Check the headers and fix the biggest items first.

SpamAssassin Scores Explained: How Spam Filters Add Up Points