How Spam Filters Work: The Signals That Decide Your Inbox Fate

A spam filter is a scoring system, not a checklist. When someone asks how spam filters work, the honest answer is that mailbox providers like Gmail, Outlook and Yahoo each run their own models, weighing dozens of signals about your sending reputation, your authentication setup, how recipients behave with your mail, and what the message itself looks like. No single rule decides your fate — the combined score does. That is why two identical emails can land in different places for different recipients, and why copying a "spam word list" rarely fixes anything.

This guide breaks the signals into four families, walks through the order in which they are evaluated, and ends with a checklist you can run this week.

What "how spam filters work" actually means for a sender

It helps to separate three outcomes that senders often lump together:

• Spam folder placement — the filter judged the message risky or unwanted.
• Promotions or Updates tab placement — the message is legitimate but classified as bulk commercial mail. This is a categorization decision, not a punishment.
• Inbox placement — the message passed the risk checks and matched the recipient's expectations closely enough.

These use different mechanisms. A Promotions tab placement usually means your authentication and reputation are fine but the content reads as promotional. A spam folder placement usually points to a reputation, authentication or engagement problem. Fixing the wrong one wastes weeks.

The four signal families filters weigh

Think of every send as being scored across four families at once. Weakness in one can sometimes be offset by strength in another, but authentication failures and complaint spikes are hard to compensate for.

1. Sender reputation: IP, domain and the people who complain

Reputation attaches to two things: the IP address your mail leaves from, and the domain you send from. It is shaped by hard bounces, spam complaints, and how consistent your volume is over time.

• Complaints are the heaviest negative signal because they are explicit user feedback. A recipient who clicks "report spam" is telling the provider your mail was unwanted, and that judgment carries across future sends.
• Bounces matter too. Repeatedly sending to invalid addresses suggests you are not maintaining your list.
• Shared versus own infrastructure. On a shared IP, other senders' behavior can affect the pool's reputation. Sending from your own domain isolates your reputation — but also means you own it fully.
• Warm-up exists for a reason. A cold domain that suddenly sends 50,000 emails looks like a compromised account or a freshly rented sender. Ramping volume gradually gives providers time to observe consistent, wanted mail.

Mailerflow's deliverability tooling covers this directly: reputation monitoring, warm-up limits, and automatic suppression of bounces and complaints, so the signals that damage reputation get handled without manual list surgery.

2. Authentication: SPF, DKIM and DMARC as the entry ticket

Authentication does not guarantee inbox placement, but failing it removes your ability to build domain reputation at all.

• SPF publishes a list of servers allowed to send mail for your domain. Receivers check whether the sending server is on that list.
• DKIM adds a cryptographic signature to each message, so receivers can verify it was not altered in transit and was signed by someone holding your domain's key.
• DMARC ties the two together: it tells receivers what to do when SPF or DKIM fails, and where to send aggregate reports about your domain's mail.

The part most senders get wrong is alignment. It is not enough for SPF and DKIM to pass — the domain that passes must match the domain in your visible From address. If your From address is you@yourbrand.com but your ESP signs as mail.espdomain.com without alignment, DMARC fails and your domain reputation never accumulates.

If you do not have a deliverability engineer, Mailerflow's guided DKIM, SPF and DMARC setup with automatic verification walks through the DNS records and confirms they resolve correctly.

3. Engagement: the signal you can actually influence

Providers infer relevance from behavior. Positive signals include opens (where they are measurable), clicks, replies, and recipients moving your mail out of the spam folder. Negative signals are the absence of all of these: mail left unopened, deleted without reading, or reported after repeated sends.

Engagement is measured per recipient, which is the part senders underestimate. If 30% of your list opens and 70% ignores you, that quiet majority drags down delivery for the engaged segment too. The practical levers:

• Send to your most engaged segment first, then expand.
• Sunset contacts who have not engaged in a defined window — 90 or 180 days is a common starting point.
• Make opting down easy (fewer emails, different topics) instead of forcing people toward unsubscribe or the spam button.

Dynamic segments based on engagement make this operational rather than theoretical: you can build a segment of "opened or clicked in the last 90 days" once and reuse it for every campaign.

4. Content and infrastructure signals (and why old tricks fail)

Content still matters, but not in the way most spam filter rules articles suggest. Filters look at patterns and context, not a fixed dictionary:

• Misleading subject lines that do not match the body.
• Image-only emails with no readable text, which hide content from analysis and look evasive.
• Link shorteners that mask the destination domain.
• A From name that does not match the sending domain.
• A very high link-to-text ratio with little substance.

Infrastructure signals include the age of your sending domain, the reputation of the domains you link to, whether your message carries a proper unsubscribe header, and list hygiene — invalid addresses and spam traps (addresses that never opted in and exist only to catch bulk senders).

Why the classic tricks fail: hiding text in white or tiny fonts, stuffing keywords in HTML comments, or adding "this is not spam" disclaimers are all trivially detectable and often treated as evidence of intent. Statistical and behavioral models have replaced static keyword lists, so a message full of trigger words sent to an engaged list can still reach the inbox, while a bland message to a purchased list will not.

How a message gets scored, step by step

Understanding the order helps you debug a specific placement problem:

1. Connection and authentication checks at SMTP time. SPF, DKIM and DMARC are evaluated before the message body is even considered. These are largely binary gates.
2. Reputation lookup. The receiving provider checks the sending IP and domain against its own history and third-party data.
3. Content and header analysis. Subject, body, links, images, unsubscribe headers and structural patterns are examined.
4. Per-user engagement and preference modeling. The same message can be scored differently for a recipient who opens every send and one who has ignored you for a year.
5. Placement decision. Inbox, tab, or spam folder.
6. Post-delivery feedback. Complaints, moves out of spam, replies and deletions flow back and update reputation for next time.

Steps 1–3 are mostly pass/fail. Steps 4–6 are continuous, which is why deliverability is a trend you manage, not a switch you flip.

A worked example: the same campaign, two outcomes

The following is an illustrative scenario, not a real customer story, and does not predict any specific provider's behavior.

A team has a 12,000-contact list and one email copy. They send it two ways.

Version A: sent from a warmed own domain with aligned DKIM, SPF and DMARC, to a segment of contacts who opened in the last 90 days (about 4,500 people). The email is text-forward, has one clear call to action, and the From name matches the brand domain.

Version B: sent from a brand-new subdomain, to the full 12,000 including 4,000 contacts who have not opened in over a year. The design is a single large image with a shortened link and no body text.

In terms of the four signal families, Version A starts with authentication passing and alignment intact, sends to a group with a recent engagement history, and presents content that matches its subject line. Version B fails on warm-up (new subdomain, full volume), carries a large inactive cohort that will likely ignore or report the mail, and uses content patterns — image-only, masked link — that filters treat as higher risk. The likely difference in placement follows from those signals, not from luck.

Common mistakes that quietly hurt deliverability

1. Sending to a purchased or scraped list. Those recipients never opted in and will report you. Fix: only send to contacts with a recorded consent path.
2. Never cleaning bounces. Fix: confirm hard bounces are suppressed automatically after the first failure.
3. Ignoring complaints. Fix: suppress complainers immediately and treat a rising complaint rate as a stop signal for that campaign.
4. Using a new domain for a big blast. Fix: warm up gradually, starting with your most engaged contacts.
5. Sending identical content to everyone. Fix: segment by engagement and adjust frequency for quieter contacts.
6. Hiding the unsubscribe link. Fix: make it one click and visible; a hard-to-find unsubscribe pushes people to the spam button instead.
7. Using link shorteners out of habit. Fix: link to your real domain unless you have a specific tracking reason not to.
8. Treating the Promotions tab as failure. For genuinely promotional mail, it is often the correct placement — and it is better than the spam folder.

A short checklist you can run this week

1. Verify SPF, DKIM and DMARC alignment for your sending domain — check that the authenticated domain matches your From domain.
2. Confirm bounces and complaints are suppressed automatically rather than manually.
3. Build an engagement segment and send to it first on your next campaign.
4. Define an inactivity window and sunset contacts who fall outside it.
5. Check that your From name, subject line and preview text describe what is actually inside.
6. Make unsubscribe one click and easy to find.
7. After each send, review reputation and volume trends before scaling up.

Mailerflow handles steps 1, 2 and 7 through guided authentication setup with automatic verification, automatic bounce and complaint suppression, and reputation monitoring. For step 5, the AI email builder can draft subject lines and preview text from a short description of the email, which is a quick way to test whether your subject matches your content.

FAQ

Does using certain words get me marked as spam?

There is no universal word list that decides placement. Filters weigh sender reputation, authentication and recipient engagement more heavily than individual words. A phrase that looks risky in a low-reputation send may be completely fine in a well-authenticated message to engaged recipients.

Why do my emails go to Promotions instead of spam?

These are different mechanisms. Promotions tab placement is a categorization decision — the provider believes your mail is legitimate but commercial. Spam folder placement is a risk decision. If you are in Promotions, your authentication and reputation are likely healthy; the fix is about expectations and content style, not deliverability repair.

Can I fix deliverability without changing my email platform?

Sometimes. Authentication, list hygiene, engagement segmentation and content changes are all within your control regardless of provider. If your sending infrastructure is the constraint — for example, a shared IP with poor reputation and no path to own-domain sending — changing platforms may be the more direct fix.

How long does domain warm-up take?

It depends on your starting volume, your engagement rates and how consistently you send. The principle is gradual: start with your most engaged contacts, increase volume over multiple sends, and watch reputation and complaint signals before each increase. There is no fixed number of days that applies to every sender.

Do I need a separate domain for marketing email?

It is a trade-off. A separate marketing domain protects your transactional and primary domain reputation if a campaign goes wrong, but it splits your reputation and requires its own warm-up from zero. Teams with high-volume promotional sends often prefer separation; smaller senders usually benefit from concentrating reputation on one well-configured domain.

Set up your sending domain in Mailerflow with guided DKIM, SPF and DMARC and automatic verification.