Email Spam Score: What It Means, How to Check It, and Its Limits

A spam score is a number a spam filter gives one email to say how much it looks like spam. Most of the time the term means SpamAssassin's score: each rule a message triggers adds or subtracts points, and once the total reaches a threshold (5.0 by default) the message is marked as spam. Mail-tester and similar checkers run SpamAssassin and show the result as a grade out of 10. The catch is that Gmail and Outlook do not use one public spam score. This guide explains what the number measures, how to check spam score properly, which fixes actually move it, and where it stops being useful.

What a spam score is

The phrase covers several different measurements. Knowing which one a tool reports saves you from fixing the wrong problem.

SpamAssassin-style rule scoring

Apache SpamAssassin is an open-source filter that runs many tests on a message's headers and body: text patterns, Bayesian classification, DNS blocklists and collaborative databases (Apache SpamAssassin). Every test that matches carries a score, and the scores add up. Scores can be negative, so a rule that marks a message as legitimate pulls the total down (SpamAssassin Conf docs).

The threshold is the required_score setting. The docs describe the default of 5.0 as "quite aggressive" and suggest 8.0 or 10.0 for ISPs (SpamAssassin Conf docs). So a 4.8 is not a "safe" score in any absolute sense. It is just below one configurable line on one server.

SpamAssassin records its verdict in an X-Spam-Status header. Its default template is _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_, so a stamped message looks roughly like this (values illustrative):

X-Spam-Status: No, score=1.3 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	HTML_MESSAGE,MIME_HTML_ONLY,SPF_PASS autolearn=ham version=4.0.2

The tests= list is the useful part. It names every rule the message triggered. The current release is 4.0.2, from August 2025 (Apache SpamAssassin).

Mailbox-provider filtering is not a score you can read

Gmail does not publish a per-message spam score, and no test can tell you Gmail's verdict before you send. What Google does publish is a sender-level number: the spam rate in Postmaster Tools, meaning the share of your mail that recipients report as spam. Google asks all senders to stay under 0.3% and recommends staying under 0.1%. It also requires SPF or DKIM (all three of SPF, DKIM and DMARC above 5,000 messages a day to Gmail), TLS, and one-click unsubscribe for bulk marketing mail (Google sender guidelines).

Microsoft is a closer call. Exchange Online stamps a spam confidence level (SCL), either -1 or 0 to 9, in the X-Forefront-Antispam-Report header of messages it receives. But Microsoft says the SCL no longer decides whether a cloud mailbox treats a message as spam, and that the same SCL can appear on messages with different verdicts (Microsoft Learn). You can read the header after delivery to a test mailbox. You cannot get it in advance or tune against it the way you can with SpamAssassin rules.

Other things called a "spam score"

• Sender Score. Validity's 0 to 100 reputation rating for a sending IP, built from complaint, spam trap and delivery data. It measures the IP's history, not a single message (Validity, senderscore.org).
• SpamCop. Not a score at all. SpamCop is a spam-reporting service plus a free DNS blocklist for mail servers. The SpamCop Blocking List lists only IP addresses, based on user reports and spam traps, and an IP drops off automatically after 24 hours with no new reports (SpamCop, SpamCop FAQ). If a checker says you are "on SpamCop", your sending IP was reported recently.
• "Domain spam score" in SEO tools. Some SEO tools publish a spam score for websites. It estimates link-spam risk for search rankings and says nothing about email. If you landed here looking for that, it is a different metric.

How to check spam score

Each method answers a different question, so use more than one.

1. A mail-tester style tool

A mail spam tester gives you a one-off address. You send a real message to it and get a report back. Mail-tester.com is the best-known option. It runs a "vanilla" SpamAssassin install, flips the scale so higher is better (a perfect result is 10/10), and allows three free tests in a rolling 24-hour window. Free results stay available for seven days, or 30 with an account (mail-tester FAQ). Our guide to using Mail-Tester.com goes through the report section by section.

To get a useful result:

• Send from your production path: the same API or SMTP account, the same From domain, and the same template. A message pasted into a webmail client tests a different setup.
• Send the real content, with links and images, not "test 123".
• Read the triggered rules, not just the grade.

Most free spam score checkers and "email spam checker online" sites work the same way. They differ in report quality, not in some secret extra signal.

2. Run SpamAssassin yourself

If you can install SpamAssassin, you can score any raw message locally. Save the full raw source of a message you received (most mail clients have a "show original" or "download message" option) as message.eml, then run:

spamassassin -t < message.eml

-t (test mode) pipes the message through and appends a report showing every rule hit and its points. Add -L to run only local tests with no network lookups, which is quicker but skips blocklist checks (spamassassin docs). The report wording assumes the message is spam even when it is not, so read the score, not the tone. This is the best way to check email content for spam score while you change a template, because you can re-run it in seconds.

3. Seed tests for inbox placement

A seed test sends your message to a panel of real mailboxes at Gmail, Outlook, Yahoo and others, then reports whether each copy landed in the inbox, spam or another tab. This is spam testing at the level that matters, actual placement. Seed mailboxes have no history with you, though, so results are noisy and sometimes contradict what your real recipients see. We cover what these tests can and cannot prove in inbox placement tests.

4. Check the domain and IP, not just the message

When people search for a "domain spam score", they usually want to know about reputation:

• Authentication. Confirm SPF, DKIM and DMARC with the DMARC checker. A failing DMARC record outweighs any content tweak.
• Blocklists. Check your sending IPs and link domains against public blocklists, including SpamCop's. See blocklist monitoring.
• Provider dashboards. Google Postmaster Tools for Gmail spam rate and authentication.

What moves a spam score

These are the usual reasons a message scores badly, with the public SpamAssassin rule names you will see in reports. Point values differ between versions and servers, so focus on which rules fire, not exact numbers (SpamAssassin rule list).

Some rules work the other way. DKIM_VALID and SPF_PASS show the message authenticated, and the RCVD_IN_DNSWL_* rules reflect a source listed on an allowlist. Fixing authentication often helps twice: it removes penalties and adds credits.

Things that move the score less than people expect: single "spammy words", one exclamation mark, or the word "free" in the subject. Rule-based filters look at combinations, and the Bayesian classifier learns from each site's own mail. If you are rewriting copy word by word to chase points, step back and check authentication and reputation first.

The limits of a spam score

A perfect 10/10 does not mean you will reach the inbox, and a 6/10 does not mean you won't.

• The big inboxes use their own systems. Gmail and Outlook decide with their own models and reputation data. A SpamAssassin score is an outside approximation.
• One message, one moment. A test scores one message from one IP at one point in time. Real placement depends on your history: volume patterns, complaints, bounces and whether recipients open, reply or delete without reading.
• List quality is invisible to it. A clean score does not catch spam traps, invalid addresses or people who never opted in. Check addresses with the email verifier and keep bounces and complaints low.
• Thresholds vary. Each receiving server sets its own required_score and may add custom rules.

Use the score to catch mechanical problems such as broken authentication, missing text parts, blocklisted links and malformed headers. Then judge real results by bounce rate, complaint rate and engagement. If mail already lands in the spam folder, our guide to why emails go to spam covers the reputation side in depth.

A practical spam check workflow

1. Set up SPF, DKIM and DMARC on the sending domain and check them with the DMARC checker.
2. Send a real template through your production path to a mail-tester address. Fix every rule that fires.
3. Run spamassassin -t locally while you edit templates, to catch regressions quickly.
4. Read the raw headers on a copy delivered to your own Gmail and Outlook test mailboxes. Look for spf=pass, dkim=pass, dmarc=pass and Microsoft's antispam headers.
5. Check sending IPs and link domains against blocklists.
6. After launch, watch Postmaster Tools spam rate, bounces and complaints. They matter more than any pre-send score.

For the full pre-launch list, see the email deliverability checklist. For testing templates and flows before they ship, see the email testing guide.

How Volanea handles this

Volanea is a developer-first email platform built on Amazon SES. Every plan, including Free, sets up SPF, DKIM and DMARC for your verified sending domain, which covers the authentication rules that most often hurt a score. Hard bounces and complaints go to a suppression list automatically. A reputation guard slows sending when bounce or complaint rates rise, so one bad list does not damage the domain's history. You can check addresses before a send with POST /v1/verify or the free email verifier.

FAQ

What is a good spam score?

In SpamAssassin points, lower is better, and the default spam threshold is 5.0. On mail-tester's inverted scale, higher is better, with 10/10 as the best. Aim for no rules firing that you could fix, rather than a particular number.

How do I check my email spam score for free?

Send a real message from your production setup to a free tester like mail-tester (three free tests per 24 hours), or run spamassassin -t on the raw message if you have SpamAssassin installed.

What is SpamCop?

SpamCop is a spam-reporting service and a free DNS blocklist. It lists IP addresses that recipients and spam traps reported recently, and removes them automatically after 24 hours with no new reports.

Does Gmail have a spam score?

Not one you can see per message. Gmail publishes your domain's user-reported spam rate in Postmaster Tools and asks senders to keep it below 0.3%, ideally below 0.1%.

How do I check a domain spam score?

For email, check reputation: SPF, DKIM and DMARC results, blocklist status for your IPs and link domains, and Postmaster Tools data. A "domain spam score" from an SEO tool measures link spam for search engines, not email.

Are free spam checker tools accurate?

They accurately report what SpamAssassin thinks of one message. They cannot predict Gmail or Outlook placement, which depends on your sending reputation and recipient engagement.

Want authentication handled for you from the first send? Start free on Volanea, with 1,000 credits a month and no card required.