Spam easily makes up the majority of emails sent worldwide. Saying that it’s everywhere wouldn’t be an overstatement. Luckily, modern inboxes have become extremely efficient in filtering out unwanted messages so we don’t actually see most of these emails. We should give some credit to various anti-spam solutions that have emerged over the years. One of them is SpamAssassin.
But, as is frequently the case, there’s a flip side to this medal. Spam filters can never be 100% error-proof. As a result, they sometimes send legitimate emails to spam or discard them altogether. To avoid such a fate, email senders use SpamAssassin and its score to improve their emails.
How do you do it right? How do you understand the SpamAssassin score, and how do you set it up properly? That’s what we’re going to discuss today.
What is SpamAssassin?
Apache SpamAssassin is a popular, open-source solution developed by Apache back in 2001. It’s a tool that one can easily install and set up on a mail server to filter out unwanted emails. It incorporates various anti-spam techniques, which include Bayesian and DNS filtering or the so-called SpamAssassin blacklist.
SpamAssassin is widely used as a tool for email deliverability testing and is integrated with many other popular email platforms. For example, it’s incorporated in Mailtrap Email Testing as one of the tools for testing emails before they’re sent to end-users.
SpamAssassin analyzes each email and gives it a score. The lower the score, the higher the chance of an email landing in an inbox. The tool can be set to any base value, but most commonly ‘5’ is used.
This doesn’t mean that emails rated 4.5 or 4.9 are headed straight to spam. Quite the opposite! Any score below 5.0 means that an email is good enough to avoid spam filters. Scores above 5.0, though, suggest that an email is likely to get stuck somewhere on the way to an inbox and, as a result, never arrive.
In reality, engineers can set the SpamAssassin value to any other value. Some prefer more aggressive settings and will set the tool to reject anything above 4.0 (or even lower than that). Many different spam filters are also in common use, and these may incorporate different criteria.
The bottom line, though, is that aiming for a very low SpamAssassin Score drastically improves the chance of an email being delivered to an inbox.
SpamAssassin score explained
For each email it analyzes, SpamAssassin generates a header, with a set of rules and points for each (positive, negative, or zero). This is precisely what you see in Mailtrap Email Testing, parsed into a more human-friendly form.
In reality, the raw header will always start with something like this:
<em>X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-28) on JetWeb</em>
<em>X-Spam-Level: </em>********
<em>X-Spam-Status: Yes, score=8.2 required=5.0 tests=ALL_TRUSTED,AWL,DKIM_SIGNED,</em> And then the list of factors that affected the score will follow. This will include both negative and positive factors, as well as those that have a negligible impact (displayed as 0.0). Before we get to those, let’s analyze the top of the header first.
The first line refers to the version of SpamAssassin in use and its release date. As of the time of writing, 3.4.4 was the latest release.
In the second line, you can see the spam level that an email achieved, expressed in asterisks, rounded down. In this test, we sent a really spammy email that earned an 8.2 score, thus 8 stars. If we got 3.4 or 3.0, it would be rounded down to three stars, of course. Anything below 1, including negative scores, results in no asterisks being displayed.
The third row starts with the status of your email, being YES (if it’s considered as spam) or NO (if it isn’t). Then the score, expressed for a change in Arabic numerals, follows. You can also see the spam threshold set on this particular installation, and the list of tests that have been run. It can be useful for understanding why the score has been given.
SpamAssassin tests
What follows next is the list of factors that affected your score, called rules or tests. For each, you’ll see it’s name (capitalized), a brief description, and a numerical score.
There are hundreds of available tests. They look at factors such as:
- presence on SpamAssassin blacklists
- suspicious links and file extensions
- disallowed scripts
- failed or passed authentications
- spammy content
- and many others
Interestingly, there are also individual tests for different variations of spammy words such as “Viagra” or “Lose weight”. As you would expect, those emails are particularly unwelcome.
Here are the common tests you may see on your SpamAssassin record:
| Name | Score | What is it? |
| URIBL_GREY | 1.1 | URL in the content is present on URIBL greylist |
| URIBL_BLACK | 2.0 | Even worse, it made it to URIBL blocklist |
| URIBL_SBL | 0.6 | URL made it to Spamhaus SBL blocklist |
| SPF_PASS | -0.0 | SPF check was successful. |
| SPF_FAIL | 0.9 | Sender doesn’t match SPF record |
| DKIM_VALID | -0.1 | Message contains at least one valid DKIM signature |
| LONG_HEX_URI | 2.4 | At least one file included in the body has a very long, solely hexadecimal URI |
| HTML_MESSAGE | 0.0 | HTML is included in the message (as you can see, it has a negligible impact) |
| AWL | -0.9 | “From” address is included on the recipient’s white-list |
| DRUGS_ERECTILE | 2.2 | Were you promoting some drugs? There you go. |
| FREEMAIL_FROM | 0.0 | Sending from a free account (e.g. Gmail) has a negligible impact |
| MPART_ALT_DIFF_COUNT | 1.5 | HTML and TXT parts of an email are different |
| HTML_IMAGE_RATIO_02 | 0.8 | There’s a low text to image ratio in the body |
How to lower your SpamAssassin score
Tackling SpamAssassin issues one by one is certainly a viable way of lowering a score. Last week we used Mailtrap for that. We generated an individual email address for our Mailtrap inbox. Then, we kept sending each new iteration from Sendgrid to our inbox, quickly comparing the SpamAssassin scores and improving on each position negatively affecting our score.
7 tips for lowering your spam score
There’s a lot more you can do to improve (decrease) your SpamAssassin scores. We’ve gathered seven tips that are guaranteed to help you deliver more emails to your recipients.
Build a good sending history
Email filters pay a lot of attention to your sender reputation.
With each email sent, you build the sending history for your domain and the IP you use. If you send quality emails that recipients eagerly open and interact with, you will be rewarded with a positive reputation.
If, however, your emails frequently bounce, are marked as spam by recipients, or are simply ignored by them, it will have a negative impact on the reputation. Building a good reputation ultimately comes down to sending emails that recipients want to receive.
Use a reputable IP
When picking a tool for sending emails, you almost always have a choice between a shared and dedicated IP. For financial reasons, most senders choose the former, and this is by no means a bad decision. Quite the opposite – there are many reputable Email Sending Providers (ESPs) that provide high-quality sending domains at very manageable prices. Often, paying a few bucks a month will be much better for your emails than sending a lot of emails from a free Gmail or Hotmail account.
Authenticate
Email authentication has become a must-have for any legitimate email servers, and for a very good reason – it’s easy to implement, and effective in fighting phishing.
For that reason, every email should have both SPF and DKIM records configured. As you can see above, missing even one has an immediate effect on its SpamAssassin score.
DMARC, the third most popular authentication method, doesn’t have a direct impact on the score. It gives you more security, though, and a better control of your authentication, so we highly recommend it as well.
Beware of blocklists
Landing on either of the common blocklists can have dire consequences for your emails. You can see if you’re present on any right in the Spam Analysis section of the Sandbox.
To avoid landing there, make sure you’ve got the permission of your recipients to send them emails. Don’t buy lists or scrape the web for new contacts. Build your list organically and you’ll never have to worry about the blocklists.
Take it slow
Another aspect that spam filters pay a lot of attention to is sudden spikes in the quantity of emails sent. For example, if you haven’t sent much in the past and suddenly send out a newsletter to thousands of recipients, you may be in for some trouble. After all, that’s precisely what spammers do after hijacking the accounts of their poor, unsuspecting victims.
Prevent any suspicions by gradually increasing the volume of emails. Send the first batch on Monday and follow with a slightly bigger bunch on Tuesday. Segment your users and send different campaigns to different groups, on different dates if you can. Give the email servers a chance to get used to your volume. This technique is referred to as IP warmup.
Avoid spammy words
As you can see above, our Viagra emails didn’t do very well. SpamAssassin has been taught to react aggressively to the typical words used by spammers as well as various, misspelled variations (such as “p1lls”).
This also goes for other seemingly normal words and phrases – “money”, “best price”, “no questions asked”, and many others. Be sure to review one of the numerous lists of spam words and pick similar alternatives.
Pay attention to text:image ratio
A visual addition to an email is rarely a bad idea. SpamAssassin (as well as other filters) don’t particularly like emails full of images, though. They don’t dramatically increase the score (we scored an extra 0.8 points for a low text:image ratio), but if you’re aiming for a lower score, it’s one of the most obvious things to tackle.
The general guidance is for embedded images not to exceed 40% of the total message body.
For those of you interested in exploring the topic further, we’ve put together a more detailed tutorial on stoping your emails from going to spam.
SpamAssassin implementation tips
If you’re implementing SpamAssassin on your server for the first time, there are a few aspects worth elaborating on.
First of all, the first thing you’ll need to decide is the spam threshold we already discussed earlier in the article. As a reminder, ‘5’ is the default value and it works quite well for most users. If you don’t have much experience with this software, we recommend keeping it as it is and adjusting it later, or even setting it to a slightly higher value to start off with (7.0, for example).
With this setting, every email will be rated, and each that scores more than 5.0 will be sent to spam. You can also set to auto-delete those, but, at least early in the project, it’s probably worth reviewing them. You’re almost guaranteed to score some false negatives, possibly jeopardizing an important communication.
Later on, if some of your emails are still going to spam, consider lowering the score to 4.0, but probably don’t go further than that.
When sending one of the product updates, we initially directly uploaded the screenshots to SendGrid (which is a very reputable ESP). Only when testing those emails did we notice that they score really high in Mailtrap’s built-in SpamAssassin.
It turned out that SendGrid assigns a very long, hexadecimal address to each file uploaded (the file name itself had more than 60 characters). On top of that, one of the servers that emails go to is “featured” on one of the prominent blocklists. Both factors added 4.4 to our SpamAssassin score.
As a result, had we not checked it, our emails would have gone to spam on all machines set to aggressive spam settings. We fixed that right away, but a lot of other senders that neglect their sending procedures may not have been so fortunate.
When evaluating an email, SpamAssassin runs a Mail::SpamAssassin check() function. It returns the score and details of a check. $status->get_uri_detail_list () will return the details of each URI used in the message headers and body, for example.
One handy feature of SpamAssassin is whitelisting or blocklisting certain addresses or entire domains. Whitelisting can be particularly helpful if you run a lot of internal communication via emails, and are afraid of losing any of them.
Wrapping up
SpamAssassin is a very useful and completely free tool. Spam filters are not and will never be 100% error-proof. For that reason, 2 minutes spent on checking your spam score will save you a lot of trouble later on. Add it to your email testing checklist, or create one if you don’t have it yet.
Best of luck!