SpamAssassin Score: What It Means and How to Lower It

How the score is added up

Apache SpamAssassin is an open-source filter that mail servers run on incoming mail. Its rules cover headers, body text, HTML, lookups against DNS blocklists, and an optional Bayes classifier trained on the server's own mail. Each rule has a score, and the documentation is plain about the sign: scores “can be positive or negative.” A positive rule is evidence of spam, a negative one evidence of legitimate mail.

The message is spam when the total reaches required_score. Its default is 5, set in the default preferences file, and the configuration manual itself calls 5.0 “quite aggressive.” The default scores were tuned against that threshold: the score file says they aim for roughly one false positive in 2,500 legitimate messages at 5.0.

Many rules carry four scores, not one. Which applies depends on how the server runs SpamAssassin: without network tests or Bayes, with network tests only, with Bayes only, or with both. A rule's weight on one server is not its weight on another.

Every server decides for itself

The threshold, the rules and their scores are all configuration. An administrator can raise or lower required_score, change any rule's score, add local rules, or set a score to 0, which the documentation says disables the rule. The default scores also change between rule updates, so even two servers with default settings can disagree if one is out of date. There is no single SpamAssassin score for an email, only the score one server gave it.

The large mailbox providers are a different question. Google describes Gmail's filtering as rules-based protections plus its own machine-learning models, including TensorFlow; it does not say it uses SpamAssassin. Microsoft 365 stamps its own spam confidence level in the X-Forefront-Antispam-Report header. A clean SpamAssassin result is good evidence about your content and setup, and no evidence about where Gmail or Outlook.com will file the message.

Reading the report

With the default configuration, SpamAssassin adds headers that start with X-Spam-. The one to read is X-Spam-Status: it says Yes or No, the score, the threshold, and the names of every rule that matched in tests=. X-Spam-Level repeats the score as a row of stars and X-Spam-Flag: YES appears only on spam. When the server is set to report_safe 0, spam also gets an X-Spam-Report header listing each rule with its points and a description.

Here is a marketing email with a large hero image, little text, no plain-text part, sent from an IP without reverse DNS. The points use the network-and-Bayes column of the default score file in SpamAssassin's source, rounded; the meanings are the rules' own descriptions, shortened. Updated rules ship different scores, so read the numbers as an illustration.

X-Spam-Status: No, score=2.8 required=5.0 tests=BAYES_50,DKIM_SIGNED,
  DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_ONLY_04,HTML_MESSAGE,MIME_HTML_ONLY,
  RDNS_NONE,SPF_HELO_NONE,SPF_PASS autolearn=no version=4.0.1

 pts  rule                 what it means
 0.8  BAYES_50             Bayes spam probability is 40 to 60%
 0.1  DKIM_SIGNED          has a DKIM signature, not necessarily valid
-0.1  DKIM_VALID           at least one valid DKIM signature
-0.1  DKIM_VALID_AU        valid DKIM signature from the author's domain
 1.2  HTML_IMAGE_ONLY_04   HTML: images with 0-400 bytes of words
 0.0  HTML_MESSAGE         HTML included in message
 0.1  MIME_HTML_ONLY       message only has text/html MIME parts
 0.8  RDNS_NONE            delivered by a host with no reverse DNS
 0.0  SPF_HELO_NONE        HELO does not publish an SPF record
-0.0  SPF_PASS             sender matches SPF record

Two things stand out. First, most rules here are worth almost nothing: HTML_MESSAGE matches any message with HTML in it and is scored 0.001; other rules build on it, but on its own it costs you nothing. Second, the points that matter came from three places: the image-heavy layout, the missing reverse DNS, and a Bayes filter that could not decide. At 2.8 the message passes the default threshold; one listed link domain on top could push it past 5.

The causes you can fix

• No text part (MIME_HTML_ONLY). The message has only a text/html part. On its own the default score is small, but a text part that says something different from the HTML matches MPART_ALT_DIFF, which scores more, so generate it from the HTML rather than writing a stub. The plain-text email guide covers the part; the plain-text generator builds one from your HTML.
• Mostly images (HTML_IMAGE_ONLY_*, HTML_IMAGE_RATIO_*). The HTML_IMAGE_ONLY rules are bucketed by how many bytes of words sit next to the images, and in the default score file most buckets carry one to two points. Put the offer in live text and keep images for illustration. The spam checker flags image-only emails and a low text-to-image balance.
• Authentication (SPF_*, DKIM_*). Passing SPF and a valid DKIM signature from your own domain earn small negative scores; SPF_SOFTFAIL adds points, and DKIM_INVALID marks a signature that does not verify. The records themselves are covered in the email deliverability guide; check yours with the SPF checker, DKIM checker and DMARC checker.
• Listed link domains (URIBL_*). Rules such as URIBL_DBL_SPAM (Spamhaus DBL) and URIBL_BLACK look up the domains your links point to. One listed tracking or shortener domain is enough. URIBL_BLOCKED is different: it means the server's own query to URIBL was blocked, not that your link is listed. The spam checker flags shortened links, which hide the domain from you as well.
• No reverse DNS (RDNS_NONE, RDNS_DYNAMIC). The IP that delivered the message has no PTR record, or one that looks dynamic. This is a property of the sending server, not the email: fix it with your host, or send through a service that sets it. The Received headers show which IP handed the message over; paste them into the email header analyzer.

Bounces are a separate signal from the score; for what a refusal code means, see hard vs soft bounces.

Getting a score for your own email

The direct way is to send the real message, through your real sending service, to an address whose server runs SpamAssassin, then read the X-Spam-Status header of what arrived. Sending matters: authentication, reverse DNS and the Received chain only exist once the message has travelled.

If you have SpamAssassin installed, you can also score a saved message locally. Test mode pipes the message through and appends the report:

spamassassin -t < message.eml

# local tests only, no network lookups
spamassassin -t -L < message.eml

The manual warns that the test-mode report text assumes the message is spam, since normally only spam sees it: “pay attention to the score instead.” A local run on a draft will also miss whatever depends on delivery, so treat it as a content check.

What our spam checker does instead

The Emailens spam checker is not SpamAssassin and does not compute a SpamAssassin score. It runs our own engine in your browser on the HTML you paste and gives a content score out of 100, where higher is better. The two scales do not convert into each other.

It looks at the content signals you can change before sending: trigger phrases, words and subjects in capitals, heavy punctuation, image-only layouts and a low text-to-image balance, hidden text, shortened links, links whose text names another site, and a missing unsubscribe link or postal address. It cannot see your sending IP, blocklists, reverse DNS or a Bayes filter trained on someone else's mail, which is why it is worth running before the send, and a real SpamAssassin header is worth reading after it.