Short answer: A spam filter runs every incoming message through a series of checks and adds up a suspicion score: the sending server's reputation, SPF/DKIM/DMARC results, spam patterns in the content, links and attachments. Messages above the threshold are rejected or quarantined; clean mail is delivered. In a business setting the filter usually sits in front of the mail server, receiving mail via the domain's MX record.
Why do you need a spam filter?
Spam is not just annoying advertising. A large share of unwanted mail that reaches business mailboxes is designed to do damage:
- Phishing: messages impersonating a bank, a delivery company, Microsoft 365 or a supplier and asking for a password or card details.
- Malicious attachments: files disguised as invoices, purchase orders or quotes that install ransomware or spyware when opened.
- Business email compromise (BEC): fake messages "from the CEO" asking finance to make an urgent wire transfer.
- Bulk spam: advertising that fills mailboxes, wastes time and buries the messages that matter.
One click on one phishing email can hand an attacker a company mailbox, get your mail server blacklisted when that account starts sending spam, and turn into a reportable personal data breach. A spam filter keeps those messages from ever landing in front of your staff.
How a spam filter works, layer by layer
A good filter never relies on a single rule. It passes each message through several layers and combines their scores:
| Layer | What it checks | What it catches |
|---|---|---|
| 1. Connection and reputation | Is the sending IP on a blocklist such as Spamhaus? Does it have reverse DNS? Does the server follow SMTP rules? | Botnets, compromised servers, known spam sources |
| 2. Greylisting | Temporarily defers mail from a sender it has never seen and waits for a retry. | Cheap spam software that never retries (451 4.7.1) |
| 3. Authentication | SPF, DKIM and DMARC results: is the From address really from that domain? | Domain spoofing, fake bank and delivery notices |
| 4. Content analysis | Subject and body text, HTML structure, known spam patterns, statistical (Bayesian) learning. | Advertising spam, scam text |
| 5. Link analysis | Are linked domains blocklisted or newly registered? Does the visible link text match the real destination? | Messages pointing to phishing pages |
| 6. Virus and attachment scanning | Antivirus signatures and risky file types (.exe, macro-enabled Office files, password-protected archives). | Attachments carrying ransomware or trojans |
Each layer adds points. Above one threshold the message is quarantined; far above it, it is rejected outright. A single failed check (for example, a legitimate supplier with a broken SPF record) does not block a message on its own, which keeps false positives down.
Types of spam filters
| Type | How it works | Pros | Cons |
|---|---|---|---|
| Email client filter | The built-in junk filter in Outlook, Apple Mail or Thunderbird. | Free | The message has already reached the server and the device, malicious attachment included. Per user, no central management. |
| Filter on the mail server | SpamAssassin in cPanel, Rspamd, or a similar filter running on your own server. | Usually included with hosting | Uses server resources, limited tuning; every spam message still reaches your server. |
| Mail provider filter | The built-in filtering in Gmail / Google Workspace or Microsoft 365 (Exchange Online Protection). | Nothing to set up | Only covers that provider; limited control over quarantine and rules. |
| Gateway filter | A service placed in front of the mail server through the MX record, scanning mail before it reaches the server. | Spam never reaches your server; central quarantine; independent of your mail platform | Requires an MX change; a paid service. |
For the details of the gateway approach, see what is an email security gateway?
Quarantine and false positives
A quarantine is a separate holding area for messages the filter considers suspicious. They do not reach the inbox, but they are not deleted either: the user or an administrator can review the quarantine and release a legitimate message with one click.
A false positive is a legitimate message the filter wrongly treats as spam. You cannot eliminate them completely, but a good filter makes them harmless:
- A daily quarantine digest lets you spot an important message before you miss it.
- Releasing a message lets you mark the sender as trusted, so it is not quarantined again.
- Senders you never want to hear from can be blocked and are turned away at the door.
How to choose a spam filter for your business
- Does it touch your existing setup? A solution that does not require changing your mail server, addresses or email clients turns a migration of days into minutes.
- Who manages the quarantine? If every employee can review their own quarantine without yet another password, IT gets fewer tickets.
- Where is mail processed? Email content contains personal data. Know where the provider processes and stores it, and make sure a data processing agreement covers it (see email security and GDPR).
- How is it priced? Per mailbox or per domain? How does the cost change as you grow?
- Test before you commit. Running it on your real traffic for a few days and looking at what lands in quarantine tells you more than any sales deck.
How Spambil does it: Spambil is a spam filter that runs in front of your mail server. You change your MX record, incoming mail goes through the layers above, and clean messages are delivered to your existing server within seconds. Employees manage their own quarantine from a password-free link and get a daily digest. Details: Spambil spam filter.
Want to see it on your own traffic? Point your MX record to Spambil and try it free for 7 days. No credit card required.
Frequently asked questions
Does a spam filter affect my outgoing email?
An inbound filter (a gateway) does not touch outgoing mail; your messages keep leaving from your existing server. Your own mail landing in other people's spam folders is a separate problem, covered in our guide on emails going to spam.
Is a free spam filter good enough?
SpamAssassin on your hosting plan or the Gmail/Outlook filter catches basic spam. If you need a central quarantine, protection against phishing and malicious attachments, company-wide rules and reporting, a gateway filter is the better fit.
Does a spam filter delay email?
Scanning usually takes a few seconds. With greylisting, only the first message from a sender the filter has never seen may be delayed by a few minutes.
Does a spam filter give 100% protection?
No filter catches everything. A filter stops the vast majority of attacks; for the small remaining risk, staff who can recognize phishing are the last line of defense.