Why do spam filters disagree on the same email?

You send the same email to ten different providers. Two mark it as spam. Three let it through. One blocks it entirely. No changes to content, headers, or sender setup. Why?

The answer lies not in the email, but in how different filters measure spam risk. Rspamd and SpamAssassin—two widely used spam filters—don’t speak the same language. One uses normalized scores; the other relies on raw totals. The same message can score differently across systems, directly affecting inbox placement.

Key takeaways

  • Rspamd normalizes scores to a 0–100 scale, reducing variance across different rule sets and making thresholds more predictable.
  • SpamAssassin uses raw scores based on accumulated rule violations, which can vary widely depending on configuration and rule set size.
  • Different scoring systems mean the same email can be flagged by one filter and ignored by another, even with identical content.

What does SpamAssassin's raw score system actually measure?

SpamAssassin’s raw score system measures the cumulative likelihood that an email is spam, based on how many rules it triggers—each with a fixed numeric weight. The final score is simply the sum of all rule hits, with no scaling or normalization. A score above 5.0 usually means the email is treated as spam, though this threshold can vary by configuration. You don’t get a normalized “spam probability”—just a raw total.

How scores are assigned and accumulated

Each rule in SpamAssassin, like detecting multiple URL links or suspicious headers, is assigned a score between 0.1 and 10, based on how strongly it correlates with known spam patterns. These values aren’t arbitrary—they’re derived from empirical analysis of spam and ham (non-spam) samples. When an email triggers several rules, their individual scores add up directly.

Let’s say an email gets flagged for using all-caps in the subject line (+2.5), contains a suspicious link (+1.8), and includes a suspicious “urgent” word in the body (+0.9). The total score is 5.2. That’s enough to trigger filtering—no further analysis needed. This approach is straightforward: more triggers = higher score.

Why raw scores don’t reflect real risk

The biggest drawback? A raw score doesn’t account for context or scale. An email with 10 weak triggers (each +0.5) adds up to 5.0—same as one with five strong triggers (each +1.0). But the risk profile is different. One may be overly cautious; the other more likely truly spam.

This is where systems like Rspamd shine. It normalizes scores using logarithmic scaling and machine learning, so a high score reflects not just the number of rules triggered, but their relative severity and correlation. For example, Rspamd might treat a single high-weight trigger more heavily than ten low ones, even if the count is the same. This leads to more balanced decisions—especially important when your email list has mixed sender reputation.

If you’re sending to large lists, the raw sum model can lead to false positives. A single misconfigured campaign might push otherwise valid emails over the 5.0 threshold, causing deliverability spikes. Tools like the MailTester bulk verification help catch invalid or risky addresses before they trigger spam filters—keeping your score low and your inbox placement high.

SpamAssassin’s design reflects an older, rule-based era. While still widely used, it lacks the adaptability modern filtering needs. For teams aiming for consistent inbox delivery, especially across different domains and user behaviors, relying on raw totals alone isn’t a robust long-term strategy.

For deeper insight, the IETF’s RFC 5322 covers core email structure—helping explain why certain headers or content patterns trigger spam rules. Still, it doesn’t address scoring logic, which remains the domain of spam detection systems like SpamAssassin and Rspamd.

How does Rspamd's score normalization differ from SpamAssassin?

Rspamd replaces SpamAssassin’s raw score system with a normalized 0–100 scale, where each rule’s impact is weighted and adjusted relative to others. Unlike SpamAssassin, which totals individual rule scores and can produce high values (e.g., 30+), Rspamd scales results so a 90 always means “highly likely spam,” regardless of how many rules were triggered. This makes spam detection more consistent and predictable across different message volumes and types.

Why normalization reduces score noise

Let’s say a message triggers 50 low-weight rules in SpamAssassin—resulting in a 25-point score. That’s ambiguous. Rspamd calculates how those rules relate to one another and their overall influence. It doesn’t count how many rules fired—it counts how strongly they pushed the normalized score over the threshold. This reduces false positives from minor, unrelated triggers.

Weighting and scaling for stability

Each rule in Rspamd is assigned a weight based on its proven impact. High-impact rules (like a known spam signature) contribute more to the final score than low-impact ones (like a missing "Reply-To" header). The system scales these weights dynamically, meaning a single strong trigger can dominate, while many weak ones won’t distort the result. The end result is a consistent 0–100 score you can trust.

For example, a spam message with 10 link-heavy headers might score 92 in Rspamd—clearly spam—while a low-volume campaign with 20 small rule hits might score only 45. In contrast, SpamAssassin might flag the second message with a 28-point score, which many systems treat as “possible spam” without clear thresholds.

Normalization also helps in real-world deployment. Large volume senders or high-frequency emailers don’t need to tune thresholds based on message size or content complexity. Rspamd handles the complexity internally, letting you focus on the final score—and your deliverability.

Still, normalization isn’t perfect. It relies on accurate rule weighting and training data. If the rule set isn’t regularly updated, scores can drift. But its design intentionally prioritizes stability—making it a solid choice for systems where consistent decision-making matters more than granular control.

When sending email at scale, catching bad addresses early saves resources and protects sender reputation. You can validate your lists before sending with tools like bulk email verification that checks for syntax, domain validity, and inbox likelihood—helping you avoid the very spam traps Rspamd is built to detect.

What happens when a message scores 5.0 in SpamAssassin?

When a message hits a 5.0 score in SpamAssassin, it’s flagged as spam by default—especially if other systems like Spamhaus or SpamAssassin’s own reputation checks also raise red flags. But here’s the catch: a 5.0 can come from one strong signal (like a 3.0 rule) plus several minor ones (like two 1.0s), meaning the score doesn’t always scale linearly with actual spam intent. Let’s break that down.

SpamAssassin’s raw scoring isn’t a direct signal of spamminess

SpamAssassin uses a raw score system where each rule adds or subtracts points. A 5.0 threshold is a simple cutoff, but it doesn’t tell you how the score was built. One email might hit 5.0 because of a single high-value trigger—like a blacklisted domain or a suspicious link pattern—while another hits the same score from a chain of low-weight signals, like a generic “urgent” subject line and a few questionable header fields. The real spam risk isn’t in the total, but in the mix and context.

For example, a 3.0 rule might flag a message with a known malicious URL, while two 1.0 rules could flag an overly promotional tone and a lack of plain-text content. Both add up to 5.0, but the underlying behavior—malicious intent vs. poor send hygiene—differs. That’s why relying solely on raw scores can misclassify low-risk messages as spam.

Why normalization matters: Rspamd’s different approach

This is where Rspamd’s score normalization shines. Instead of adding raw points, Rspamd applies machine learning and statistical weighting to normalize scores across rules. It accounts for rule frequency, signal overlap, and real-world patterns. A 5.0 in Rspamd means something more consistent across messages, reducing false positives that plague SpamAssassin’s additive model.

Industry practices reflect this: mail providers like Gmail and Yahoo use normalized, weighted models that go beyond simple point totals. A 2022 report by Return Path (now Validity) noted that sender reputation and behavioral signals outweigh static rule scores in modern filtering. This is why systems like Rspamd, with their dynamic normalization, tend to outperform raw-score models in real-world inbox placement.

While you can’t avoid SpamAssassin’s scoring quirks if you’re using it, you can mitigate their impact with better hygiene and pre-sending validation. Tools like MailTester’s bulk verification scrub invalid, disposable, and catch-all addresses—types that often trigger false spam flags even in clean messages—before they ever hit your filter.

What’s the real downside of using raw scores for spam filtering?

Raw scores from SpamAssassin make tuning unpredictable—two nearly identical emails can differ by 5+ points due to minor rule variations, making it hard to know if changes actually fix spam or just shift the line. Small updates to rules often cause unpredictable shifts in classification, turning tuning into a trial-and-error process that doesn't reflect real sender behavior.

Small changes, big swings in results

SpamAssassin’s raw score system doesn't normalize across mail streams, so a rule adjustment on one domain might shift a message from "ham" to "spam" without any clear signal about why. Let’s say you tweak a link analysis rule—suddenly, a newsletter with a single link in a footer crosses the spam threshold. This behavior is hard to debug because the total score isn’t contextual; it’s just a number, and the system offers no way to compare it across different senders or message types.

That lack of consistency undermines reliability. You can’t use a raw score as a stable signal for decisions like rate limiting or sender reputation. In practice, this means administrators often rely on heuristics or thresholds that degrade over time. A score of 5 might mean "ham" today, but after a minor rule shift, it could mean "spam" tomorrow—even if the content hasn’t changed.

Opaque tuning and poor visibility

The system’s opacity makes it hard to measure genuine improvement. You can’t track progress with confidence because the score isn’t normalized. For example, a 2-point drop in score after a content fix might not reduce spam detection rates if the underlying scoring distribution is unstable across batches.

This isn't just theory. RFC 5451, which outlines content filtering best practices, notes that consistent score normalization across systems improves reliability in shared environments. Without it, even honest senders can be penalized based on algorithmic noise rather than intent.

If you’re trying to reduce bounces or blocked emails, a predictable baseline is essential. That’s why tools like Rspamd—using normalized scores—let you compare results across campaigns, domains, and time zones with confidence. The alternative? A system where your fix doesn’t show up in the numbers, or worse, makes things worse.

For teams that care about consistent deliverability, verifying your list’s quality before sending is critical. If you’re sending to high-risk addresses, you’ll want to catch those early. Check individual email addresses for validity and risk before sending, so your spam score data starts from a clean slate.

How does normalization improve spam filtering consistency?

Rspamd’s score normalization balances the influence of individual spam rules, so one overly aggressive rule doesn’t dominate the final decision. Unlike SpamAssassin’s raw score system, where a single strong signal can tip the scale, Rspamd weights each rule relative to others, making filtering more stable across message variations. This reduces false positives and ensures consistent decisions, even when rules trigger in unexpected combinations.

Outliers don’t skew results

Let’s say one rule flags a message as spam with a raw score of 100, while ten weak rules each contribute +1. In SpamAssassin’s system, that single strong signal can override everything else—resulting in a 100-point spam flag, even if the rest of the message is clean. Rspamd normalizes this, so no single rule can dominate. The same ten weak triggers now sum to a minimal impact, and the overall score reflects the message’s true nature more accurately.

Consistency across minor changes

That stability matters when you send the same message with small variations—like changing a subject line or adding a single link. In SpamAssassin, a single trigger might push an inbox message into spam due to raw point accumulation. Rspamd’s normalized system averages these small shifts, making threshold-based decisions less sensitive to tiny changes. This means a well-crafted email stays in the inbox even when slight tweaks happen during bulk delivery.

Normalization is particularly useful when managing large-scale email volumes. Without it, systems can misclassify valid messages based on a single odd trigger—what might be a low-impact anomaly in a large dataset becomes a gatekeeping event. Rspamd’s approach aligns better with how real-world email patterns behave. For a real-world example, see how the SMTP RFC emphasizes consistent handling of message content, not arbitrary thresholds.

You can test how normalization affects deliverability by simulating real inbox placement with tools like the inbox placement test. Use it to validate how your content behaves across filters and whether minor changes affect your deliverability score. For teams validating email lists at scale, bulk verification helps surface problematic addresses before they harm sender reputation.

Can normalization ever mask real spam risk?

Yes—over-normalization can flatten out subtle but high-risk patterns, making it harder for systems like Rspamd to catch sophisticated spam. When diverse rule scores are forcibly scaled into a narrow range, rare but dangerous signals can get lost in the noise. A well-tuned system must balance normalization with sensitivity to rule diversity.

How normalization can bury hidden risks

Let’s say a spammer uses a rarely triggered but high-fidelity pattern—like a malicious URL structure paired with a domain from a recently compromised network. In SpamAssassin’s raw system, that single rule might push the score over the threshold, even if other rules are quiet. Rspamd’s normalization, however, may dilute that signal if the overall score distribution is heavily skewed toward average behavior.

When normalization downweights rule diversity—treating a hundred minor alerts the same as a single critical one—it risks treating a 100% accurate detection as mathematically equivalent to a dozen weak signals. This erodes the ability to detect subtle, yet malicious, email behavior. It’s not that normalization is flawed, but that poor implementation can create blind spots.

Why balance and validation matter

Every scoring model needs periodic validation. What works today may not tomorrow—especially as spammers adapt. Rspamd’s flexibility lets you adjust weights and thresholds, but that requires ongoing monitoring. You can’t assume normalization alone ensures accuracy.

Consider this: a rule identifying a known malicious IP in a hidden part of an email header might be flagged with a +1 in SpamAssassin. In Rspamd, if that rule is grouped under a broader category with diminishing returns, its weight may be reduced—making it ineffective over time. Without regular review, you might miss the same pattern being used across new campaigns.

Tools like the inbox placement tester help confirm whether your email actually lands in inboxes by simulating real user environments. It’s not just about the score—it’s about real-world behavior. You can’t rely on a single metric, normalized or raw, to guarantee deliverability.

Ultimately, the choice between raw and normalized scoring isn’t about superiority—it’s about context. The best systems combine both approaches: use raw data to preserve signal integrity, then normalize selectively to avoid false positives. But that balance requires attention. Ignoring it means accepting silent failures in your spam detection pipeline. RFC 5477, which outlines spam filtering best practices, emphasizes continuous monitoring—because no system is immune to drift.

Why does this matter for email deliverability?

Spam filtering isn’t consistent across providers—some use raw scores like SpamAssassin, others normalize them like Rspamd. This mismatch means an email flagged as spam by one system might pass through another. Deliverability hinges on predictable filter behavior, and normalization helps reduce false positives by evaluating context, not just point totals. Without testing real-world results, you’re guessing whether your emails will land in the inbox.

Raw scores vs. normalized systems: what’s the practical difference?

SpamAssassin’s raw score system assigns points for each spam signal—domain reputation, suspicious links, or missing authentication—adding them up like a grade. But a high score doesn’t always mean spam, especially if the sender has a strong reputation. Rspamd, on the other hand, normalizes scores so the same email might score 30 in one system and 6.2 in another, based on weighted thresholds. This approach avoids overreacting to minor red flags.

Let’s say your newsletter gets 15 points in SpamAssassin and gets blocked. But Rspamd’s weighted analysis sees your sender history, domain age, and engagement signals—they might accept it. The same message passes through one filter, fails in another.

How real-world testing catches these inconsistencies

This is why testing delivery outcomes across multiple providers is essential. A message that scores “safe” on paper might still land in spam because the recipient’s mail server uses a different filtering model. That’s where inbox-placement testing comes in. Tools like MailTester’s inbox-tester simulates sending to real inboxes across Gmail, Outlook, Yahoo, and others, showing you exactly where your emails end up.

MailTester’s inbox placement tests don’t rely on score predictions—they use real mail servers. This exposes how normalization or raw scoring affects delivery. A sender with a high SpamAssassin score could still succeed in a system that weighs reputation and engagement more heavily.

For example, if you’re sending transactional emails, a raw score system might flag your message due to a missing header field. Rspamd, with its normalization, might consider your domain’s history and user engagement to override that flag. But unless you test against actual inboxes, you won’t know which filter wins.

Use this insight to refine your sending practices. Test regularly with tools like MailTester’s inbox-placement tester to see how your emails perform in the real world, not just in theory.

How can you test if your email content triggers spam filters?

You can reliably test if your email content triggers spam filters by sending real test messages to a diverse set of domains and analyzing final delivery outcomes—like inbox placement, spam folder detection, or outright rejection—across different filtering systems. This reveals how each system, such as Rspamd’s normalized scores or SpamAssassin’s raw score thresholds, responds to your content in practice.

Test with real-world inbox placement

  1. Send test emails to a range of domains across major providers (Gmail, Outlook, Yahoo, Proton, Apple Mail) using a clean, dedicated test address. This simulates real delivery conditions and exposes how each filter interprets your content.
  2. Use a tool like MailTester’s inbox-placement feature to send these tests automatically and receive detailed reports on final delivery state. You’ll see not just if the email arrived, but whether it landed in the inbox, spam folder, or was blocked entirely. Learn how inbox placement testing works.
  3. Compare results across filtering systems—Rspamd often applies thresholds that normalize scores across multiple criteria, meaning high content risk might be offset by strong sender reputation. SpamAssassin, by contrast, accumulates raw points. A single high-scoring rule in SpamAssassin may trigger rejection, while Rspamd might balance it with other metrics.
  4. Check deliverability performance at scale by testing with 5–10 different domains per provider. A single test can be misleading; consistency across tests gives you real insight into how filters assess your content. Tools like MailTester’s email checker help validate addresses first to avoid noise from invalid or inactive ones.
  5. Review the logs and headers of delivered messages. Look for DSN codes, X-Spam-Status, or similar fields to understand why a message was filtered. Standards like RFC 6650 define how some headers should be structured, and their presence or absence can affect filtering behavior.

Spot normalization vs raw scoring in action

When testing, watch for patterns: does a message pass filtering with one provider but fail with another—even with identical content? That divergence often stems from how each system handles scoring. SpamAssassin’s raw point system can be more sensitive to specific rule hits, while Rspamd’s normalization might suppress false positives by weighing sender reputation, domain alignment, and historical behavior.

Let’s say your email contains a promotional link and a high link-to-text ratio. On SpamAssassin, this could push the score above the 5.0 rejection threshold. On Rspamd, if your domain has good reputation and no prior complaints, the same content might still pass. Testing across systems reveals this difference — and helps you tune content, structure, and sender setup accordingly.

What happens during bulk email sends when spam filters behave inconsistently?

When spam filters use raw scoring like SpamAssassin, identical content can be flagged as spam on one server and approved on another—especially during bulk sends. This inconsistency means valid emails get blocked unpredictably, hurting deliverability even with good sender reputation. Rspamd’s score normalization reduces this variability by standardizing scores across systems, leading to more consistent inbox placement.

Raw scores vary too much for reliable bulk sends

SpamAssassin’s raw score system assigns points based on rules like header format, link density, or image-to-text ratio. But different mail providers apply these rules differently—some are stricter, others more forgiving. The same newsletter sent to 100,000 inboxes might hit 20% rejection on one mailbox, 5% on another, with no clear pattern.

Even if you’ve built a strong sender reputation, poor content formatting—like a single suspicious link or one overused emoji—can push a message over the threshold on one system but not another. This makes it nearly impossible to predict spam filter behavior at scale.

Normalization brings stability to scoring

Rspamd doesn’t just score—it normalizes. It adjusts raw rule points to a consistent scale, factoring in sender history, domain reputation, and real-time feedback. This means an email with borderline content gets a fairer review across different providers. A 3.0 score in Rspamd has the same meaning whether it's received by Gmail, Outlook, or ProtonMail.

Think of it like this: raw scores are like speed limits set by different cities—50 kph here, 100 kph there. Normalization is like setting a universal speed index based on risk, so you know what’s actually dangerous, regardless of local rules. The result? More predictable delivery, fewer false positives, and better inbox placement over time.

For teams handling high-volume sends, this consistency is critical. A single misclassified message can trigger a blocklist warning or trigger reputation penalties. Tools like inbox placement testing help validate how your message lands across real inboxes, including those behind Rspamd or SpamAssassin-style filters.

The bottom line: score system choice shapes deliverability outcomes

Rspamd’s score normalization turns a complex, variable system into consistent, repeatable results. By scaling all scores to a 0–100 range, it reduces noise from minor fluctuations and makes it easier to set reliable thresholds across different environments.

SpamAssassin’s raw scoring, while detailed and precise in theory, introduces instability. Small changes in header structure or content can shift scores significantly, making it hard to maintain consistent inbox placement, especially at scale.

For high-volume senders, predictability matters more than fine-grained detail. Rspamd’s approach reduces variability in scoring outcomes, leading to more stable deliverability and fewer surprises in inbox placement.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does a higher score always mean an email is spam?

No. A high score indicates spam likelihood, but the threshold and system behavior vary. Rspamd normalizes this risk into a consistent range, while SpamAssassin adds raw scores, which can be misleading.

Why do two emails with similar content have different spam scores?

Differences in headers, routing, or content order can shift rule triggers. SpamAssassin’s raw scores are sensitive to these changes; Rspamd’s normalization dampens such effects.

Can I test how my email will be scored by different filters?

Yes. MailTester offers inbox-placement testing to simulate delivery across real providers, revealing differences in scoring behavior.

Does Rspamd always beat SpamAssassin in accuracy?

Not inherently. The scoring method affects behavior, but accuracy depends on rule quality. Rspamd’s scaling improves consistency, not absolute detection.

How do normalized scores affect sender reputation?

They reduce false positives from low-risk signals. This improves reputation by lowering unnecessary bounces and spam complaints.

Is it better to use a system with raw scores or normalized scores?

Normalization improves predictability. Raw scores are precise but fragile. For deliverability, consistent scoring leads to better results.

Do all email service providers use Rspamd or SpamAssassin?

No. Providers use various spam filters with different scoring logic, including proprietary systems. Test across platforms to understand actual behavior.

Can I adjust my content to beat SpamAssassin's raw score system?

Yes, but it’s hard to predict. Avoid common spam triggers, and test with tools like MailTester instead of guessing rule behavior.

What role does sender reputation play alongside spam scoring?

Reputation influences scoring thresholds. A good reputation can forgive minor hits. But scoring system choice still shapes final delivery outcomes.

How often do spam filters reassess their rules?

Providers update rules continuously. Normalized systems adapt better to rule changes because they scale relative to the whole set.

Can normalization lead to lower detection of real spam?

Possibly. Over-normalization may reduce sensitivity. But most modern systems balance this with machine learning and threat intelligence.

Does MailTester account for different spam scoring systems?

Yes. Through inbox-placement testing, MailTester evaluates how messages land across real provider systems, reflecting differences in their underlying filters.