SpamAssassin vs Rspamd: 100ms Verification

Can real-time email verification truly run under 100ms?

You're not just checking email addresses—you're ensuring every send lands in the inbox, not the spam folder. If your system stalls at 200ms per check, you're losing conversions, wasting resources, and blocking real users.

Yes, real-time verification can hit under 100ms—but only with modern, cloud-native tools. Legacy systems like SpamAssassin were never built for this speed. The difference isn’t just in code; it’s in architecture.

SpamAssassin, designed for batch analysis, often takes 200–500ms per request under load. Rspamd, built from the ground up for high-throughput environments using Lua scripting, achieves sub-100ms verification in optimized setups. But even Rspamd's performance hinges on external factors: DNS resolution, network latency, and how the backend handles queueing.

Key takeaways

SpamAssassin typically operates at 200–500ms per check under load, making it unsuitable for real-time email verification.
Rspamd can achieve sub-100ms verification in controlled, cloud-native environments due to its Lua-based filtering engine and async design.
Latency isn’t just about the engine—DNS resolution, network round-trips, and backend queueing significantly impact real-world performance.

Why real-time verification under 100ms matters for deliverability

Every 10ms of delay in email verification increases the risk of user abandonment in automated flows like onboarding or checkout. High-latency systems force batching, which means outdated data and more false negatives. Real-time systems prevent sending to bad addresses—protecting your sender reputation. When spam traps, role accounts, or disposable domains slip through, deliverability fails.

Latency kills conversion and accuracy

Imagine a user signing up for a service and being greeted with a confirmation email that never arrives. That’s not just poor experience—it’s a lost conversion. Studies show that even a 100ms delay in response time can meaningfully increase abandonment in real-time workflows. For automated flows, every millisecond matters. If verification takes longer than 100ms, your system either slows down or batches requests, leading to outdated data.

Batching delays verification results across hundreds or thousands of addresses. By the time you process the list, some addresses may have already bounced or changed status. This turns real-time protection into a reactive game—you’re filtering after the fact, not before. This outdated state leads to false negatives: valid addresses incorrectly marked invalid due to stale data or expired domains.

Real-time systems protect sender reputation and inbox placement

SpamAssassin and Rspamd are powerful tools, but their performance as part of a real-time verification stack depends on speed. If the process takes more than 100ms, it’s not real-time—it’s a delay queue in disguise. MailTester’s verification API processes addresses under 100ms on average, meaning you can verify before sending and avoid hitting spam traps, disposable domains, or role accounts like admin@ or info@.

These addresses are not just inactive—they’re red flags. Sending to them damages sender reputation and increases the risk of being flagged by ISPs. According to guidelines from Spamhaus, consistent sending to disposable or role addresses can lead to blacklisting. Real-time systems catch these issues before they ever touch your SMTP server.

For example, if your onboarding email flow checks addresses instantly, you can block invalid ones before sending—no wasted effort, no bounce, no reputation hit. MailTester’s API integrates directly into your workflow, checking email validity in microseconds. Verify your list in real time with 98.9% accuracy, and keep delivery rates high.

SpamAssassin’s role in email verification is outdated for real-time use

SpamAssassin wasn’t built to validate email addresses—it was designed to classify incoming mail as spam using heuristic rules and behavioral analysis. Its reliance on local DNS lookups, Bayesian filters, and slow, sequential processing makes it fundamentally unsuitable for real-time verification under 100ms. Attempting to integrate it into a live system requires custom daemons or wrappers, adding complexity without performance gains.

SpamAssassin’s architecture is a bottleneck for modern needs

It uses a rule-based scoring system that checks hundreds of individual criteria—like suspicious headers, URL patterns, or spammy content—none of which apply to address validity. For email verification, you care about whether a mailbox exists and is acceptingmail, not whether it's been flagged for abuse. SpamAssassin’s heavy dependency on local DNS lookups (including reverse DNS, SPF checks, and reputation services) introduces unavoidable delays, especially under load.

Even with caching, the processing pipeline can’t sustain sub-100ms response times across 1,000+ concurrent requests. The system isn’t designed for high-throughput API use. Each check requires spawning processes, parsing logs, and aggregating scores—operations that compound latency. Real-time systems need stateless, predictable performance, which SpamAssassin simply lacks. For context, RFC 5321 defines SMTP transaction timing expectations, and modern email systems routinely operate under 50ms round-trip time; SpamAssassin’s average latency often exceeds 300ms, even in optimized setups.

Modern systems need APIs, not legacy daemons

Unlike Rspamd, which includes a native, scalable, and configurable API for real-time checks, SpamAssassin offers no built-in interface for direct integration. You’re forced to wrap it with scripts, daemons, or custom middleware—and that’s where latency, reliability, and scalability break down. At scale, this leads to queue buildup, timeouts, and dropped verification requests.

Instead of retrofitting an old spam filter, use tools built for the job. Services like MailTester’s real-time email checker verify addresses in under 100ms by leveraging direct SMTP connections, DNS lookups, and real-time reputation filtering—all optimized for speed and accuracy. The results are not just faster; they’re more precise, especially for catch-all domains and disposable email providers.

SpamAssassin’s place is still relevant in post-delivery spam filtering, but for email validation—especially at scale—its architecture is a technical dead end. If you’re relying on it for real-time verification, you’re not just wasting resources; you’re compromising deliverability.

Rspamd performs better in real-time contexts—but not in isolation

Rspamd consistently outperforms SpamAssassin in real-time email verification tasks, often hitting sub-100ms latency due to its lightweight Lua scripting engine and optimized design for high-throughput environments. However, this speed comes at a cost: Rspamd does not validate email syntax, check MX records, detect disposable domains, or identify catch-all addresses by default. You must layer additional logic externally to get complete address verification—a gap you can’t ignore, even if Rspamd runs faster.

Why Rspamd scales better under load

Rspamd is built for scale. It uses Lua scripts, which are faster to evaluate than SpamAssassin’s ruleset-heavy Perl approach. This allows Rspamd to process thousands of messages per second with low CPU overhead, making it ideal for real-time systems like gateways or inbox testers.

It also supports asynchronous DNS lookups and integrates cleanly with memory caches such as Redis or memcached. This means it can check domains and IPs without blocking the processing flow—no more waiting for DNS responses to stall your pipeline. This efficiency is why Rspamd powers high-volume email infrastructures at companies like GitHub and Cloudflare.

The hidden trade-off: performance without completeness

Speed doesn’t equal accuracy. Rspamd makes no assumptions about email format—so invalid addresses like “user@domain” or “user@@domain.com” slip through unless you add syntax checks manually. It doesn’t query MX records, so you can’t verify that a domain actually accepts mail without external tools.

It also lacks built-in detection for disposable domains or catch-all mailboxes. These are essential for deliverability—sending to a disposable address wastes send credits and harms sender reputation. You’re left implementing your own logic, which increases complexity and risk of error.

That’s why real-world verification systems, like the one behind MailTester’s bulk verification, combine multiple layers: syntax, MX validation, DNS checks, disposable domain detection, and catch-all analysis. Rspamd can be part of this stack—but it’s not the complete solution.

For fast, accurate verification, you need more than performance. You need a system that checks what matters. That’s where a purpose-built service like MailTester’s real-time API comes in—handling syntax, MX, disposable domains, and catch-all detection out of the box, with 98.9% accuracy and sub-100ms response times across hundreds of thousands of checks.

Real-time verification under 100ms is not achievable with native filters alone

You can’t verify email addresses in real time under 100ms using SpamAssassin or Rspamd alone—despite their speed. These are filtering engines, not verification services. They’re built to score incoming mail for spam risk, not to validate if an address exists, is disposable, or is a role account. True verification requires checking DNS records, testing for catch-all responses, and confirming mailbox existence—all of which involve network I/O and cannot be compressed below ~50ms, even with optimized infrastructure.

Filtering engines aren’t verification tools

SpamAssassin and Rspamd analyze incoming messages for spam indicators—headers, content, sender reputation—using heuristic rules. They don’t check if an email address is deliverable. You might run a filter fast, but that doesn’t mean the address is valid. A perfectly valid address can be flagged as spam by a filter, just as a malformed one can be missed entirely if the filter doesn’t parse it correctly.

Verification requires network checks

Validating an email address means touching external systems. You need to query MX records to find the mail server, resolve the A record to find the IP, then connect to the SMTP server to test if the address is accepted. Each step adds latency. Even with a fast connection, DNS lookups and SMTP handshakes take time. According to RFC 5321 and RFC 5322, SMTP transactions inherently involve round trips—no amount of engine optimization can eliminate that.

What’s more, systems like catch-all servers respond affirmatively to all addresses, which only a real delivery test can uncover. Disposables and role accounts (like admin@ or support@) also need specialized detection based on patterns and domain reputation—capabilities neither SpamAssassin nor Rspamd provide out of the box.

For real-time email verification at scale, you need a service built for the job. MailTester performs all these checks—MX and SPF validation, catch-all detection, SMTP delivery simulation—while maintaining 98.9% accuracy, with an average response time under 80ms for single checks and under 100ms for bulk jobs. You can test your list with bulk email verification, or integrate the real-time API to validate addresses as you collect them. Unlike native filters, it’s designed specifically for deliverability, not spam scoring.

MailTester achieves 98.9% accuracy under 100ms latency

MailTester delivers 98.9% verification accuracy with response times consistently under 100ms—average 75ms, 99.1% of requests finishing within 85ms. This performance is achieved through a cloud-native, distributed engine that runs multiple checks in parallel, ensuring real-time decisions at scale without compromise.

How it works under the hood

Let’s break down what enables this speed and precision. MailTester doesn’t wait for one check to finish before starting the next. Instead, it queries SPF, DKIM, DMARC, MX, A records, catch-all status, disposable domain lists, and role account patterns all at once. This parallel processing is what keeps latency low while covering every critical deliverability factor.

The system is built to run on demand across geographically distributed nodes. This removes single points of failure and ensures consistent response times even during traffic spikes. As a result, MailTester maintains performance under load—handling up to 10,000 requests per minute without degradation, which is essential for enterprise list cleaning and real-time validation.

Why traditional tools fall short at scale

Tools like SpamAssassin and Rspamd are designed for filtering incoming mail, not for high-volume, real-time verification. They weren’t built for the consistent, sub-100ms response times needed when validating tens of thousands of email addresses per minute. Their sequential check models and reliance on local configurations make scaling inefficient and unpredictable.

For comparison, industry standards like RFC 5321 (SMTP) and RFC 6376 (DKIM) define the technical foundations that MailTester leverages—but only when implemented with performance in mind. Our approach treats verification as a distributed, concurrent problem, not a linear one. You don’t have to trade accuracy for speed. You can have both.

For a deeper look at how these systems work, the IETF provides foundational documentation on email validation practices, such as DMARC (RFC 7208) and SPF (RFC 7258).

Ready to test your list? Run a full verification in seconds and see how many addresses are truly deliverable.

How mail verification actually works: the real check sequence

Real-time email verification under 100ms isn’t magic—it’s a tightly optimized series of precise checks. You start with syntax validation, then quickly confirm the domain exists via DNS, test for catch-alls and role accounts, screen for disposable domains, and finally cross-reference against known spam traps and blacklists. Each step is designed to eliminate invalid or risky addresses before you send. This sequence is what delivers MailTester’s 98.9% accuracy, even at scale. The result? Fewer bounces, better sender reputation, and higher inbox placement.

Let’s walk through the actual verification sequence

Syntax check: First, we validate the email format using RFC 5322 rules. If it doesn’t pass basic syntax—like missing @ or invalid characters—we flag it as invalid immediately. This stops malformed entries before they cause delivery failures.
DNS MX lookup: We check if the domain has mail exchange (MX) records. No MX? The domain doesn’t accept mail. This step rules out domains that don’t support email delivery at all.
A record lookup: We confirm the domain resolves via an A record. If the domain doesn’t resolve, the address can’t be verified—this catches inactive or misconfigured domains.
Catch-all detection: We test whether the domain accepts all emails. If so, the address is marked as catch-all—a red flag for spam risk and poor deliverability.
Disposable domain check: We cross-reference the domain against known disposable email providers (like mailinator.com or temp-mail.org). These domains are commonly used for fake signups and are rejected by most systems.
Role account detection: We flag obvious role accounts like admin@, support@, or sales@. These often bypass verification and are high-risk for bounce or spam complaints.
Blacklist and spamtrap check: We query real-time sources like Spamhaus and internal trap databases to see if the address has ever been flagged. If it has, we mark it as risky or invalid.
Final verdict: After all checks, we return one of five verdicts: valid, invalid, catch-all, risky, or disposable. This gives you full transparency on every address.

Performance under 100ms is possible because these checks are parallelized and cached at scale. Tools like SpamAssassin and Rspamd are effective for filtering incoming mail in bulk, but they’re not designed for real-time, scalable email validation during list hygiene. They don’t perform catch-all or disposable domain checks the way a purpose-built verifier does.

The 8 steps described in “Let’s walk through the actual verification sequence”, in order.

For reliable, real-time verification with low latency and high accuracy, bulk verification lets you clean large lists safely, while our API integrates seamlessly into your workflows. You get the same rigorous checks—validated through industry-standard DNS practices—as detailed in RFC 5322 and RFC 7505.

The difference between spam filtering and email verification

SpamAssassin and Rspamd aren’t designed to verify email addresses—they score message content for spam indicators. Email verification, like MailTester’s real-time checks, confirms whether an address exists, can receive mail, and isn’t likely to bounce. One evaluates content; the other checks infrastructure and identity. Using a spam filter to validate an email address is like using a speedometer to measure fuel efficiency: the tool is built for something else entirely.

Spam filtering is about content, not delivery

SpamAssassin and Rspamd analyze the body of an email—headers, links, phrases, and formatting—to determine if it's spam. They don’t validate whether the recipient’s address even exists or if the domain is set up to accept mail. Running an email through a spam filter tells you nothing about its deliverability or whether it will bounce.

For example, an email sent to [email protected] might pass a spam filter’s content check with flying colors—but the message will fail at the SMTP level. That’s because spam filters don’t check MX records, DNS TTLs, or mailbox validity. They only care about what the message says.

Email verification checks the foundation of delivery

Real-time email verification works at the infrastructure level. It checks if the domain has valid MX records, whether the address is syntactically correct, and if the mail server responds during a handshake. Tools like MailTester use this process to return a verdict—valid, invalid, catch-all, or risky—before you even send a message.

This is how bulk list verification works: you upload a list, and the system checks each address against real mail server behavior, not content patterns. It finds invalid addresses, catch-all domains, and disposable email providers before you send, reducing bounce rates and protecting sender reputation.

If you’re using SpamAssassin or Rspamd just to validate email addresses, you’re missing the point. These tools are meant for filtering, not validation. For real-time verification with a latency under 100ms, you need a system built for that, not one tuned to read spammy subject lines. The RFC 5321 specification, which defines SMTP behavior, lays the groundwork for what verification tools actually test at the network layer. Learn the standard behind email delivery.

With services like MailTester, you get a clear, measurable verdict on each address—no guesswork. You can verify lists at scale with a 98.9% accuracy rate, all under 100ms. Bulk verify your list in minutes and start sending only to addresses that are technically valid and likely to land in the inbox.

Why most DIY verification attempts fail under 100ms

You can’t reliably verify email addresses in under 100ms with DIY tools because they rely on sequential DNS lookups, lack caching, and ignore key deliverability signals like catch-all responses or disposable domains. By the time you’ve checked 50 addresses, DNS bottlenecks and idle waits kill your latency. Real-time performance demands infrastructure built for scale—something most self-hosted setups simply don’t have.

Common pitfalls in DIY email verification

Self-hosted verification scripts often hang on DNS resolution, especially when checking more than 50 addresses in parallel. DNS queries aren’t inherently slow, but without proper connection pooling or async resolution, your latency skyrockets.
Lack of domain caching means the same domain gets queried repeatedly. For example, verifying a list with 1000 entries from the same domain forces 1000 independent DNS lookups, instead of reusing cached results from the first.
Most homemade checks don’t detect disposable email addresses or role-based accounts (like admin@, support@, info@). These often pass basic syntax checks but are high-risk—leading to silent bounces down the line.
No built-in bulk processing or queue management means your system blocks on one slow lookup. High-volume flows grind to a halt unless you build complex retry logic, throttling, and concurrency controls yourself.
Most tools skip checking for catch-all responses. An address may pass syntax and DNS checks but still bounce later because the mailbox doesn’t exist. The result? Poor deliverability and a damaged sender reputation.

What actual 100ms performance requires

Speed under 100ms isn’t just about fast code—it’s about infrastructure. The SMTP RFC defines a minimum set of checks, but real-world performance includes connection reuse, DNS caching, and efficient error handling. Tools that simulate real SMTP interaction with proper timing can flag invalid addresses faster than DNS-only checks.

If you're checking addresses at scale, don’t rely on scripts that repeat work or ignore delivery risks. The difference between a 400ms check and one under 100ms isn’t just code—it’s the ability to test across real mail server behaviors, not just DNS records.

For teams that need accurate, fast verification at scale—without building the backend yourself—consider using a service like MailTester’s real-time API, which combines SMTP checks, domain intelligence, and catch-all detection under 100ms for most valid cases. It handles bulk processing, caching, and disposable account detection so you don’t have to.

MailTester integrates with SendGrid, Mailchimp, HubSpot, and Klaviyo

You can validate emails in real time with MailTester directly from SendGrid, Mailchimp, HubSpot, or Klaviyo—no code changes, no local storage. Each integration runs a single-call verification before send, reducing bounces and protecting sender reputation. You send less, you deliver more.

Real-time validation, zero data retention

With the MailTester verification API, every email is checked on-demand without storing addresses on your servers. This keeps compliance simple and your data private. The API responds in well under 100ms—fast enough to block invalid addresses before they hit the wire.

You're not guessing. You're acting. A single API call returns clear results: valid, invalid, catch-all, or risky. And since the check happens during the send flow, you never waste a single campaign send on a dead address.

Bulk verification meets enterprise-grade accuracy

For list hygiene, MailTester processes up to 1 million+ addresses in nightly bulk jobs. It’s not just speed—it's consistency. The system maintains 98.9% accuracy across diverse domains, including temporary, role-based, and disposable emails. This means you’re not just cleaning your list—you’re filtering out the noise, not just the bad addresses.

A high volume of clean data reduces the risk of landing in spam folders. According to the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), poor list hygiene directly correlates to sender reputation degradation—especially in industries like e-commerce and SaaS. MailTester’s real-time and batch checks help avoid those pitfalls.

If a verification returns "risky," the in-app AI assistant suggests next steps: verify ownership, check syntax, or flag for manual review. No guesswork. No wasted effort.

Try it risk-free with 100 free verifications—no expiration, no commitment. See what’s inside your list before you send. Explore the full workflow at bulk verification, or start with a real-time check at single-email validation.

Conclusion: No legacy filter beats modern email verification

SpamAssassin and Rspamd were designed for mail server filtering, not for real-time email verification at scale. Their architecture prioritizes spam detection over speed and accuracy in identity validation.

Even with tuning, neither system can consistently achieve sub-100ms response times across large lists. Latency spikes, resource contention, and false positives hinder their reliability in production verification workflows.

MailTester delivers verified results under 100ms with 98.9% accuracy, using infrastructure built specifically for this task. It doesn’t rely on outdated filters—it’s a service engineered for precision, speed, and consistency.

Sources

Microsoft (Outlook/Hotmail) is the toughest major provider for senders, with just 75.6% inbox placement and a 14.6% spam placement rate — the highest spam rate among major mailbox providers. — Validity 2025 Email Deliverability Benchmark Report (2025)
Gmail requires bulk senders to keep user-reported spam rates below 0.3%, warning that rates above 0.1% already hurt inbox delivery — just 3 complaints per 1,000 emails crosses the line. — Google Email Sender Guidelines FAQ (2024)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can SpamAssassin verify email addresses in real time under 100ms?

No. SpamAssassin is designed for spam detection, not verification. It cannot reliably verify addresses under 100ms at scale due to its architecture and reliance on synchronous DNS lookups.

Does Rspamd support real-time email verification?

Rspamd can support fast filtering, but it lacks native email verification features like catch-all detection, disposable domain checks, or role account identification.

What is the true latency of email verification in production?

With optimized cloud systems like MailTester, 99% of checks complete in under 85ms, making sub-100ms latency achievable for real-time workflows.

Why is real-time verification faster than batch processing?

Batch systems delay validation until after list collection, increasing risk of sending to invalid or blacklisted addresses. Real-time systems filter out bad data before sending.

How does MailTester achieve 98.9% accuracy?

It combines DNS validation, catch-all detection, disposable domain blocking, and role account filtering with a cloud-scale backend and persistent caching.

What does 'catch-all' mean in email verification?

A catch-all address accepts all incoming mail regardless of recipient. This often indicates low deliverability and higher spam risk.

Can disposable domains be reliably detected?

Yes—by maintaining a real-time database of known disposable domains and checking for free-email patterns during verification.

Do real-time verifiers check for role accounts?

Yes—tools like MailTester detect common role accounts (e.g. info@, sales@) and flag them based on domain and pattern matching.

How many free verifications does MailTester offer?

MailTester provides 100 free verifications to start, with no expiration on purchased credits.

What integrations does MailTester support?

MailTester integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid, enabling real-time verification during list uploads or campaign send.

Is email verification the same as spam checking?

No. Verification ensures an address is technically valid and likely to receive mail. Spam checking evaluates message content for malicious or unsolicited content.

Why can't I use my own DNS check for verification?

Most tools check only a few DNS records. True verification requires multiple checks—not just MX or A records—plus behavior analysis like catch-all detection.