How the Spam Filter Works

Please note that your email is processed automatically and no one actually reads your mail. When an email message is received by your mail server, it is sent to the spam filter system before it is delivered to you. Here's what happens when it gets to the spam filter system:

The first thing it does is to build a checksum of the email which is then queried against two spam databases, Vipul's Razor and the Distributed Checksum Clearinghouse DCC. No confidential information leaves your server. If the checksum already is in Vipul's manually maintained SPAM-database or DCC, then Razor or DCC will answer back that this email is SPAM.

Many different servers in the Internet use Vipul's Razor or DCC, so if someone already got this SPAM while it was circulating, then you're protected against it. So both Razor and DCC serves as an early warning radar against SPAM and they do this job extremely well.

Once the check against Razor and DCC are completed, Spamassassin will look at the email headers to determine if they are manipulated. Have date and time stamps been forged? Are fake relay stations inserted to mask the sender? Is the sending host a known open relay? And so forth.

Next the message body is examined and a so called SPAM-Treshold is built. Phrases usually found in SPAM increase the SPAM-Threshold, while phrases usually found in legitimate emails decrease the SPAM-Threshold.

Additionally your servers own Automatic Whitelist is queried to find out if the sender of this email already has sent at least three legitimate emails to you, which have not been reported as SPAM. If the sender is in the Whitelist, then the SPAM-Threshold will be radically lowered.

In the end the SPAM-Threshold is compared against the value Required Hits which the user configured for his mailbox (the default value is 6).

If the SPAM-Threshold is higher than Required Hits, then the Email will be tagged as SPAM in the Subject line. If the SPAM-Threshold is lower, then the email will be passed on unmodified.

At that point the mail is delivered to the recipient, but one additional step is performed if the owner of the mailbox desires: