Spam Score and Header Analysis

Full message headers show the route a message took and may include spam-filter and authentication results. Use them to investigate delivery issues or suspected spoofing.

Find the message headers

Most email apps provide an option such as Show Original, View Source, View Message Details, or Internet Headers. The exact label depends on the app. Copy headers for analysis without changing them; they can contain private addresses and routing information, so share them only with trusted support staff.

Common fields include:

Header What it can indicate
X-Spam-Status Whether the filter marked the message as spam and sometimes the score and threshold
X-Spam-Score A numeric score assigned by a filter, when included
X-Spam-Report Rules or signals that contributed to the filter’s decision, when included

These headers are optional and may be altered by mail systems along the delivery path. Interpret them together with the message and other authentication results.

Authentication results

Look for an Authentication-Results header added by the receiving mail system. It may report:

  • SPF: whether the sending server was authorized by the sender domain’s SPF policy.
  • DKIM: whether a domain signature was present and verified.
  • DMARC: whether SPF or DKIM passed with alignment to the visible From domain and how the domain’s policy was applied.

A pass result is useful evidence but does not guarantee that a message is safe. A fail can also occur for legitimate mail that was forwarded or sent through a service that has not been configured correctly.

Interpret a score

Spam scores are filter-specific. A higher score generally means more spam-like rules matched, but the configured threshold and action vary. Review the rule report, sender authentication, links, attachments, and context before deciding whether to trust a message.

For a legitimate message that was filtered, see Spam Filtering and Whitelisting. For an explanation of scoring rules, see Understanding SpamAssassin.