Spam

Spam is unsolicited bulk email. Both halves of that phrase are load-bearing: unsolicited means the recipient did not ask for it, and bulk means it was sent to many recipients essentially unchanged.

The definition deliberately says nothing about content. A single unwanted message is not spam, and a million messages to people who genuinely subscribed are not spam either. This is why senders and recipients so often disagree — and why the recipient’s view is the one that determines whether your mail gets delivered.

What forms does spam take?

• Advertising spam, the original form: bulk promotion of a product, sent to harvested or purchased address lists.
• Snowshoe spam, spread thinly across many IP addresses and many domains so that no single source crosses a volume threshold. It is defeated by correlating at the range and ASN level rather than per address.
• Hailstorm spam, the opposite tactic: an enormous volume from fresh infrastructure delivered within minutes, finished before reputation systems can react.
• Reputation laundering, in which the message is sent through a trusted provider — a mailing-list service, a newsletter platform, a free group hosting service — so that it inherits that provider’s good standing. See how to block Google Groups spam in Rspamd for a worked example of exactly this.
• Backscatter, bounce traffic caused by forged senders, which is spam from the recipient’s point of view even though nobody intended to send it.

Phishing and malware distribution are usually delivered in bulk too, but they are categorised separately because the intent is fraud rather than advertising. All of them fall under abuse.

How is spam filtered?

Modern filtering happens in layers, and the cheapest checks come first:

1. Connection reputation. Is the connecting IP address listed on a DNSBL? This decides before a single byte of the message is transferred, which is why it does most of the volume reduction.
2. Envelope and identity checks. Does the hostname resolve, does SPF pass, is there a valid DKIM signature, does DMARC align?
3. Content scoring. SpamAssassin and rspamd combine hundreds of rules — body patterns, URL reputation, header anomalies, Bayesian classification — into a single score, and act on thresholds.
4. User feedback. A “report spam” click feeds back to the sender through an ARF report and to the provider’s own classifier.

Because content scoring is the last and most expensive layer, tuning it is rarely where the biggest wins are. Blocking at the connection is.

How do you avoid being treated as a spammer?

If you send legitimate bulk mail, the receiving side cannot read your intentions. It measures behaviour:

• Verifiable consent. Confirmed opt-in, with a record of when and how, so a complaint can be answered with evidence.
• A working unsubscribe that takes effect immediately, including List-Unsubscribe headers.
• Clean lists. Remove hard bounces after the first failure and complainers immediately. Repeatedly mailing dead addresses is one of the strongest spam signals there is.
• Complete authentication. SPF, DKIM and an aligned DMARC policy.
• Consistent volume. A dormant IP address that suddenly sends a hundred thousand messages looks exactly like a compromised one.
• Separated streams. Send transactional mail from different IP addresses and subdomains than marketing, so a bad campaign cannot take your password resets down with it.

What happens when spam comes from your server?

Usually it means an account has been compromised rather than that a customer turned malicious. The escalation is predictable: complaints to your abuse desk, spam trap hits, an IP listing, a range listing, and finally rejection of all your mail.

Detection is easier than it sounds — a mailbox sending far outside its normal pattern, or a mail queue that grows suddenly with messages to recipients nobody in your organisation knows, are both visible long before a blocklist notices. See manage Postfix mail server queues like a pro for how to inspect and clear such a queue.