---
title: "Spam"
description: "Spam is unsolicited bulk email. It is defined by consent and volume rather than by content, which is why even well-meant marketing can be spam."
url: "https://mailmum.io/glossary/spam/"
---

# Spam

Spam is unsolicited bulk email. Both halves of that phrase are load-bearing:
*unsolicited* means the recipient did not ask for it, and *bulk* means it was
sent to many recipients essentially unchanged.

The definition deliberately says nothing about content. A single unwanted
message is not spam, and a million messages to people who genuinely subscribed
are not spam either. This is why senders and recipients so often disagree
— and why the recipient's view is the one that determines whether your
mail gets delivered.

## What forms does spam take?

* **Advertising spam**, the original form: bulk promotion of a product, sent to
  harvested or purchased address lists.
* **Snowshoe spam**, spread thinly across many IP addresses and many domains so
  that no single source crosses a volume threshold. It is defeated by
  correlating at the range and [ASN](https://mailmum.io/glossary/autonomous-system-number-asn/)
  level rather than per address.
* **Hailstorm spam**, the opposite tactic: an enormous volume from fresh
  infrastructure delivered within minutes, finished before reputation systems
  can react.
* **Reputation laundering**, in which the message is sent through a trusted
  provider — a mailing-list service, a newsletter platform, a free group
  hosting service — so that it inherits that provider's good standing. See
  [how to block Google Groups spam in
  Rspamd](https://mailmum.io/posts/howto-block-google-groups-spam-in-rspamd/) for a worked example
  of exactly this.
* **[Backscatter](https://mailmum.io/glossary/backscatter/)**, bounce traffic caused by forged
  senders, which is spam from the recipient's point of view even though nobody
  intended to send it.

[Phishing](https://mailmum.io/glossary/phishing/) and malware distribution are usually delivered
in bulk too, but they are categorised separately because the intent is fraud
rather than advertising. All of them fall under
[abuse](https://mailmum.io/glossary/abuse/).

## How is spam filtered?

Modern filtering happens in layers, and the cheapest checks come first:

1. **Connection reputation.** Is the connecting IP address listed on a
   [DNSBL](https://mailmum.io/glossary/dns-blocklist-dnsbl/)? This decides before a single byte of
   the message is transferred, which is why it does most of the volume
   reduction.
2. **Envelope and identity checks.** Does the [hostname](https://mailmum.io/glossary/hostname/)
   resolve, does [SPF](https://mailmum.io/glossary/sender-policy-framework-spf/) pass, is there a
   valid [DKIM](https://mailmum.io/glossary/domainkeys-identified-mail-dkim/) signature, does
   [DMARC](https://mailmum.io/glossary/domain-based-message-authentication-reporting-and-conformance-dmarc/)
   align?
3. **Content scoring.** SpamAssassin and rspamd combine hundreds of rules
   — body patterns, URL reputation, header anomalies, Bayesian
   classification — into a single score, and act on thresholds.
4. **User feedback.** A "report spam" click feeds back to the sender through an
   [ARF report](https://mailmum.io/glossary/abuse-reporting-format-arf/) and to the provider's own
   classifier.

Because content scoring is the last and most expensive layer, tuning it is
rarely where the biggest wins are. Blocking at the connection is.

## How do you avoid being treated as a spammer?

If you send legitimate bulk mail, the receiving side cannot read your
intentions. It measures behaviour:

* **Verifiable consent.** Confirmed opt-in, with a record of when and how, so a
  complaint can be answered with evidence.
* **A working unsubscribe** that takes effect immediately, including
  `List-Unsubscribe` headers.
* **Clean lists.** Remove hard [bounces](https://mailmum.io/glossary/bounce-message/) after the
  first failure and complainers immediately. Repeatedly mailing dead addresses
  is one of the strongest spam signals there is.
* **Complete authentication.** SPF, DKIM and an aligned DMARC policy.
* **Consistent volume.** A dormant IP address that suddenly sends a hundred
  thousand messages looks exactly like a compromised one.
* **Separated streams.** Send transactional mail from different IP addresses and
  subdomains than marketing, so a bad campaign cannot take your password resets
  down with it.

## What happens when spam comes from your server?

Usually it means an account has been compromised rather than that a customer
turned malicious. The escalation is predictable: complaints to your
[abuse desk](https://mailmum.io/glossary/abuse-desk/), spam trap hits, an IP listing, a range
listing, and finally rejection of all your mail.

Detection is easier than it sounds — a mailbox sending far outside its
normal pattern, or a
[mail queue](https://mailmum.io/glossary/email-queue/) that grows suddenly with messages to
recipients nobody in your organisation knows, are both visible long before a
blocklist notices. See
[manage Postfix mail server queues like a
pro](https://mailmum.io/posts/manage-postfix-mail-server-queues/) for how to inspect and clear
such a queue.