Filters were the first defense against spam although crude and ineffective. Some of those one-strike-you're-out programs are still around, especially on business mail servers. Filtering has since evolved into more sophisticated programs. They use a complex collection of tests to measure the probability a message is spam, rather than trash it at the first offense.

One well-known application is SpamAssassin, an open-source project of the Apache Software Foundation. In a corporate setting, usually small to midsized businesses and ISP mail servers, it runs each e-mail message through hundreds of tests that analyze headers, text, and HTML coding and checks domains and IP addresses against DNS (define) blocklists and filtering databases.

When a message flunks a test, it scores anywhere from a fraction of a point to multiple points. If a message scores too many points, SpamAssassin rejects it. But the message can also receive negative points (a good thing) that help offset the unwanted positive points. Check out the list of tests to get a basic understanding of what SpamAssassin checks for.

Though it can reject permission-based messages, SpamAssassin has many positives:

• There's more latitude with content. Using a word such as "free" too often in copy might cost half a point, but the filter won't reject your message outright as some others do.
  
  
• If your e-mail is rejected, the ISP or receiving business may provide this detail in a bounce message; not inform you (the sender) at all; or simply insert the word "SPAM" at the beginning of the subject line when the message is delivered to the recipient. In some cases, the receiving entity will return the message with a detailed report showing exactly which tests it violated and how many points it accumulated. (This e-mail can go back to either your reply-to e-mail address listed in the header or your sender address. Make sure somebody monitors those mailboxes.)
  
  
• SpamAssassin rewards you if you're listed on an individual or corporate whitelist, or with a reputation or certification agency, such as Habeas, Bonded Sender, or ISIPP's Email Senders Accreditation Program. Habeas accreditation can take 4.3 (for single opt-in) to 8 (for confirmed/double opt-in) points off your score, for example.

A couple negatives, besides the rejection potential: End users, whether individuals or corporations, can set the maximum score as high or low as they want, although a score of 5 or so is most common. They can also decide which tests to apply. The scores vary according to how SpamAssassin is configured, and users can boost or reduce them if they want.

Also, SpamAssassin penalizes messages more heavily for factors you might not control, such as using open relays or blacklisted IP addresses, or using malformed HTML or MIME (define) coding. If you flunk one of those tests, notify your HTML designer or e-mail service provider (ESP), pronto.

This Is a Test...

Most SpamAssassin tests target obvious spammer tricks, such as misspelling potentially offensive words and forging domains or dates.

Other tests seem innocuous but could cost you, such as "g a p p y t e x t" (0.5 points), and the subject or body IN ALL CAPS (0.3 points).

Below is a sample list of 10 tests (the point values vary depending on how the end user configures SpamAssassin):

• The subject line is all capital letters. Score: 0.459 to 1.049.
  
  
• The message date is 12 to 24 hours before the receive date: 0.881 to 1.247.
  
  
• The domain in the sender line doesn't match the domain in the "received" line in the headers: 0.217 to 2.127.
  
  
• The subject contains "As Seen:" 1.511 to 1.757.
  
  
• The subject starts with "Free": 0.286 to 0.034.
  
  
• The message has bad MIME encoding in the header: 2.255 to 3.100.
  
  
• The message is 90 percent to 100 percent HTML: 0.113 to 0.587.
  
  
• The HTML font size is large: 1.182 to 1.575.
  
  
• The message mentions Oprah Winfrey with an exclamation mark: 0.366 to 1.386.
  
  
• "Remove" appears in a URL (e.g., www.xyz.com/remove) or e-mail address (e.g., mailto:remove@xyz.com): 0.383 to 1.109

Check Your Content Before Sending

A message content checker can help target potential problems prior to distribution. It runs your receiver and sender addresses, subject line, and message content past a collection of SpamAssassin rules. It then reports how your message fared and whether it's likely to be filtered. Most checkers suggest a score of 5.0 will get your e-mail sent to the spam scrap heap.

All the major delivery monitoring companies include a content checker in their offerings, as do many ESPs. One of our favorite free checkers is the Lyris' Content Checker (full disclosure: Lyris and EmailLabs are now sister companies, both having been acquired by J.L. Halsey). It delivers a more complete analysis and doesn't give you a sales pitch. Just fill in the blanks, including your e-mail text or the full HTML coding, and submit it. You'll get an instant score on the next screen and a more detailed report by return e-mail.

Filters will probably always be with us, whether they remain primarily anti-spam tools or evolve into mechanisms that evaluate trustworthiness. At least the playing field is more level now than it was when filters trashed your messages for a single offense.

Next, we'll look at some sample e-mail messages that failed the SpamAssassin test, what drove the score up, and how the messages scored after making some simple changes.

Check your content, and keep on deliverin'!

Want more e-mail marketing information? ClickZ E-Mail Reference is an archive of all our e-mail columns, organized by topic.