Gmail filters billions of spam messages per day. The filters must run before message delivery, add minimal latency, and maintain low false-positive rates: legitimate email landing in spam is a worse outcome than spam landing in inbox. Spam filtering is a layered classification pipeline with each layer trading latency for accuracy.

Layer 1: Connection and Sender Reputation#

Before reading a single byte of message content, the receiving mail server checks the sender:

DNS-based blocklists (DNSBLs): is the sending IP address on a known spam IP list? A DNS lookup takes under 5ms.

SPF and DKIM validation: is this email actually sent from a server authorized to send for this domain? Forged sender addresses are a primary spam vector. These cryptographic checks add under 10ms.

Sender reputation score: what fraction of email from this sender has been marked as spam historically? High-volume senders with good reputation (Google, Stripe) pass quickly. Unknown senders get higher scrutiny.

Layer 2: Content Analysis#

Content scoring runs on message body and subject:

Bayesian classifier: trained on known spam/ham corpus, computes probability that this message is spam given its word distribution. Fast (under 5ms for typical messages).

URL extraction: links in the message body are checked against phishing and malware URL databases. A message with a known phishing URL is rejected regardless of other signals.

Header anomalies: legitimate email has consistent Received headers showing a plausible routing path. Spam often has forged or missing headers.

graph TD A[Incoming SMTP connection] --> B[Layer 1: IP blocklist + SPF/DKIM, 10ms] B --> C{Pass?} C --> |No| D[Reject connection] C --> |Yes| E[Layer 2: Content scoring + URL check, 20ms] E --> F{Score above threshold?} F --> |Yes| G[Route to spam folder] F --> |No| H[Layer 3: ML model, 50ms] H --> I{ML score above threshold?} I --> |Yes| J[Route to spam folder] I --> |No| K[Deliver to inbox] style A fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style B fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style C fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style D fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style E fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style F fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style G fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style H fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style I fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style J fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff style K fill:#000000,stroke:#00ff00,stroke-width:2px,color:#fff

Layer 3: ML Model#

Messages that pass content scoring go through a trained model that combines all signals: sender reputation, content features, header anomalies, URL risk scores, and user-specific signals (has this user interacted with this sender before?). The model output is a spam probability. Above the threshold: spam folder. Below: inbox.

The threshold is tunable per user: users who report many false positives get a higher threshold (less aggressive filtering). Users who receive high spam volumes get a lower threshold.

Feedback Loops#

When a user marks a message as spam or “not spam,” that signal feeds back into both the sender reputation system and the model training pipeline. This is how the filters stay current as spammers adapt. A new spam campaign that initially passes filters gets caught as users report it, and the model updates within hours.

At Salesforce#

Salesforce Marketing Cloud has an email deliverability product: helping customers avoid their legitimate marketing emails being flagged as spam. The inverse of the filtering problem. We monitored sender reputation scores from major ISPs, tracked complaint rates per campaign, and flagged campaigns where the spam complaint rate exceeded 0.1%. Above that threshold, ISPs start filtering all email from that sender. Early warning at 0.08% gave customers time to clean their lists.

What I’m Learning#

Spam filtering is a layered system where cheap fast signals run first and expensive accurate signals run last. The feedback loop from user actions is what keeps it current — static rules decay quickly as spammers adapt. Designing the feedback pipeline is as important as the initial classifier.

Have you worked on classification systems with adversarial inputs, and how did you handle the adaptation problem?