SpamAssassin Score Explained: How to Lower It in 2026

TL;DR

• A SpamAssassin score is the total of points added (or subtracted) by every rule an email triggers. The default spam threshold is 5.0.
• Aim for 2.0 or lower on cold email. Zero or negative is excellent.
• The biggest point sources for outbound: failed SPF/DMARC, missing headers, HTML-only or image-heavy bodies, and links on blocklisted domains (URIBL_DBL_SPAM alone adds 2.5).
• Test the exact email from the exact mailbox you will send from, using mail-tester, Postmark Spamcheck, or spamassassin -t.
• Fix the rules with the highest points first, then retest. A low score helps, but it does not guarantee Gmail or Outlook inbox placement.

What Is a SpamAssassin Score?

A SpamAssassin score is a number that tells you how spammy an email looks to Apache SpamAssassin, the open-source spam filter used by many corporate gateways and hosting providers. Higher means more likely spam.

The score is not a single judgment. It is the sum of many small tests, each worth a fixed number of points.

This guide is for SDRs, founders, and RevOps teams running cold email. It covers how the math works, the real rule names that hit outbound emails, how to test a draft, and the fixes that bring the number down before launch.

Every rule name and point value below comes from the official SpamAssassin rule files and documentation, not guesswork.

How SpamAssassin Scoring Works

SpamAssassin runs every incoming email through hundreds of rules that inspect headers, body text, HTML, links, and the sending IP. Each rule that matches adds its score to the total.

If the total reaches the required_score, the email is tagged as spam. The official configuration docs set the default at 5.0 and describe it as "quite aggressive", suggesting ISPs use 8.0 or 10.0.

Positive and negative points

Most rules add points. Some subtract them, because they signal a legitimate sender.

A valid DKIM signature from your own domain (DKIM_VALID_AU) subtracts 0.1. A sending IP on a trusted allowlist (RCVD_IN_DNSWL_HI) subtracts 5.

Four score sets per rule

Many rules list four scores, not one. The value that applies depends on whether the server runs Bayes (learned filtering) and network tests (DNS blocklists, URI lookups).

• Set 0: no Bayes, no network tests
• Set 1: network tests only
• Set 2: Bayes only
• Set 3: Bayes and network tests

That is why the same email can score 1.8 in one tester and 3.1 in another. Always read the rule list, not just the total.

What Is a Good SpamAssassin Score?

A good SpamAssassin score for cold email is 2.0 or lower. That leaves a 3-point buffer under the default threshold for gateways that are stricter than default.

The Rules That Add Points

The rules below are the ones cold emails trip most often. Scores come from SpamAssassin's 50_scores.cf rule file and, where marked, the published 3.3.x test table.

Where a rule has four values, we show the range. Rule updates via sa-update can shift these, so treat them as weights, not constants.

Authentication Rules

Authentication failures are the most common reason a new outbound domain scores badly. They are also the easiest to fix.

Notice the asymmetry. Passing authentication earns tiny credits, while failing it costs close to 2 points.

A misaligned DKIM key plus a softfailing SPF record can put you at 2.7 points before SpamAssassin reads a word of your copy. Our Gmail DKIM setup guide walks through the fix for Google Workspace.

Header and Copy Rules

These rules catch emails sent by scripts that skip standard headers, and copy patterns lifted from old spam.

"Dear Sir" openers cost almost 2 points on their own. A missing Date header, common with homemade SMTP scripts, costs up to 2.7.

HTML and Formatting Rules

Formatting rules punish emails that look like newsletters or image ads. Cold email built in a heavy HTML template trips several at once.

HTML itself is nearly free (0.001). The penalty comes from what you do with it: image-heavy layouts, hidden text, and plain-text parts that do not match the HTML.

Link and Reputation Rules

Network rules check your links and sending IP against public blocklists. These carry the heaviest single penalties a cold email can hit.

One bad link can undo everything else. If your tracking domain or a linked page sits on Spamhaus DBL, that is 2.5 points for a single URL.

You can look up any domain or IP for free on Spamhaus's lookup tool.

Bayes Rules

Bayes rules come from a filter that learns from mail the server has already classified. You cannot see its training data, but you can see the verdict.

• BAYES_99: 99 to 100% spam probability, worth 3.5 to 3.8 points
• BAYES_999: stacks on BAYES_99 for an extra 0.2
• BAYES_50: 40 to 60% probability, worth 0.8 to 2.0
• BAYES_00: 0 to 1% probability, subtracts 1.5 to 1.9

A BAYES_99 hit usually means your copy reads like templated mass outreach the server has seen before. Rewriting the first lines and cutting stock phrases is the fix.

How to Test a Cold Email

To test a cold email's SpamAssassin score, send the final copy from the exact mailbox and sending tool you will use, to a tester address. Pasting copy into a web form misses every header and authentication rule.

Option 1: mail-tester

mail-tester gives you a one-time address. Send to it, click check, and open the SpamAssassin section to see each rule that fired.

It also checks SPF, DKIM, DMARC, and blocklists in the same report. The free tier is limited to a few tests per day.

Option 2: Postmark Spamcheck

Postmark Spamcheck is a free JSON API that returns a spam score for a raw email. Paste the full message source, headers included.

It suits teams that want to script a check into their send workflow.

Option 3: Run SpamAssassin yourself

On Linux or macOS, install SpamAssassin, save the received email as a .eml file, and run it in test mode. This gives you the most control and the full rule report.

sa-update                       # pull the latest rules
spamassassin -t < message.eml   # score and print the report
spamassassin -D -t < message.eml 2>&1 | less   # debug output

For a broader view that includes Gmail and Outlook inbox placement, see our roundup of email deliverability test tools.

Testing rules that matter

• Fill in every merge field. Unfilled {{firstName}} tags change the body and the score.
• Include your signature, tracking domain, and unsubscribe line exactly as they will ship.
• Test each step of the sequence, not just email one. Follow-ups often carry different links.
• Retest after every DNS change, and wait for propagation first.

How to Read the Report

SpamAssassin writes its verdict into the email headers. The X-Spam-Status header shows the total, the threshold, and every rule that fired.

X-Spam-Status: No, score=3.4 required=5.0
  tests=DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,
  HTML_IMAGE_ONLY_08,MIME_HTML_ONLY,MISSING_MID,
  SPF_SOFTFAIL,URIBL_BLOCKED autolearn=no

Read it in three passes. First, the total versus the threshold. Second, any authentication rule (SPF, DKIM, DMARC). Third, the highest-point content rules.

In the example above, the fix order is SPF_SOFTFAIL (DNS), then MISSING_MID (sending method), then the image-only HTML (template). URIBL_BLOCKEDscores 0.001 and only means the tester's DNS resolver was rate-limited by URIBL, so ignore it.

How to Lower Your SpamAssassin Score

To lower your SpamAssassin score, fix the rules with the most points first. These eight fixes cover nearly every rule a cold email trips.

1. Fix SPF, DKIM, and DMARC

Add every sending service to one SPF record and keep it under 10 DNS lookups. Sign with DKIM on your own domain so DKIM_VALID_AU fires, and publish a DMARC record that passes.

Google requires all three for bulk senders under its email sender guidelines, so this fix pays off beyond SpamAssassin.

2. Send through a real mailbox, not a raw script

Google Workspace, Microsoft 365, and proper sending tools add Date and Message-ID headers automatically. Homemade SMTP scripts often skip them and pay up to 2.7 points for MISSING_DATE.

If you connect a tool over SMTP, use the right settings. Our Office 365 SMTP settings guide covers Microsoft 365.

3. Use plain text or matching multipart

Cold email works best as near-plain text. If you send HTML, include a plain-text part with the same words, so MIME_HTML_ONLY and MPART_ALT_DIFF do not fire.

4. Drop images and hidden text

A cold email does not need a banner, logo, or image signature. Image-heavy bodies trigger HTML_IMAGE_ONLY_* and HTML_IMAGE_RATIO_* rules.

Never use white or near-white text for preheaders or keyword stuffing. HTML_FONT_LOW_CONTRAST exists to catch it.

5. Clean up every link

• Keep to one or two links per email, on your own domain.
• Set up a custom tracking domain instead of a shared one, or turn link tracking off.
• Skip public URL shorteners and raw IP links.
• Check each linked domain on Spamhaus before launch.

6. Rewrite spam-pattern copy

Remove "Dear Sir/Madam" openers, all-caps subject lines, and money or urgency phrases. Write like one person emailing another.

Run your draft through a spam word checker to catch trigger phrases before you test.

7. Send from clean IP space

RCVD_IN_PBL (up to 3.558 points) means mail left from a residential or dynamic IP. Hosted mailboxes from a real provider fix this.

See our pick of the best email hosting for cold email if you are choosing a provider.

8. Warm up and retest

New domains have no reputation, which hurts reputation-based filters even when SpamAssassin scores well. Follow an email domain warmup plan, then retest the full sequence before launch.

A Low Score Is Not Inbox Placement

A low SpamAssassin score means your email passes one filter's rule-based checks. It does not mean Gmail or Outlook will inbox it.

Gmail and Microsoft weigh domain reputation, complaint rates, and bounce rates heavily. A campaign with a 0.5 score and a 9% bounce rate will still burn a domain.

That is why list quality belongs in the same pre-send check. SyncGTM verifies each address through a multi-provider waterfall at 0.1 credits per email, so you only send to inboxes that exist. See SyncGTM pricing or compare options in our free email verifier roundup.

Pre-Send Checklist

Run this before every new campaign or new sending domain.

1. SPF, DKIM (own domain), and DMARC all pass in the test report.
2. SpamAssassin score is 2.0 or lower on every sequence step.
3. No MISSING_* header rules fired.
4. Plain text, or HTML with a matching plain-text part. No images.
5. One or two links, none on Spamhaus DBL, SURBL, or URIBL.
6. No BAYES_99 hit. If it fires, rewrite the opening lines.
7. List verified, with bounce risk removed.
8. Domain warmed up for at least two to three weeks.

Conclusion

Your SpamAssassin score is a sum you can audit line by line. Default spam is 5.0, and cold email should sit at 2.0 or lower.

The big point sources are predictable: failed authentication, missing headers, image-heavy HTML, and blocklisted links. Fix them in that order, retest from your real mailbox, and pair the clean score with a verified list.

Ready to clean the list side? Try SyncGTM free and verify every contact before your next campaign goes out.