Email spam score checker
Paste an email and see the content and header signals spam filters react to, with the points for every rule and how to fix it. The message is scored in your browser and never leaves it.
By using these tools you accept the Terms and the Privacy page.
How the spam score checker works
The spam score checker scores a pasted email much as a content filter would, adding up points for every signal it finds. It is for anyone who sends newsletters, receipts or outreach and wants to see what might push a message into junk before it goes out.
What the rules look at
- Subject: all capitals, three or more exclamation marks, no subject at all, or one longer than 120 characters.
- Headers: a missing or malformed Message-ID, a missing Date or one more than a day in the future, no Received lines, and a Reply-To or Return-Path on another domain.
- Sender name: a display name that claims a well-known brand when the address isn’t the brand’s, or a name that shows a different email address.
- Text: lottery and prize wording, urgency, credential-phishing phrases such as “verify your account”, and too many capitals or exclamation marks.
- Links: shorteners, bare IP addresses, punycode domains, frequently abused endings such as
.xyz, an @ that hides the real host, and link text that shows a different domain than the link. - Structure: HTML with no plain-text part, images with almost no text, large hidden text blocks, and executable, archive, HTML or macro-enabled attachments.
How a message is read
The checker splits the paste into headers and body, walks the MIME parts and decodes base64 and quoted-printable text, up to 200 parts. HTML is turned into text without being rendered, so blocks hidden with display:none or a zero font size are measured rather than shown. Each step reads the message in a single pass, so even a paste near the 5,000,000-character limit takes about a second, with a progress line while it runs. Longer pastes are refused; remove large attachments from the source first.
With the full source, authentication results come from the topmost Authentication-Results header, the one your receiving server added; lower ones can be forged by the sender. A DMARC failure is the costliest authentication rule, at 3 points.
Reading the result
Rules are sorted by points, so the costliest problems come first. Rows marked as passes or notes add nothing: they confirm what already works, such as SPF passing or a normal relay chain, or explain what was skipped.
The summary counts the rules hit, links and images, plus attachments when there are any and, for a full message, the Received hops. The Links table puts each link’s visible text next to where it really goes, as plain text so nothing in a suspicious message can be opened by accident. Copy report gives you a text version to share, and JSON gives the full rule list. The two sample buttons load a spam-like and a clean message, so you can see how the rules read before you paste your own.
What to check next
Content is one part of the picture. Grade the sending domain’s SPF, DKIM, DMARC and related DNS records with the deliverability score. To see what a receiving server concludes from a real delivery, including the sending IP’s blocklist status, send the message to the email test.
Updated · Maintained by Liviu Tanase
Questions
Is this SpamAssassin?
No. It is a heuristic engine in the same spirit: about 50 weighted rules over the headers, subject, links, HTML structure, attachments and text, with SpamAssassin’s classic 5.0 threshold. Real filters add Bayesian learning, blocklist lookups and, above all, sender reputation, which no paste-in tool can see.
Do I need the full headers?
No, but you get more checks with them. Paste the whole source to check Authentication-Results (SPF, DKIM, DMARC), Message-ID, Date, the Received chain, Reply-To and Return-Path alignment and one-click unsubscribe. In Gmail open the message, choose More, then Show original, then Copy to clipboard. A body alone, with an optional subject, still scores the content rules.
What do the score and grade mean?
Points add up from every rule that fires. Under 1 is A+, under 2.5 is A, under 4 is B, under 5 is C, 5 to 10 is D and 10 or more is F. Five is the point where a default SpamAssassin setup marks mail as spam.
What does the one-click unsubscribe check look for?
Gmail and Yahoo require bulk senders to send a List-Unsubscribe header with an https URL plus List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058), and the DKIM signature must cover both headers. The check fires on mail that looks like bulk mail: it has List-Unsubscribe, List-Id, Precedence: bulk, or an unsubscribe link in the body.
How do I stop my emails going to spam?
Fix what the rules flag here first: link to your own domain instead of shorteners, send a plain-text part with the HTML, keep a real amount of text next to images, and give bulk mail one-click unsubscribe. Then make sure the sending domain passes SPF, DKIM and DMARC, and send a real message to the email test to see what a receiving server concludes, including blocklists.
Does it check blacklists?
No. The paste is scored in your browser and nothing in it is looked up. Use the blacklist check for an IP address or domain, or send the message to the email test, which checks the IP it really came from.
Why did a legitimate email score high?
Common causes are an all-caps subject, link shorteners, image-only HTML, no plain-text part, click-tracking links whose visible domain differs from the real one, and a Reply-To on another domain. Each rule says what it found and how to fix it.
Where does my email go?
Nowhere. Parsing and scoring run in JavaScript on this page, there is no server call, and the message is not put in the URL or saved in your browser. Links are shown as text, and the HTML is read as text, never rendered.