Source: https://help.spamfoo.com/guides/how-classification-works
Last updated: 2026-10-20

***

# How SpamFoo Classifies Email

SpamFoo gives every message a result. This page explains each result and the steps SpamFoo takes to choose it, so you can understand why a message ended up where it did.

## Spam and Phishing

SpamFoo first decides whether a message is unwanted. Unwanted mail gets one of two results:

- **Spam:** Junk mail you didn't ask for. Examples: bulk mail from unknown senders, fake offers, and scams.
- **Phishing:** A fake message that tries to trick you into giving up a password, money, or personal details. SpamFoo uses this result when a phishing check finds a link to a known phishing site, a display name that pretends to be someone your administrator protects, or a sender domain spelled to look like a well-known domain. With a SpamFoo Anti-Phishing license, the Anti-Phishing model can also give this result. See [Protect Against Phishing](https://help.spamfoo.com/guides/phishing-protection).

## The Four Email Classifications

Mail that isn't spam or phishing gets one of four Email Classifications.

| Classification | What It Means | Examples |
| --- | --- | --- |
| **Primary** | Important mail you should see first. | Messages from real people, replies in a conversation, sign-in codes, and urgent account alerts. |
| **Transactions** | Mail about money, orders, and accounts. | Receipts, order and shipping confirmations, bills, and subscription renewals. |
| **Updates** | Useful news that is rarely urgent. | Social media notices, forum posts, newsletters, and project updates. |
| **Promotions** | Sales and marketing from real companies. These aren't spam, but they are trying to sell something. | Sale announcements, coupons, and new product offers. |

SpamFoo picks a classification for each message, not for each sender. One company can send many kinds of mail. For example, Amazon might send you:

- A sign-in code (Primary)
- A receipt (Transactions)
- An AWS service notice (Updates)
- A sale announcement (Promotions)

SpamFoo looks at what the message says along with who sent it, so each one can get a different classification.

## What SpamFoo Looks At

SpamFoo reads many small clues, called signals, from each message. Some examples:

- **The sender:** the sender's address and domain, and the server the message came from.
- **Proof of the sender:** results of email checks called SPF, DKIM, and DMARC. These show whether the message really came from the domain it claims to be from.
- **Links:** how many links there are and where they go.
- **Attachments:** whether the message has any.
- **Warning signs:** for example, a reply address on a different domain than the sender, or text that hides words with odd spacing or look-alike characters.
- **Meaning:** what the message says and what it is trying to get you to do. SpamFoo turns the text into a list of numbers that captures its meaning, so it can compare messages without keeping their words.

## The Steps

SpamFoo runs these checks in order. When an early step reaches a clear answer, the later steps are skipped.

1. **Spam Rules.** A Spam Rule tells SpamFoo to always mark mail from a sender as Spam or Not Spam. Users, domain administrators, and system administrators create them in the SpamFoo Dashboard. If the matching rule is one of your rules or a Domain Spam Rule, it decides the result right away and no other check runs.
2. **Phishing checks.** SpamFoo looks for links to known phishing sites, display names that pretend to be people your administrator protects, and sender domains that are spelled to look like well-known domains. The display name check needs a SpamFoo Anti-Phishing license. A match marks the message as phishing.
3. **Your past corrections.** SpamFoo compares the message to messages you corrected before. If it closely matches one, especially from the same sender, SpamFoo follows your correction. See [How Personalization Works](https://help.spamfoo.com/guides/personalization).
4. **Sender reputation.** SpamFoo checks whether the sender's domain or server is on SpamFoo's list of senders known to be good or bad. A domain on the good list is only trusted when the message proves it really came from that domain.
5. **Spam models.** If nothing above decided, small machine learning models read the message. One looks at the text, one looks at the other signals, and a third combines their answers into the spam result.
6. **Email Classification.** Mail that isn't spam is sorted into Primary, Transactions, Updates, or Promotions. When the model isn't sure, the message goes to Primary so you don't miss it.
7. **Anti-Phishing model.** With a SpamFoo Anti-Phishing license, and when the model is turned on, SpamFoo scores the message with the Anti-Phishing model. A high enough score marks the message as phishing. See [Turn On the Anti-Phishing Model](https://help.spamfoo.com/guides/phishing-protection#anti-phishing-model).
8. **System Spam Rules.** System Spam Rules are applied. See [How System Spam Rules Fit In](https://help.spamfoo.com/guides/my-rules#system-rules).

## What Your License Includes

Your license decides which steps run.

- With spam protection and Email Classifications, every step runs, and mail that isn't spam gets one of the four classifications.
- With Email Classifications only, SpamFoo skips the spam steps and gives every message one of the four classifications.
- With spam protection only, SpamFoo decides spam or not spam, and mail that isn't spam gets no classification.
- With SpamFoo Anti-Phishing, the Anti-Phishing model step runs and display names are checked against protected identities. Without it, the model doesn't download or run, and protected identities aren't checked. The checks for known phishing links and look-alike domains run either way.

## Where You See Results

- **Your mailbox:** How classifications appear depends on your mail program. If you use SmarterMail, see [What SmarterMail Users See](https://help.spamfoo.com/integrations/smartermail/users).
- **Your dashboard:** The SpamFoo dashboard shows the result for each message and which step decided it. See [Review Your Messages](https://help.spamfoo.com/guides/my-messages) and [See Why a Message Was Spam](https://help.spamfoo.com/guides/why-spam).