See Why a Message Was Spam
Every message in the SpamFoo Dashboard records how SpamFoo reached its result. This page shows where to find that reason, what the common reasons mean, and what to do when the result is wrong.
Find the Reason
- Open the SpamFoo Dashboard and go to My Email > My Messages.
- Set Detection Type to Spam or Phishing, then click Search.
- Click the message to open the Message Detail panel.
Look at these parts of the panel, in this order:
- Tags next to the result. A reason tag, such as Learned (spam) or Look-alike domain, names what decided the message. An Override tag means a spam rule decided it. No reason tag usually means SpamFoo's models decided.
- Sender Verification. Shows whether the sender passed email sign-in checks and why. For example, Blocked by global reputation or DMARC failed.
- Processing Steps. The steps SpamFoo took, in order. When a rule decided the message, this names the rule as User Rule, Domain Rule, or System Rule.
Common Reasons
Most reasons appear as a tag next to the result, both in the list and in the details panel. The Detection Path filter on My Messages groups them, so you can find every message with the same reason.
| Reason | Detection Path Filter | What It Means |
|---|---|---|
| No reason tag | ML model | SpamFoo's models read the message and judged it to be spam. This is the most common reason. Your past corrections can also nudge the models toward spam or not spam. |
| Learned (spam) | Learned | The message looks like mail you marked as spam before. If Processing Steps says Learned (other sender), it matched a correction you made for a different sender. |
| User rule (spam) | User rules | One of your Trained Rules matched. SpamFoo created that rule from your corrections. |
| Admin block with an Override tag | Admin override | A spam rule set to Spam matched the sender. It may be your own rule, your domain's rule, or a system rule. Processing Steps says which one. |
| Reputation block | Reputation | The sender has a poor reputation because it sends a lot of spam. The Verified state is Blocked. In the details panel, this reason shows in Sender Verification instead of as a tag. |
| PhishTank match | Phishing / impersonation | The message links to a known phishing site. |
| Impersonation | Phishing / impersonation | The sender's display name matches a person your administrator protects, but the message didn't come from one of that person's approved senders. A fingerprint icon also appears. See Protect Against Phishing. |
| Look-alike domain or Typosquat domain | Phishing / impersonation | The sender's domain is spelled to look like a real one, for example with one letter changed. |
| Phishing Model | None | The Anti-Phishing model scored the message as phishing. |
| No reason tag | Cached | SpamFoo saw an identical message recently and reused that result. Processing Steps shows Cache Hit. |
| Parse error | Parse error | SpamFoo couldn't read the message properly. Badly formed messages are often spam. |
What Sender Verification Tells You
Sender Verification is based on SPF, DKIM, and DMARC. These are checks that let a domain prove which servers may send its mail.
- Spoofed is a strong warning sign. The message claims to be from a domain, but that domain's own checks say it isn't.
- Blocked means SpamFoo decided by the sender's reputation before running the checks.
- Unknown doesn't mean the message is bad. Many senders don't set up these checks, and messages decided by a rule or your corrections skip them.
If the Result Is Wrong
Pick the fix that matches the reason:
| Reason | What to Do |
|---|---|
| ML model, Learned, or Cached | Report the message as Not Spam, or as the classification it belongs in. See Correct a Wrong Result. |
| User rule (spam) | Delete the rule under Trained Rules on My Rules. |
| Admin block from your own rule | Turn off, change, or delete the rule in the Spam Rules list on My Rules. Your own rules show You under Set By. |
| Admin block from a domain or system rule | Ask your administrator. You can't change their rules, and they win over yours. |
| Reputation block or a phishing reason | If you trust the sender, add a spam rule set to Not Spam for them. See Add a Spam Rule. Be careful with phishing results. Only allow a sender you're sure is real. |
The quickest way to add that rule is the Create Rule button in the Message Detail panel. For a spam or phishing message, it fills in the sender's domain and picks Not Spam for you.
Warning Do not allow a sender just because a message looks familiar. Phishing messages copy the look of real companies and people.