Source: https://help.spamfoo.com/guides/why-spam
Last updated: 2026-10-20

***

# See Why a Message Was Spam

Every message in the SpamFoo Dashboard records how SpamFoo reached its result. This page shows where to find that reason, what the common reasons mean, and what to do when the result is wrong.

## Find the Reason

1. Open the SpamFoo Dashboard and go to **My Email > My Messages**.
2. Set **Detection Type** to **Spam** or **Phishing**, then click **Search**.
3. Click the message to open the **Message Detail** panel.

Look at these parts of the panel, in this order:

- **Tags next to the result.** A reason tag, such as **Learned (spam)** or **Look-alike domain**, names what decided the message. An **Override** tag means a spam rule decided it. No reason tag usually means SpamFoo's models decided.
- **Sender Verification.** Shows whether the sender passed email sign-in checks and why. For example, **Blocked by global reputation** or **DMARC failed**.
- **Processing Steps.** The steps SpamFoo took, in order. When a rule decided the message, this names the rule as **User Rule**, **Domain Rule**, or **System Rule**.

## Common Reasons

Most reasons appear as a tag next to the result, both in the list and in the details panel. The **Detection Path** filter on **My Messages** groups them, so you can find every message with the same reason.

| Reason | Detection Path Filter | What It Means |
| --- | --- | --- |
| No reason tag | **ML model** | SpamFoo's models read the message and judged it to be spam. This is the most common reason. Your past corrections can also nudge the models toward spam or not spam. |
| **Learned (spam)** | **Learned** | The message looks like mail you marked as spam before. If **Processing Steps** says **Learned (other sender)**, it matched a correction you made for a different sender. |
| **User rule (spam)** | **User rules** | One of your **Trained Rules** matched. SpamFoo created that rule from your corrections. |
| **Admin block** with an **Override** tag | **Admin override** | A spam rule set to **Spam** matched the sender. It may be your own rule, your domain's rule, or a system rule. **Processing Steps** says which one. |
| **Reputation block** | **Reputation** | The sender has a poor reputation because it sends a lot of spam. The **Verified** state is **Blocked**. In the details panel, this reason shows in **Sender Verification** instead of as a tag. |
| **PhishTank match** | **Phishing / impersonation** | The message links to a known phishing site. |
| **Impersonation** | **Phishing / impersonation** | The sender's display name matches a person your administrator protects, but the message didn't come from one of that person's approved senders. A fingerprint icon also appears. See [Protect Against Phishing](https://help.spamfoo.com/guides/phishing-protection). |
| **Look-alike domain** or **Typosquat domain** | **Phishing / impersonation** | The sender's domain is spelled to look like a real one, for example with one letter changed. |
| **Phishing Model** | None | The Anti-Phishing model scored the message as phishing. |
| No reason tag | **Cached** | SpamFoo saw an identical message recently and reused that result. **Processing Steps** shows **Cache Hit**. |
| **Parse error** | **Parse error** | SpamFoo couldn't read the message properly. Badly formed messages are often spam. |

## What Sender Verification Tells You

Sender Verification is based on SPF, DKIM, and DMARC. These are checks that let a domain prove which servers may send its mail.

- **Spoofed** is a strong warning sign. The message claims to be from a domain, but that domain's own checks say it isn't.
- **Blocked** means SpamFoo decided by the sender's reputation before running the checks.
- **Unknown** doesn't mean the message is bad. Many senders don't set up these checks, and messages decided by a rule or your corrections skip them.

## If the Result Is Wrong

Pick the fix that matches the reason:

| Reason | What to Do |
| --- | --- |
| ML model, Learned, or Cached | Report the message as **Not Spam**, or as the classification it belongs in. See [Correct a Wrong Result](https://help.spamfoo.com/guides/correct-result). |
| User rule (spam) | Delete the rule under **Trained Rules** on **My Rules**. |
| Admin block from your own rule | Turn off, change, or delete the rule in the **Spam Rules** list on **My Rules**. Your own rules show **You** under **Set By**. |
| Admin block from a domain or system rule | Ask your administrator. You can't change their rules, and they win over yours. |
| Reputation block or a phishing reason | If you trust the sender, add a spam rule set to **Not Spam** for them. See [Add a Spam Rule](https://help.spamfoo.com/guides/my-rules#add-spam-rule). Be careful with phishing results. Only allow a sender you're sure is real. |

The quickest way to add that rule is the **Create Rule** button in the **Message Detail** panel. For a spam or phishing message, it fills in the sender's domain and picks **Not Spam** for you.

> **Warning** Do not allow a sender just because a message looks familiar. Phishing messages copy the look of real companies and people.