Understanding SpamAssassin and Inbound Spam Filtering in Postmark

This article explains how Postmark uses SpamAssassin to process inbound messages and answer common questions about how spam filtering works.

📝 Summary

Postmark’s inbound spam filtering relies on SpamAssassin version 3.4.0, using simplified scoring and certain limitations. You can control which inbound messages are blocked by adjusting the SpamAssassin threshold in your inbound settings and reviewing the X-Spam-Score header in message details.

👀 Quick link

Learn more: What is SpamAssassin?

🤔 What is SpamAssassin?

SpamAssassin is an open-source tool that evaluates incoming messages and assigns a spam score based on a set of heuristic and rule-based checks.

Postmark uses SpamAssassin to assign a score to each inbound message. Messages with a spam score higher than your configured threshold will be blocked from delivery.

You can view or change your inbound SpamAssassin threshold from your Inbound Settings in Postmark.

🙋 Frequently asked questions

♻ Which SpamAssassin version does Postmark use?

Postmark runs SpamAssassin version 3.4.0, which is an older release. (SpamAssassin 4.0 was released in 2022.)

❓Why isn’t Postmark using a newer version?

SpamAssassin is integrated into our SMTP layer (Postfix), so upgrading requires a full system update. While we hope to update in the future, there are no current plans for an immediate version change.

👜 Does SpamAssassin scan attachments?

No. SpamAssassin analyzes the raw email message only. It does not inspect attachment content.

💀 Why are SpamAssassin headers sometimes missing?

Spam scoring is CPU-intensive. In rare cases, to optimize performance, Postmark may skip spam scoring for some messages. When this happens, those messages will not include an X-Spam-Score header.

🤔 Does SpamAssassin check DMARC?

SpamAssassin does not directly evaluate DMARC. However, inbound messages include SPF and DKIM results, which you can use to infer DMARC alignment manually if needed.

🧑🏿💻 Which header determines if a message is blocked?

The key header is X-Spam-Score.
Messages with scores higher than your configured threshold are blocked automatically.

💥 How are the X-Spam-Score and X-Spam-Status headers created?

These headers are added by SpamAssassin. Postmark does not modify or rank them. Only the X-Spam-Score header is used to determine if a message is blocked.

💅🏽 Does SpamAssassin check URLs?

No. The version of SpamAssassin we use does not support the DQS (Spamhaus DNS Query Service) plugin, and Postmark does not use any paid SpamAssassin services. As a result, spammy URLs may not always be flagged.

Note: Postmark’s inbound spam assessment is intentionally simplified and does not include URL reputation checks.

🎼 Can I see the score for each SpamAssassin test?

Not currently. While Postmark includes the triggered rules within the message headers, we do not display individual rule scores to keep message size and complexity manageable.

✅ Summary

To recap:

Postmark uses SpamAssassin 3.4.0 for inbound spam detection.
Messages are blocked based on the SpamAssassin threshold you set.
You can review scores in the X-Spam-Score header.
Attachments, URLs, and DMARC are not directly analyzed.
Missing headers can occur occasionally due to performance optimizations.