Anatomy of A SPAM Filter (pt1) : What They Really Look For

Uncategorized
Anatomy of A SPAM Filter (pt1) : What They Really Look For

Spam filters are black boxes for a reason — if everyone knew how they worked, they’d be much easier for bad actors to crack.

This means that to understand how they work, we have to take a hands-on approach to testing and observing their behaviors, developing hypotheses on how they work and then testing those hypotheses in controlled experiments.

That’s exactly what we did in researching email deliverability over the past two years, and in this series of posts we’re going to share all of our findings on:

  • What SPAM filters are built to do (it’s not “filtering out marketing emails” 🙂 )
  • How SPAM systems evaluate your emails step-by-step
  • How to streamline your ops to lower chances of getting caught in SPAM

In this article, we’ll focus on the first topic — understanding what SPAM filters are built to do and why our marketing emails seem to get stuck in them, even when we follow all the best practices.

Why Do SPAM Filters Exist?

Email providers don’t spend millions of dollars each year fighting SPAM –defined as unwanted/unsolicited email — just to improve the User Experience.

So why do they do it?

Is it cost?

80% of all email traffic is estimated to be SPAM, which means the aggregate power, bandwidth and storage space it consumes is enormous.

But that’s not it either.

The evidence from our study (which we’ll share throughout these series) overwhelmingly suggests that the primary objective of these filters isn’t to prevent SPAM, but rather to prevent SCAMs.

How prevalent are scams? The FBI reports that phishing attacks cost victims $2.7B per year and that global cybercrime (in which cold email is heavily used) is over $6 trillion . The sheer size of these SCAM numbers and the associated liabilities is the primary reason why we see ESPs like Google constantly upgrading their email filtering capabilities.

In other words… all this time you thought were getting caught in the SPAM filter for being a marketer, you were actually getting caught in the SCAM filter because the algorithm couldn’t differentiate your emails from those of cybercriminals 😭😭😭

How “Best Practices” Can Get You Caught In The SCAM Filter

If these email filters are built to detect scam-like activity, then our goal becomes to look as little like these scammers as possible.

So how good are today’s “best practices” at doing this?

The answer is “very poorly”. Buying lots of domains, warming up inboxes, spintaxing email content and piggybacking off Google/Outlook/Sendgrid IPs are practices straight from the scammer playbook they’re very easy to detect.

Below and throughout this series, we’ll show exactly how blindly following these practices — developed without any scientific rigor and shared without any supporting evidence — often leads to lower email deliverability.

Text Content

What do most SCAM emails look like? Let’s break down one of the most infamous scam emails of all time — the “Nigerian Prince email” — and see how many email content best practices it checks.

  • Short Subject Line ✅
  • No HTML ✅
  • DKIM/DMARC/SPF set up
  • No Email Signature ✅
  • Not too much text ✅
  • Simple offer of value/pitch with clear ROI ✅
  • Simple CTA ✅

The truth is, this SCAM email is structured like most cold emails today and machine learning algorithms can’t tell the difference between them, unless a lot more work is put into updating the content. In our research, we found that this type of content change improved inbox placement by as much as 25%!

This is a good example of where you need to think less about looking like SPAM, and worry more about not looking like SCAM.

In a future post we’ll look at the algorithms used by an open source spam filter, which will make this even more clear.

HTML Content

Google recently freaked everyone out by displaying this warning message on emails containing open tracking pixels.

Everyone on the social web thought that this was Google cracking down on SPAMMERS who use email marketing tools; they actually thought someone inside Google was given the job of tackling SDR/marketing emails, as if that was what was top of mind.

What they later discovered — which we had already found in our study — was that Google wasn’t showing this warning because of the 1×1 tracking pixel. They were showing it because the CSS on that pixel was “display:none”, which meant there was an invisible image being served in the email. Now who would want to serve an invisible image in an email, except someone who is trying to trick the reader? A SCAMMER!

Once email marketing vendors realized was that they could simply remove that CSS and nobody would even notice that pixel being there since it’s 1×1 (it would look like some dirt on the screen or something), the message disappeared, leaving many wondering “is this really why I turned off email open tracking all these years???”

So what’s the takeaway?

First, that there are MANY MANY MANY similar html red flags that are obvious once you shift your lens from thinking like a SPAMMER to thinking like a SCAMMER.

And second that this is a classic example of how “email expert” advice can be right like a broken clock is right two times a day — they were right that removing tracking pixels improved deliverability, but wrong about the cause and optimal solution.

Link Redirects

Another classic in the scammer’s playbook is to play with links by adding redirects to different domains. The sneakiest ones will even find domains that look like other domains.

What do the cold email experts tell you to do?

  • Buy alternate domain names that look similar to a real domain name.
  • Overwrite links to track clicks.

Again, the “cleverness” of the outbound email marketer manifests itself like the cleverness of the scammer.

Note: there are far better click tracking mechanisms that we’ll share with you in a future post.

Conclusion

Getting to the primary inbox by blindly following “expert advice” is becoming harder and harder.

Those who want to achieve consistent results in the coming years need to understand HOW spam filters work and build customized strategies based on the characteristics of their campaign (volume, brand, offer, etc).

For those of us building high quality campaigns on segmented lists, there are far better/faster/cheaper approaches to getting to the inbox than going down the rabbit hole of managing

, and we’ll be sharing those with you on this blog. To make sure you don’t miss any of these insights, consider subscribing to The Deliverability Blog below.

eroltoker

eroltoker

Author

Loading...