✉ Email deliverability

Email content and HTML: what spam filters really look at

How much content matters for delivery: linked domains, clean HTML, plain-text part, images, URL shorteners and the myth of forbidden words in subjects.

When a message ends up in spam, the first instinct is often to blame the text: a wrong word, too many exclamation marks, the word «free» in the subject. The idea dates back to early filters, which assigned scores to individual expressions. Modern filters at the major providers rely mainly on sender reputation and user behaviour, and content weighs less than people think. It does weigh in specific ways, though, and some construction mistakes can genuinely trip a filter.

The myth of forbidden words

There is no official list of words that send a message to spam. An expected newsletter from a sender with a good reputation can contain «offer» and «discount» without trouble. Conversely, a flawlessly written message from an unknown sender, or one with frequent complaints, will land in spam anyway.

What matters about the text is consistency: a subject that promises one thing and content that delivers another generates complaints, and complaints damage reputation. The problem, then, is not the word but how people react.

The content elements filters check most carefully are the domains mentioned in the message. Every link, every image loaded from an external server, every tracking domain is compared against reputation lists. A message sent from a flawless IP, with a single link to a domain on a suspicious-domain list, can be filtered.

Some practical rules:

  1. avoid public URL shorteners: they are heavily used by spammers and their domains often have poor reputation;
  2. use a custom tracking domain, a subdomain of your own domain rather than the platform's shared one;
  3. check the domains you link to: a link to a compromised or newly registered site can be enough to cause trouble;
  4. make text and destination match: a link whose visible text shows one address and points to another is a classic phishing signal.

Clean HTML and a plain-text part

Many emails are built with visual editors or pasted from word processors, and the resulting code is often heavy and messy. That creates two problems: some clients clip messages that are too long, showing only part of the content, and unusual HTML is in itself a weak signal of low quality.

Element Good practice
HTML size modest: some clients clip messages above a certain threshold
structure simple tables or email-specific layouts, no scripts or forms
styles inline, compatible with the most widespread clients
plain-text part present and consistent with the HTML, not an empty placeholder
encoding declared correctly, so accented characters don't turn into garbage

The plain-text part is often forgotten or left with generic text. A message made of a rich HTML part and an empty or completely different text part is an unnatural combination.

Images

A message consisting almost entirely of one large image, with very little text, is a format historically used to get around text-based filters, and is viewed with suspicion for that reason. Besides, many users see messages with images blocked: if all the content is in an image, they see an empty box.

It is better for the message to be readable without images, with real text for headings and calls to action and a descriptive alt attribute on every image.

Attachments

Attachments in promotional campaigns are best avoided. They increase message size, and some file types, such as compressed archives or documents with macros, are treated with great caution for security reasons. To distribute a document, a link to a page on your own site is preferable.

Test without obsessing

There are tools that give a message a spam score, often based on rules similar to those of traditional filters. They are useful for finding technical errors: missing DKIM signature, malformed HTML, links to listed domains, missing text part. They are less useful as a prediction: a good score doesn't guarantee the inbox at large providers, which rely mostly on reputation signals.

In my work, when one specific message is filtered while the sender's other messages get through, the cause is almost always a link: an external domain mentioned in the text or a shared tracking service.

In short

  • «Forbidden» words matter little: reputation and user reactions are what count.
  • Domains in links and images are checked carefully.
  • Avoid public shorteners and use your own tracking domain.
  • Modest HTML and a consistent plain-text part make the message more trustworthy.
  • A message should remain readable even with images blocked.
MM
Marco Marzaduri

Marco Marzaduri works in cybersecurity, digital forensics and web development. A computer science graduate, he combines rigorous technical analysis with attention to the people who use technology.

Read also