The 6 types of email spam and how filters tell them apart

Email spam is unsolicited bulk or commercial messaging, but "spam" as a filtering category actually covers several distinct types of abuse, each detected with different signals. Understanding the split matters for legitimate senders mainly because it clarifies which detection mechanism a borderline message risks triggering, and why fixing one type of flag (say, a content heuristic) does nothing for a different kind (say, a domain reputation issue).

1. Unsolicited commercial email (UCE)

The broadest category - legitimate-looking marketing sent without consent or to a stale/purchased list. Detection here leans heavily on aggregate signals: complaint rate, engagement rate, list source reputation, and sending pattern consistency, rather than content alone. A well-written, honestly-labelled marketing email sent to a list that never opted in still gets filtered as UCE once enough recipients mark it as spam or simply never engage.

2. Phishing emails

Messages impersonating a legitimate brand or person to extract credentials or payment details, typically via a link to a fake login page. Detection relies on domain and URL reputation checks, visual/brand-impersonation pattern matching (a message claiming to be from a bank but failing DMARC alignment for that bank's actual domain), and known malicious-link databases. This is the category where DMARC enforcement (p=reject) does the most direct work - a correctly enforced DMARC policy makes it much harder to spoof a brand's visible From address convincingly.

3. Malware-containing emails

Messages carrying a malicious attachment or a link to a malware download, often disguised as an invoice, shipping notification, or document. Detection is attachment and link scanning - sandboxing executable content, checking attachment hash against known-malware databases, and flagging unusual file types (a .exe or macro-enabled document from an unfamiliar sender is a strong signal independent of the rest of the message's content).

4. Scam emails

Advance-fee fraud, fake lottery wins, romance scams, business email compromise (BEC) attempts - messages designed to manipulate a human decision rather than exploit a technical vulnerability. These are harder to filter purely algorithmically because they often come from otherwise clean sending infrastructure (a compromised but reputationally clean account) and rely on social engineering rather than a technical payload. Detection leans on content pattern matching (urgency language, request for payment or gift cards, unusual request from an apparently known contact) more than header or link analysis.

5. Chain emails

Messages asking the recipient to forward to others, often with a claimed consequence for not doing so. Largely a legacy category now, but still detected through forwarding-pattern analysis and specific phrase matching, since the structure (a message that explicitly asks to be propagated) is itself unusual for legitimate mail.

6. Spoofed and impersonation emails

Messages where the visible From address is forged to appear as a trusted sender, distinct from phishing in that the goal may just be to bypass a spam filter or get past a recipient's guard, not necessarily to steal credentials directly. This is almost entirely an authentication problem from the filtering side: SPF checks whether the sending IP is authorized for the envelope domain, DKIM verifies the message wasn't altered in transit and came from a domain holding the signing key, and DMARC ties both back to the visible From domain and tells the receiving server what to do on failure.

Detection method by type

Why this matters for a legitimate sender

A cold outreach or marketing message that looks fine in isolation can still get caught by UCE-style aggregate detection if engagement is poor or the list is stale - no amount of content polish fixes that, because the signal being evaluated is reputation and behaviour, not wording. Conversely, a message failing DMARC alignment because of a misconfigured sending source can get treated with the same suspicion as a spoofing attempt, even with genuinely good content and an engaged list - because from the filter's perspective, the authentication signal is what it is regardless of intent.

What not to do

Do not assume better subject lines or copy fix a UCE-pattern flag that's actually being driven by list quality and engagement. Do not assume DMARC enforcement alone stops scam/BEC attempts that don't rely on domain spoofing in the first place. And do not treat all filter rejections as "spam" generically when diagnosing a delivery problem - identifying which detection category a message is actually tripping tells you which part of your setup to fix.

MailPilot's deliverability checks cover the authentication layer that stops spoofing and phishing-style rejections, alongside the reputation and engagement tracking that governs the UCE-style aggregate signals - the two halves of this that a legitimate sender actually controls.