Most email never reaches an inbox, and the filtering that removes it happens in layers. Each layer asks a different question about the message.
Connection filtering comes before content
The cheapest check happens before the message body arrives. The receiving server looks at the connecting address and its history.
Addresses with a record of sending bulk unwanted mail are refused outright, which removes a large share of traffic without any content being examined.
This is why some mail vanishes without appearing in a spam folder. It was rejected at the door and never accepted for delivery.
Authentication checks who the sender claims to be
Several published standards let a domain owner declare which servers may send mail on its behalf and how messages should be cryptographically signed.
A receiving server checks whether the message matches those declarations, and whether the visible sender address aligns with the authenticated one.
Failing these checks does not automatically condemn a message, but it removes the evidence that would otherwise argue for delivery.
Reputation is attached to domains and addresses
Providers track how recipients treat mail from each sender over time: what gets opened, what gets marked as spam, what gets deleted unread.
A sending domain accumulates a reputation from that behaviour, and a poor one causes future mail to be filtered more aggressively regardless of content.
Reputation is why a newly registered domain sending large volumes is treated with suspicion. There is no history arguing that it should be trusted.
Content analysis looks at patterns, not words
Modern filters do not work from banned word lists. They compare a message against statistical patterns learned from very large volumes of classified mail.
Structure matters as much as vocabulary: link density, mismatches between visible and actual destinations, images carrying text, and formatting typical of bulk tools.
Because the model learns continuously, a technique that passes today can be caught next month without anyone writing a new rule.
False positives come from thin signals
Legitimate mail is misfiled most often when it looks statistically like bulk mail and lacks the reputation history that would override the resemblance.
Small organisations sending occasional newsletters from their own infrastructure fit that description precisely, which is why their mail is disproportionately affected.
Marking a message as not spam feeds the recipient signal back into the system, which is the mechanism by which the classification actually gets corrected.