Spam mail is still a daily problem, but the fight against it has moved on. The real question for most website owners isn’t “what is spam” any more — it’s how to stop spam reaching your inbox, how to stop spam comments and contact form submissions on your website, and how to make sure your own emails don’t end up in other people’s spam folders. This guide covers all three, with practical steps you can take today.
The three sides of the spam problem
When people talk about “fighting spam”, they usually mean one of three separate issues:
- Incoming spam — junk arriving in your email inbox.
- Website spam — fake comments, contact form submissions, and bogus sign-ups on your site.
- Outgoing deliverability — making sure your own legitimate emails aren’t flagged as spam by Gmail, Yahoo, or Outlook.
Each one needs a different fix. Below is what actually works for each.
How email spam filtering works
Spam filtering isn’t one check — it’s several layers working together, usually at the server level rather than something you configure yourself.
Think of it like an airport checkpoint. The first stop is an identity check at the door: the receiving mail server checks the sending server’s IP address against real-time DNS-based blocklists (DNSBLs), which are public and private lists of known spam sources. If the sender’s IP is already flagged, the message can be rejected before its content is even read.
If it passes that check, the message goes through full screening. A content filter such as SpamAssassin — a long-standing tool first launched in 2001, and still bundled free with most cPanel hosting — runs the message against a large set of rules. Suspicious phrases, scam patterns, malformed headers and other warning signs each add or subtract points. Once the score crosses a threshold, the message is marked as spam or deleted.
An older technique called greylisting is still around too. It temporarily rejects mail from a sender-recipient combination the server hasn’t seen before, then accepts it once the sender retries a short time later — genuine mail servers do this automatically, but one-off spam scripts often don’t. It’s worth knowing that greylisting is less effective than it used to be, since many spam-sending botnets now mimic a proper retry.
Most small business and WordPress users don’t need to configure any of this directly, since it typically runs at the mail hosting or server level. What you can usefully do is:
- Check that spam filtering is switched on in your hosting control panel (often listed under “Spam Filters” in cPanel).
- Avoid setting the spam-score threshold too aggressively, or genuine messages may be caught.
- Check your spam or quarantine folder occasionally for anything wrongly caught, rather than having it deleted automatically.
If spam is still getting through in large volumes after filtering is enabled, there are more specific adjustments covered in Too much spam is getting through Spamassassin – Here is some help.
Why your own emails might be landing in spam
If customers or subscribers say your emails never reach them, the cause is usually missing email authentication rather than anything wrong with the message content.
Three DNS-based records work together to prove an email genuinely came from you:
| Record | What it does |
|---|---|
| SPF | Lists which mail servers are allowed to send email for your domain. Stored as a DNS TXT record. |
| DKIM | Adds a digital signature proving the message wasn’t altered in transit and genuinely came from your domain. |
| DMARC | Ties SPF and DKIM together and tells the receiving server what to do if a message fails those checks — ignore it, quarantine it, or reject it — plus where to send reports. |
A basic DMARC record looks like this:
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
The p=none part means “just monitor, don’t block anything yet” — useful for getting started without risking legitimate mail being rejected, but it doesn’t actually protect your domain from being spoofed. Once you’ve checked reports and are confident, moving to p=quarantine or p=reject gives real protection.
One detail that trips people up: the domain in the visible “From” address has to match the domain checked by SPF or DKIM. If it doesn’t line up, a technically passing record still fails DMARC.
Why this matters more now than it used to
Gmail and Yahoo now require anyone sending 5,000 or more emails a day to a given provider to have SPF, DKIM and DMARC in place, support one-click unsubscribe, and keep spam complaints below 0.30%. Since November 2025, mail that doesn’t meet this is rejected outright rather than just filtered to spam. Microsoft brought in equivalent rules for Outlook.com and Hotmail.com addresses from May 2025.
Most small sites send well under that 5,000-a-day threshold, so the bulk rules won’t apply directly. But the wider trend affects everyone: unauthenticated mail is increasingly treated with suspicion and filtered to spam by default, even in small volumes. It’s worth checking with whoever manages your domain’s DNS that SPF and DKIM are set up, and adding at least a p=none DMARC record. If you send newsletters or marketing emails to a sizeable list, check whether you’re approaching the bulk-sender threshold, since one-click unsubscribe becomes a requirement at that point.
If you’re not sure how to add a DNS record like this, the steps are the same process as any TXT record: see How to Add a TXT Record to Your DNS: A Step-by-Step Guide. If outgoing mail is being rejected rather than just misfiled, also check Email Delivery Failure: 6 Common Causes and Fixes.
Stopping spam comments and contact form spam in WordPress
If your website gets fake comments, bogus contact form messages, or junk sign-ups, WordPress has some built-in tools before you need a plugin.
Use the Disallowed Comment Keys list
In your WordPress admin area, go to Settings > Discussion and find the Disallowed Comment Keys section (previously called the comment blacklist). Add words, phrases, links, IP addresses or user agents commonly seen in spam. Any comment matching one of these entries is sent straight to the Trash.
This check isn’t limited to the comment text — WordPress also checks the commenter’s name, site URL, email address and IP address against the list.
There’s a second, gentler option on the same screen: Comment Moderation holds matching comments for you to review manually, rather than deleting them automatically. Use this for borderline terms you’re not sure about.
Turn off pingbacks and trackbacks
Pingbacks and trackbacks were originally meant to notify you when another blog linked to your post, but they’re now a common spam route. On the same Settings > Discussion screen, untick “Allow link notifications from other blogs (pingbacks and trackbacks) on new posts” to close this off.
Other practical steps
- Add a spam-filtering or CAPTCHA plugin to contact forms, which blocks most automated submissions without inconveniencing real visitors.
- Keep comment moderation switched on for first-time commenters, so nothing appears publicly until you’ve approved it.
- Review your spam folder in the comments screen occasionally rather than emptying it immediately, in case a genuine comment is caught.
For a fuller walkthrough of plugin options and settings, see How to Deal with Spam on Your WordPress Website.
A quick checklist
- Check spam filtering is switched on in your hosting control panel.
- Confirm SPF and DKIM records exist for your domain, and add a basic DMARC record.
- Set up the Disallowed Comment Keys list in WordPress and turn off pingbacks/trackbacks.
- Add spam protection to any contact or sign-up forms.
- Check (don’t just empty) your spam and comment-moderation folders occasionally.
FAQ
Why am I still getting spam even with filtering turned on?
No filter catches everything, and spammers constantly change their wording and sending patterns to get past the rules in use. If a large volume of spam is getting through, the filter’s sensitivity settings may need adjusting rather than switching the filter off.
Do I need DMARC if I only send a few emails a day?
The strict Gmail/Yahoo/Outlook requirements only apply once you’re sending 5,000 or more emails a day to one provider. Below that, DMARC isn’t compulsory, but adding at least a basic p=none record is still worth doing, since unauthenticated mail is increasingly treated with suspicion regardless of volume.
Why does WordPress send some comments to spam automatically?
WordPress checks new comments against your Disallowed Comment Keys list and, if you use a spam-detection plugin, against wider spam databases too. Comments matching known spam patterns are trashed or held automatically so you don’t have to review every one manually.
Is greylisting still worth using?
It can still help reduce some spam, but it’s less effective than it used to be, since many spam-sending systems now correctly retry delayed messages. It works best as one layer alongside content filtering, not as a standalone solution.
