Spam Prevention

​

Inbound: spam scoring

​

What’s checked

• Header analysis — forged headers, missing fields, suspicious routing
• Content patterns — known spam phrases, excessive capitalization, link density
• Sender reputation — blacklist checks, domain age, authentication results
• HTML analysis — hidden text, suspicious scripts, deceptive formatting

​

Spam score in webhook

{
  "security": {
    "spam": {
      "checked": true,
      "score": 1.2,
      "action": "accept",
      "flagged": false
    }
  },
  "message": {
    "metadata": {
      "spam_score": 1.2,
      "spam_action": "accept",
      "spam_flagged": false
    }
  }
}

​

Score thresholds

​

Using spam data in your agent

app.post('/webhook/email', (req, res) => {
  const { security, message } = req.body;

  if (security.spam.flagged) {
    // Handle with caution — might be spam
    console.log(`Spam score: ${security.spam.score}`);
    return res.json({ ok: true }); // Acknowledge but don't process
  }

  // Process normally
  processEmail(message);
  res.json({ ok: true });
});

​

Outbound: content validation

​

What’s checked

• Phishing patterns — deceptive links, urgency language, credential requests
• Spam content — excessive promotional language, misleading subjects
• Link analysis — suspicious URLs, redirect chains
• Sender consistency — From address matches inbox configuration

​

Blocked content

​

Email validation

​

Validation in send response

{
  "data": { "id": "msg_..." },
  "validation": {
    "rejected": [
      { "email": "user@nonexistent.xyz", "reason": "no_mx_records" }
    ],
    "warnings": [
      { "email": "test@mailinator.com", "reason": "disposable_domain" }
    ],
    "duration_ms": 35
  }
}

​

Suppression lists

• Hard bounces → immediately and permanently suppressed
• Soft bounces → suppressed after 3 consecutive failures (expires after 7 days)
• Complaints → permanently suppressed when a recipient marks email as spam
• Unsubscribes → permanently suppressed

​

What’s next?