SpamAssassin is the scoring engine most receivers apply as one factor in the spam decision. Postmark, SparkPost, Sendgrid’s mail-tester integration, cPanel/WHM, most self-hosted MTAs, and every hosted anti-spam gateway that predates the machine-learning-only era all use it in slightly different shapes. A score under 3 is clean, 3 to 5 is borderline, 5 and up will usually land in a spam folder or get quarantined at the edge. What matters more than the number is which rules fired. Each rule names a fixable defect in your headers, your MIME shape, or your authentication.
This tool sends the message you paste to
Postmark’s free public spamcheck endpoint, runs SpamAssassin on it, and returns the score plus every rule that scored the message. Then it translates each rule name into WP-shop language and points at the relevant nanoPost fix guide. SPF-family rules go to the DNS auth checker, DKIM-family rules to the DKIM inventory, missing-headers and MIME rules to the WordPress email troubleshooting guide, HTML-weight rules to the Gmail clipping analyzer, and blocklist rules to the sending-services roundup (the almost-always-right fix for a blocklist hit is to move off the shared IP that got you listed).
How this works. Your pasted message is forwarded once to Postmark’s free public spamcheck endpoint, which runs SpamAssassin and returns the score plus every rule that fired. nanoPost does not store the message; Postmark receives it in transit and its own privacy policy applies. If your content is confidential, use a local SpamAssassin install instead. Postmark’s public endpoint cannot query DNS blocklists (Spamhaus, DNSWL), so RBL rules never fire here — use a live inbox test to check real blocklist status.
What “score” means, honestly
A SpamAssassin score is a diagnostic, not a delivery prediction. Two receivers using the same rules can still land the same message differently. Gmail’s decision pipeline is dominated by their own reputation model and engagement signals, not by SpamAssassin. What SpamAssassin catches well is the content-and-shape class of problems: forged From lines, missing Message-ID, HTML-only MIME, absurd whitespace-to-text ratios, DKIM signatures that don’t verify. What it can’t tell you is whether your sending domain has a reputation with Google, whether your list has aged into engagement problems, or whether a real recipient will flag you as spam.
Use this tool to sweep the fixable, shape-shaped defects before you ship a template. To measure delivery to a real inbox, run a live inbox test (Mail Tester, GlockApps, or your ESP’s own inbox placement tool). Different question, different tool.
Privacy
Your pasted message is forwarded once, over TLS, to Postmark’s public spamcheck endpoint. nanoPost does not store it; Postmark receives it in transit and their own privacy policy applies. If the message content is confidential (a real customer receipt, a password reset, an internal notification) either redact the sensitive parts before you paste, or install SpamAssassin locally and run the check against a private instance. The Postmark endpoint requires no API key and has no user account, so there is no way to authenticate the request beyond the shared public endpoint.
What Postmark’s public endpoint cannot see
The public spamcheck endpoint runs a stock SpamAssassin ruleset with two important gaps. First, it cannot query DNS blocklists (Spamhaus, DNSWL, URIBL). Those providers block open-resolver traffic, and Postmark’s shared IP hits that block. So RCVD_IN_ZEN and its siblings never fire here. If a rule name in the results ends in _BLOCKED_OPENDNS, that is the fingerprint of the check environment, not a verdict on your IP. Use a live inbox test that receives from your actual sending IP to measure real blocklist status.
Second, the Bayes classifier is Postmark’s, trained on their own corpus. Your ESP’s classifier will score the same body differently. The Bayes rules (BAYES_00 through BAYES_99) are useful as a directional signal, not as an oracle.
How to get raw MIME
- Gmail / Google Workspace. Open the message. Three-dot menu, then Show original. Copy the whole page (headers plus body).
- Outlook (web) / Microsoft 365. Three-dot menu, then View, then View message source.
- Apple Mail (macOS). View, then Message, then Raw Source.
- Thunderbird. View, then Message Source (
Ctrl+U).
A raw MIME message must include the headers and the body. Postmark needs both to score content rules like HTML_MESSAGE, MIME_HTML_ONLY, and the whitespace-ratio checks. If you paste only headers, the score is still useful for authentication and structural rules, but every content rule will be blind.
Rate limit
Ten checks per fifteen minutes per IP. Postmark’s endpoint takes several seconds per check because SpamAssassin is doing real work; the limit protects both their free service and this tool from being scripted for bulk scoring.
When you’re ready to fix what fired
- SPF, DMARC, MTA-STS, TLS-RPT records: the DNS auth checker reads them live and grades them against the Gmail, Yahoo, and Microsoft 365 bulk-sender rules.
- DKIM signatures and selectors: the DKIM inventory lists every well-known selector for the domain and shows which are signing.
- The receiver’s stamped verdicts on a specific message: the header auth visualizer reads the
Authentication-Results:chain from raw headers and traces each mechanism. - HTML byte weight and Gmail clipping: the Gmail clipping analyzer measures the message against Gmail’s 102 KB clip threshold and points at the heaviest components.
- The general “why isn’t this delivering” starting point: the troubleshoot WordPress email guide.
- Moving off a shared IP that landed on a blocklist: the SMTP email services roundup covers the providers with clean-pool reputations.
