qmail

Spam and virus filters can use any of a wide range of message characteristics for filtering. They include:

• The IP address from which the message is received

• The information sent in commands in the SMTP session, including the argument to the HELO or EHLO command, the envelope sender in MAIL FROM, and the envelope recipients in RCPT TO

• The contents of message headers, including From:, To:, Subject:, and Received:

• The contents of the message body

It's also possible and often useful to make filtering decisions based on combinations of messages, such as the number of messages received per minute from a particular IP address, or "bulkiness" scores based on the number of messages seen with similar or identical contents.