Spam filtering is the one part of email nobody looks at while it's working. Mail arrives, junk mostly doesn't, and the whole thing is invisible until the day something important lands in the spam folder or a customer says they never got your reply. By then you're troubleshooting an incident rather than reading a trend.
Spam statistics turn that around. They're per-domain, they cover the last thirty days, and they answer a question most providers won't even let you ask: what is actually being filtered on my domain, and is the filter getting it right?
What the Spam Statistics Actually Show
For each domain you get a summary over the period plus a daily series, so you can see both the shape and the movement.
| Figure | What it tells you |
|---|---|
| Inbound total | Everything that reached the domain, junk included |
| Clean | What passed filtering and was delivered |
| Spam detected | What was identified as junk |
| Spam rejected | What was refused outright rather than filed |
| Virus detected | Messages carrying known malware |
| Spam rate | Detected as a percentage of inbound |
| User-reported spam | What your people marked as junk themselves |
| False positives released | Legitimate mail rescued from the spam folder |
| Top symbols | Which filter rules are firing most |
The last three are the ones worth caring about, and they're the ones almost nobody publishes. Spam statistics that only tell you how much junk was blocked are marketing. Statistics that tell you how often the filter was wrong are diagnostics.
The Numbers That Signal Trouble
Most of the time these figures sit still and you can ignore them. Three movements are worth acting on.
False positives climbing. If people are regularly releasing legitimate mail from the spam folder, the filter is miscalibrated for your traffic — often because a supplier or a newsletter you rely on shares characteristics with junk. This is the most expensive failure in email and the least likely to be reported, because the person who never received your quote doesn't know to complain.
Inbound volume spiking on one domain. A sudden rise on a domain that normally sees little traffic usually means an address has been harvested and put on a list. Not urgent, but it tends to precede a period of noise, and if the address is a catch-all it can get loud.
User-reported spam rising while detection stays flat. This means junk is getting through and your people are cleaning up manually. The filter isn't failing loudly; it's failing quietly, and the cost is being absorbed by everyone's attention rather than showing up as an error.
Why Per-Domain Matters
Aggregate spam statistics across an entire account hide exactly what you need to see.
Domains have different traffic. A public info@ address on a company site receives a completely different mix from an internal domain used by six people, and averaging them produces a number that describes neither. A spam rate of 40% is alarming on one and entirely normal on the other.
If you hold domains for clients, this becomes the difference between a useful answer and a shrug. When a client asks why a message didn't arrive, per-domain spam statistics let you look at their domain specifically, over the period in question, rather than reasoning about a platform-wide average that has nothing to do with them.
Reading the Symbols
The top symbols list is the filter showing its working. Each symbol is a rule that fired — authentication results, reputation checks, content heuristics — and the count is how often. The names come from Rspamd, the filtering engine underneath.
You don't need to learn them all. What's useful is noticing when an authentication symbol dominates, because that usually points at a sender problem rather than a spam problem. Mail failing SPF or DMARC alignment gets scored up as junk even when it's legitimate, and the fix isn't the filter — it's the sending domain's records. Our guides on setting up SPF and configuring DMARC cover that side.
That's the most common false-positive cause worth knowing: a supplier whose own authentication is broken. Your spam statistics will show it as content-neutral rules firing on a sender you recognize.
Acting on It
The available responses are deliberately few, because most spam problems are solved by teaching rather than configuring.
Reporting spam and releasing false positives both feed the filter, and doing it consistently for a fortnight moves the numbers more than any setting. Blocking a specific sender is available when a particular source is the problem and you don't want to wait. For mail that's legitimate but unwanted, a filter rule that files it away is better than marking it as junk, because marking trains the system to distrust a sender other people may want — server-side rules are covered in how mail filters work, and they begin on the Pro plan.
What's usually wrong is doing none of this and then concluding the filter is bad. Spam statistics exist so the decision is informed rather than instinctive.
The Shape of a Normal Spam Rate
There's no universal figure, and any provider quoting one is describing their own average rather than your domain. What's useful is reading your own spam statistics for long enough to know the shape of normal, so you can recognize abnormal.
A domain with public-facing addresses — anything printed on a website, a business card or a company vehicle — routinely sees the majority of its inbound traffic classified as junk. Rates above half are unremarkable there. A domain used only for internal correspondence between known parties should see very little, and a sudden appearance of spam on such a domain is worth a look rather than a shrug.
The figure that should stay near zero on every domain is false positives released. Spam getting through is annoying; legitimate mail being filed as junk is expensive, and the two are not symmetrical. A filter tuned to catch everything will always cost you more than one that lets a few through.
What matters most is the direction of travel. A rate that has been steady for six months and then moves is telling you something happened, and the spam statistics will usually let you date it to within a day.
Using It When a Client Complains
If you hold domains for other people, this is where the feature earns its keep, because "we never got your email" is a conversation that otherwise has no evidence in it.
The sequence is short, and spam statistics carry the whole of it. Look at the client's domain over the period they're describing. If inbound volume was normal and nothing was rejected, the message probably never arrived at all, which moves the investigation to the sender's side rather than yours. If it was detected as spam, you can say so, release it, and explain why the filter judged it that way from the symbols.
That turns a defensive exchange into a factual one within a couple of minutes. It also protects you from the opposite error — assuming the filter was at fault and spending an afternoon adjusting something that was working correctly.
Per-domain spam statistics are what make this possible. An account-wide average tells a client nothing about their own domain, and they know it.
Rejected Versus Filed
Two of the figures look similar and mean quite different things, and confusing them leads to the wrong conclusion.
Spam detected is mail that was accepted and then classified as junk. It exists, it's in a folder, and it can be retrieved. Spam rejected is mail that was refused during the SMTP conversation and never accepted at all. It doesn't exist anywhere on your side, and it can't be released, because there's nothing to release.
Rejection happens for the most confident cases — known-bad sources, malformed messages, senders failing authentication badly enough that acceptance would be reckless. The advantage is that a rejected message produces an error at the sending end, so a legitimate sender caught by it finds out immediately rather than assuming their mail arrived.
That's the point worth passing on to anyone worried about false rejections. A wrongly rejected message tells its sender it failed. A wrongly filed one tells nobody anything, which is why the released-false-positive count is the number to watch rather than the rejection count.
The Limits of What the Numbers Show
Spam statistics describe inbound mail on your domains and nothing else, which leaves two questions they can't answer.
Both are worth naming, because assuming the statistics cover them is the usual way people end up looking in the wrong place.
They don't tell you how your outbound mail is being treated elsewhere. Whether your messages land in other people's inboxes is a separate question answered by DMARC reports and bounce data, covered in reading DMARC reports.
And they don't explain any individual message. The summary is aggregate: counts, rates and which rules fired most often across the period. For a specific message that went missing, the answer is in the headers of that message rather than in the statistics, and the statistics only tell you whether the domain saw traffic of that shape at all.
Used for what they're for — noticing that something changed, and having evidence when someone asks — they answer the question quickly. Used as a diagnostic for one email, they'll frustrate you.
A Sensible Routine
Nobody is going to check this weekly, and they shouldn't have to.
Look once a month, and look at false positives first rather than the headline block count. Check the domains that carry customer traffic before the internal ones. If false positives are at zero and user-reported spam is flat, close the tab — that's the system working.
The other time to look is the moment somebody says a message went missing, before assuming it was never sent. Spam statistics will tell you within a minute whether the domain saw the traffic at all, which turns an argument into a fact.
