# Email Spam Score Checker Paste an email and get a 0-100 spam score with every rule that fired: trigger phrases, caps ratio, link density, shorteners, and header anomalies. Runs locally. ## Run it - **CLI:** `gizza tool email-spam-score 'From: Deals Subject: FINAL NOTICE!! ACT NOW to claim your FREE GIFT of $50,000 CASH!!!'` - **Web:** https://gizza.ai/tools/email-spam-score/ - **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/email-spam-score/tool.json ## Inputs - `email` — Email message _(field)_ - `subject` — Subject line (only if the paste has no Subject header) _(field)_ - `format` — Read the input as _(field)_ - `report` — Report style _(field)_ - `check_headers` — Apply header rules (SPF/DKIM/DMARC, From vs Return-Path, Reply-To) _(field)_ ## Output - Spam score report (text) ## Query parameters Open the tool pre-filled and auto-run via URL: - `email` — Email message - `subject` — Subject line (only if the paste has no Subject header) - `format` — Read the input as - `report` — Report style - `check_headers` — Apply header rules (SPF/DKIM/DMARC, From vs Return-Path, Reply-To) Example: `https://gizza.ai/tools/email-spam-score/?email=From%3A%20Deals%20%3Coffers%40grabber.top%3E%0ASubject%3A%20FINAL%20NOTICE%21%21%0A%0AACT%20NOW%20to%20claim%20your%20FREE%20GIFT%20of%20%2450%2C000%20CASH%21%21%21&subject=Your%20invoice%20for%20March&format=auto&report=detailed&check_headers=true` --- ## About this tool Email Spam Score Checker gives you a private, deterministic pre-flight score for suspicious or draft email copy. Paste a raw RFC 5322 message, an HTML body, or plain text and it reports a 0-100 spamminess score where higher is worse. The report is intentionally transparent: every fired rule is listed with its point value, so you can see whether the risk came from trigger phrases, uppercase shouting, link density, shorteners, suspicious headers, authentication failures already present in `Authentication-Results`, hidden HTML, or other explainable signals. It does not contact DNS, blacklists, seed inboxes, SMTP servers, or any reputation service. ### Worked example Paste this message and keep the default `format=auto`, `report=detailed`, and `check_headers=true`: ```text From: "security@yourbank.com" Return-Path: Reply-To: help@other.example Subject: Verify your account Authentication-Results: mx.example.com; spf=fail; dkim=none; dmarc=fail We detected unusual activity. Please confirm your account within 24 hours or your account will be closed. http://192.0.2.9/login ``` The output highlights the score band, message stats, and rules such as authentication failure, From/Return-Path mismatch, Reply-To detour, credential-pressure phrases, suspicious TLDs, insecure links, and IP-address URLs. ### Limits and edge cases - The input cap is 1 MiB. Remove large quoted threads, inline base64 attachments, or long footers before scoring. - Header checks only read headers that are already in the pasted message. The tool does not perform live SPF, DKIM, DMARC, DNS, blacklist, or reputation lookups. - This is a transparent heuristic approximation, not a SpamAssassin score and not a deliverability guarantee. - `report=json` is intended for scripts and CI checks that want the same deterministic score and rule list. ## FAQ
Is this the same as SpamAssassin or an inbox placement test? No. It is a local heuristic checker with a published set of rules and weights. SpamAssassin, DNS reputation, RBL checks, and seed-inbox placement require server-side data or network lookups, which this browser-local tool intentionally does not use.
Why can a legitimate newsletter get a non-zero score? Marketing email often contains some spam-like signals: many links, promotional phrases, unsubscribe headers, images, and tracking pixels. A non-zero score is not automatically bad; use the rule list to decide which signals are expected and which ones are worth changing.
What does the header checker actually verify? It inspects pasted headers such as `Authentication-Results`, `From`, `Return-Path`, `Reply-To`, `Message-ID`, `Date`, `Received`, and `List-Unsubscribe`. It does not query DNS or validate cryptographic signatures itself; it only reads results already stamped by a mail gateway.
When should I use `format=html` or `format=text` instead of auto? Use `format=html` when you paste only an HTML body and want HTML-specific rules such as image-heavy content, hidden text, tracking pixels, and anchor/href mismatches. Use `format=text` when the paste is plain copy with no headers and any angle brackets should be treated as text.
## Related tools - [Parse a Postal Address](https://gizza.ai/tools/address-parse/): Parse a freeform postal address into street, unit, city, region, postcode, and country fields. Local, rule-based, and browser-only. - [Authorization Header Decoder](https://gizza.ai/tools/authorization-header-decode/): Decode an HTTP Authorization header: Basic to username and password, Bearer token structure, Digest and AWS SigV4 params. Free, in your browser. - [Basic Auth Header Generator](https://gizza.ai/tools/basic-auth-header-generator/): Generate an HTTP Basic Authorization header from a username and password — base64(user:pass) per RFC 7617. Runs in your browser, nothing is sent, free. - [Calendar Free/Busy Overlap](https://gizza.ai/tools/calendar-freebusy-overlap/): Paste two .ics calendars and list the time slots where both are free — working hours, minimum meeting length, timezones and DST handled. Free and in-browser. - [CIDR Calculator](https://gizza.ai/tools/cidr-calculator/): CIDR calculator: get network address, broadcast, netmask, wildcard, usable host range and host count for any IPv4 or IPv6 prefix. Free, private, in-browser.