Frequently asked questions
What is Spam Scanner?#
A spam filter for Node.js, the command line and mail servers. It reads a raw email message and decides whether it is spam, phishing, a scam or carries malware, with a score and the list of tests that decided it. It runs as a library, a milterMail filter: a protocol from Sendmail, also used by Postfix, that lets a separate program inspect each message during the SMTP session. for Postfix and Sendmail, a SpamAssassin-compatible spamdSpamAssassin's daemon. Its protocol is spoken by spamc, Exim, Haraka and other SpamAssassin clients. server, a Postfix content filter, an HTTP API or a TCP server.
Is it free?#
Its license, the Business Source License 1.1, allows any use except offering spam detection as a service to others, and names the date on which it changes to the Apache License 2.0.
How accurate is it?#
On held-out English messages from its training data, the bundled classifier alone marked no hamWanted mail: the opposite of spam. as spam and caught 97% of the spam; the full numbers per language are in the training guide. Links, attachments, authentication, blocklists and a language model add to that. Your own mail is the real test: spamscanner eval measures any model on any labelled mail.
Which languages does it support?#
All of them. It segments words with the Unicode rules, including Chinese, Japanese and Thai, which have no spaces. Where the bundled model has seen little mail in a language it stays unsure rather than flag it, and a language model or your own training decides. Languages
Does it send my mail anywhere?#
No. By default it looks up the host names of links on Cloudflare's filtering DNS resolvers, and nothing else leaves the machine. Authentication, blocklists, language models and reputation services are off until configured, and personal data is removed before mail goes to a hosted language model. Security and privacy
Do I need a language model?#
No. It is a second opinion for close calls. Without one, those messages are decided by their score alone.
Which language model should I use?#
qwen3.5:4b through OllamaA program that downloads and runs open language models on your own machine, with an HTTP API. on a CPU, or qwen3.5:9b with a GPU. Both are Apache-licensed and read 201 languages. Spam Scanner reads the probability of each verdict from one step of the model, which on a two-core CPU took about 11 seconds a message instead of 31 for a written answer, with the same accuracy. For a hosted service, the decision models Cloudflare Clef and TypeSafe Jev answer in under a second; Anthropic, OpenAI, Google and others work too. Measurements and recommended models
Can it replace SpamAssassin?#
For most setups, yes: it speaks spamd's protocol, so spamc, Exim and Haraka work unchanged, and it writes the same X-Spam-* headers. It does not run SpamAssassin's rule files. SpamAssassin alternative
Will it reject legitimate mail?#
Refusing mail is off by default: the milter only tags. With --reject, only messages scoring 15 or more are refused, with a temporary 451 error, so senders retry and a mistake can be fixed by changing a setting. The content filter never refuses during the SMTP session.
How do I train it on my mail?#
spamscanner train --spam ~/Maildir/.Junk --ham ~/Maildir/cur --out model.json, then --model model.json. Mbox files, Maildirs, folders of .eml files and CSV or JSON Lines datasets all work. Training
Does it work without Node.js?#
Yes: standalone binaries for Linux, macOS and Windows include Node.js and the model. curl -fsSL https://github.com/spamscanner/spamscanner/releases/latest/download/install.sh | bash.
Who makes it?#
Forward Email, for its own mail servers.