Reason codes

Codes are stable strings. New ones may be added; none are renamed or reused. reasons is never empty, and codes appear in evaluation order, so the first one is usually the one to show.

Hard rules

Stage rules, always spam. These are bots; drop them silently.

code	meaning	wording for people
HONEYPOT_FILLED	The hidden trap field had a value. Humans cannot see it.	A hidden field was filled in.
FAST_SUBMIT	The form was submitted under two seconds after it loaded.	The form was submitted faster than a person can type.
URL_IN_NAME	The name field contains a URL.	The name field contained a web address.
MANY_URLS	Three or more URLs in the message. Legitimate messages occasionally hit this; a review folder is safer than dropping.	The message contained several links.

Memory

Stage rules.

code	meaning	wording for people
DUP_KNOWN_SPAM	Near-identical to a message already classified as spam on any site. Always spam.	The same message was sent to other sites recently.
DUP_KNOWN_HAM	Identical to a message you marked legitimate. Always ham.	You marked this message as legitimate before.

Sender reputation

Stage rules when decisive, otherwise a soft signal alongside a model code.

code	meaning	wording for people
IP_REPUTATION_BAD	The visitor’s IP address has a recent history of spam.	This sender’s address has sent spam recently.
EMAIL_REPUTATION_BAD	The email address has.	This email address has sent spam recently.
EMAIL_DOMAIN_REPUTATION_BAD	The address’s domain has. Free-mail domains are never scored this way.	This sender’s domain has sent spam recently.
EMAIL_REPUTATION_GOOD	The address has a recent history of legitimate messages; the score was scaled down.	This sender has written legitimately before.

Reputation from one site affects only that site until two independent sites agree. Counters halve every 14 days.

Soft signals

Contribute to the score and appear next to a model or language-model code. None of them is spam on its own.

code	meaning
URLS_PRESENT	One or two URLs in the message.
SCRIPT_MISMATCH	Cyrillic or CJK text on a site whose locale uses the Latin script.
DISPOSABLE_EMAIL	Address at a known throwaway provider.
RISKY_TLD	A top-level domain with a high spam share, such as .ru, .xyz, .top, .click.
RANDOM_EMAIL, RANDOM_NAME	Machine-looking identifiers: digit density, consonant runs, case switching.
NAME_EMAIL_MISMATCH	No part of the name appears in the address and the domain is not a free-mail provider.
SPAM_PHRASE	One or more learned high-precision spam phrases matched.
KEYWORD_STUFFING	Very low vocabulary diversity in a long message.

Classifier and language model

code	stage	meaning	wording for people
ML_SPAM	ml	The classifier decided with at least 99 percent zone precision.	Looks like an unsolicited pitch.
ML_HAM	ml	The classifier is confident the message is legitimate.
LLM_SPAM	llm	Gray-zone case; the language model judged it unwanted for this site.	Not the kind of message this site is for.
LLM_HAM	llm	Gray-zone case; the language model judged it legitimate.
LLM_UNAVAILABLE	ml	The language-model call failed or timed out.
LLM_SKIPPED	ml	The request used mode: "fast", so the language model was not consulted. Re-classify in full mode if you want its opinion.
ML_GRAY_FALLBACK	ml	Gray-zone case labelled by the classifier’s nearest side because the language model was skipped or unavailable. Treat as the review bucket.	Borderline; worth a look.