Because filtering is a classification problem, and every classifier has two failure modes it can never eliminate at once. Tighten it and legitimate mail gets caught; loosen it and spam gets through. Your provider has to pick a point on that trade-off for hundreds of millions of people at once, and the senders are actively working to defeat it. The FTC puts it plainly: "filters aren't perfect, so even emails that make it past the filter might still be spam."
The trade-off, in one paragraph
A filter decides, for each message, spam or not spam. It will sometimes be wrong in each direction — a false positive (real mail in junk) and a false negative (spam in the inbox).
You cannot reduce both by tuning. Push the threshold to catch more spam and you catch more legitimate mail with it. Relax it to stop losing real mail and more spam arrives. Providers set the threshold conservatively because losing someone's invoice or fraud alert is far more damaging than showing them another casino email — which is exactly why some spam always gets through. Source: FTC. Checked: 2026-08-19.
Why it stays hard
- The senders adapt. This is an adversarial problem, not a static one. Every signal a filter learns becomes something to avoid — wording, sending patterns, infrastructure, image-only messages.
- Legitimate marketing looks like spam. A retailer you signed up with sends bulk promotional mail from a marketing platform. Structurally that's near-identical to unwanted bulk mail. The difference is your consent, which the filter can't see.
- Reputation takes time. New sending domains have no history, so filters are cautious — which is why a new legitimate sender sometimes lands in junk and a burner domain gets a brief window before it's flagged.
- Your definition is personal. A newsletter you love and one you resent are indistinguishable to a classifier. Only you know which is which, which is what marking as spam actually teaches it.
What filters are genuinely good at
Worth acknowledging: modern filters catch the overwhelming majority of obvious spam without configuration, and they've made the crude 2005-style flood a non-problem. Training yours — reporting rather than deleting — measurably improves it for your specific mail.
What they can't do is anything about the underlying situation.
The structural gap
A filter acts on messages after a sender has already reached your mail system. It doesn't reduce how many organisations hold your address, can't tell you which one leaked it, and can't revoke anyone's ability to contact you.
So a well-tuned inbox stays tidy while the number of parties holding your address keeps rising — every signup adds one. That's the boundary of what any receiving provider can do, not a criticism of your provider.
What to add
Filtering handles volume. Two things handle the cause:
- Unsubscribe from senders you recognise. Legally backed, and it also stops compliant companies sharing your address onward. When it works
- Give each organisation its own address. Then spam identifies its own source and can be cut off without the sender's cooperation — the one lever that isn't a classification guess. How
These are complements, not replacements. Keep the filter on; it's doing the volume work. All four mechanisms compared