Spam is not a filtering problem

Thirty years into industrial-scale spam filtering, you still check the spam folder.

Not because the filter is bad. They are extremely good, and an inbox today compared with one from 2003 is a monument to highly complex engineering. You check it because you have no way to trust that it was right this time. That is a different complaint, and a much harder one to answer.

Two errors, always

Open the folder. There is something in there that should have reached you: a receipt, a reply from someone you wrote to first, a confirmation code. Now look at your inbox. There is something in there you would rather never have seen.

Both are true at once, permanently, on every account, for every provider. That is not a filter that needs tuning. That's the treatment of a symptom while the underlying problem remains unsolved.

A classifier must guess, and anything that guesses has two ways to be wrong. Push it harder and more real mail is diverted; ease it off and more junk arrives. There is no setting where both errors are zero, which means there is no point at which you can stop checking. The chore is not evidence of a filter that hasn't finished improving. It is the permanent cost of having a guess where a decision should be.

The part that should bother you more

Here is what I think is the real indictment, and it has nothing to do with accuracy.

You cannot escape the guess by stating what you want.

Try it. Add someone to your contacts and their mail still lands in quarantine sometimes. Contacts are an input to the classifier, not an instruction to it. Block an address and the same sender writes from a different one that afternoon, at no cost. Mark something as wanted, and you have supplied a training signal, not a rule.

There is no way to say "I always want mail from this person" and have it be true. There is no way to say "I never want mail from this person" and have it be true. Every mail system on earth offers you a version of these controls, and in every one of them your stated preference is advisory input to a probabilistic system that retains the final say.

You are not the one deciding who reaches you. You are a feature in a model that decides, for everyone.

Why it cannot be otherwise

Not because providers are careless, but because the preference has nothing durable to attach to.

"I want mail from this person" requires the system to know who this person is. In SMTP there is no such fact. The From: line is a string the sender writes, and there is nothing in the protocol to check it against. An address is not an identity; it is a label anyone can type, that anyone can copy, and that the person you actually care about can change tomorrow.

So a rule about a person cannot be written. What you get instead is a rule about a string, which is why blocking has always felt futile: the string was never what was reaching you. Filtering isn't the mail system's answer to spam. It is the mail system's substitute for a decision it cannot let you make.

That is the sense in which spam is not a filtering problem. Making the guess better does not move you closer to control. Accuracy and authority are different things, and no amount of the first produces the second.

What changes when an address is a key

Make an address a cryptographic keypair, have every message carry a signature from the key that owns it, and the missing referent appears. Now "this person" names something real, a key, and it can be checked locally, by your own client, without asking anyone.

Both sentences become expressible, and both become true:

Always this person. Their mail opens, every time, because the signature verifies against the key you trusted. Not "usually", not "unless the classifier disagrees today". There is nothing left to disagree.

Never this person. The block binds to the key, not to the address they happened to use. There is no fresh address that afternoon, because the address was never what you blocked.

For everyone you have decided about, the guessing simply ends.

The case you have not decided about

That leaves first contact, which is the only genuinely hard part, and which no preference can help with because you do not have one yet.

The answer is not to guess on your behalf. It is to make the message inert until you decide. Mail from someone new arrives in your inbox like anything else, with the sender, the subject and a preview line all visible. Nothing in it renders, loads a remote image, or works on you before you have chosen. Then you trust the sender, and the first sentence above applies from then on, or you block them, and the second does.

Notice what that removes. There is no second place to check, because nothing is being hidden from you on a guess. The quarantine folder was only ever needed because a machine was making a decision it could not make well, in a place you could not see.

What this does not do

It reprices bulk sending; it does not abolish it. Anyone can still send you something you did not ask for, and a determined sender can still acquire identities and spend them. What changes is that spending them costs something, because a burned identity stays burned, and that your refusal actually holds. Filters will still have work. They will be doing it against senders who cannot cheaply become someone else.

The guarantee holds between two DMCN addresses. Mail from the rest of the world crosses a bridge and is ordinary email on the other side: we run real SPF, DKIM and DMARC at the boundary and show you exactly what we could and could not verify, which is more than most providers do; they compute the same verdict and then hide it. But authentication is not identity. A sender who authenticates cleanly has proved that their domain sent the message, not that they are who they claim to be, so a convincing lookalike passes the boundary as cleanly as the real thing.

The protocol is open, the specification is published, and the reference server is Apache-2.0, so none of this requires trusting us in particular.

Thirty years of filtering has been an enormous amount of intelligence spent making a guess as good as a guess can get. It worked. It is still a guess, and you still check, because a probability is not a decision and never becomes one. The alternative was never a better classifier. It was being able to say who you want to hear from, and have that be the end of it.