Razor and Pyzor are two databases that store the checksums (signatures) of patterns known to have generated SPAM. To keep it simple, here is an example:
- A user sends a mass mailing campaign whose message includes the phrase: "Buy stolen watches".
- A high percentage of recipients click the "This is SPAM" button in their email client, which causes that email to be analysed by several external auditors, also known as blacklists.
- These auditors extract a checksum and determine that the phrase "Buy stolen watches" is the trigger.
- From that moment on, every email containing that checksum will be flagged as SPAM.
How do they differ?
- Razor is fed by Cloudmark's database, which has a huge global footprint: among others, they handle email for numerous government organisations. More details about Razor here.
- Pyzor is fed through honeypots: bait email accounts created with the sole purpose of flagging as SPAM every message they receive. More details about Pyzor here.
They collect checksums in different ways, but their functionality is essentially the same.
In short: if an email is flagged as SPAM by a Razor or Pyzor rule, the reason is the content of the email itself.
Why was the rule triggered?
Unfortunately it is not possible to find out the exact reason, but it is most likely one of these:
- The sender or the recipient has sent SPAM in the past.
- The sender's or recipient's entire domain has sent SPAM in the past.
- The subject line contains text that has been flagged for generating SPAM before.
- The body contains phrases or patterns that have generated SPAM in the past.
Recommendations if your emails trigger these rules
- If it is a reply or a forwarded message, remove all content that is not relevant to the conversation. Keep only your reply: quoted content is a common cause of antispam triggers.
- Send the email in plain text, without HTML. This avoids most of the checksums associated with HTML markup.
- Try changing the subject of the email.
- Try sending the same email to a different recipient to rule out a problem with the recipient themselves.
- Try sending the same email from webmail.