POPcon PRO's antispam feature works by checking the IP address of the sending mail server against internet DNS blacklists (RBLs — Real-time Blackhole Lists). If the IP is listed, the email is tagged as spam.
Why false positives occur
DSL and cable ISPs often share IP address pools. If a residential user on the same IP range sent spam, the entire pool may be blacklisted, affecting legitimate senders on that ISP.
Why false negatives occur
Blacklists react to past abuse. A newly compromised server will not be listed immediately — there is always a lag. Additionally, some spam is sent from legitimate servers (compromised accounts).
Content filtering limitation
Content-based spam detection is inherently imperfect because spammers constantly adapt their techniques to evade filters.