Email spam trigger words to avoid in cold outreach (2026)

Spam filtering in 2026 runs on sender reputation, authentication and per-recipient statistical models, and word choice is a rounding error next to all three. The famous trigger-word lists descend from rule-based filters of the early 2000s, and the one such filter whose rules you can still read — Apache SpamAssassin — scores most of those phrases below two points against a default threshold of five, while a single listing on a DNS blocklist scores 3.558 by itself. Write plainly because plain writing gets replies. Do not rewrite a sentence to dodge a word.

Where the trigger-word list actually came from

Rule-based content filtering was the state of the art around 2002. A filter held a list of regular expressions, each with a point value, added up the ones that matched, and compared the total to a threshold. Publishing the rule names was normal, and marketing blogs copied the phrase fragments out of those rule sets into listicles. Those listicles have been copied from each other ever since, mostly without anybody re-reading the source.

The source is still there. Apache SpamAssassin's rules live in a public repository, and you can read them without an account. The file holding the salesy-phrase rules is 20_phrases.cf. It is 192 lines long and describes around 40 rules. The scores are in 50_scores.cf. The default threshold is one line in 10_default_prefs.cf:

required_score 5

Anything scoring at or above 5 is classified as spam. That single number turns every claim about trigger words into arithmetic you can check.

What the phrase rules actually score, with the numbers

Here is a selection of real rules from 20_phrases.cf, with the scores from 50_scores.cf. Read the constraints on the patterns, not just the words:

• ACT_NOW_CAPS matches /\bA(?i:ct) N(?i:ow)\b/ — the phrase with both initial letters capitalised, case-sensitively. It scores 0.1. That is one fiftieth of the threshold.
• SUBJ_ALL_CAPS fires when the subject line is entirely capitals. It scores 0.5.
• FREE_QUOTE_INSTANT requires the word "free" within about twelve characters of "instant", "express", "online" or "no obligation", and within another thirty-two characters of "quote". It scores up to 2.700, and there is no rule anywhere in the file for the bare word on its own.
• URG_BIZ requires "urgent" within sixteen characters of one of nine specific nouns — assistance, business, buy, confidential, notice, proposal, reply, request, response. It scores up to 1.750.
• DEAR_FRIEND matches a message opening with that exact salutation. It scores up to 2.683.
• MONEY_BACK is a literal three-word refund promise, matched as a fixed phrase. BANG_GUAR requires the same promise word immediately followed by an exclamation mark; it scores 1.0.
• SUBJ_BUY fires only when the subject line *starts* with "buy". LOW_PRICE requires a capital P in "Price". PRICES_ARE_AFFORDABLE, JOIN_MILLIONS, ONE_TIME, STRONG_BUY, UNCLAIMED_MONEY and REFINANCE_YOUR_HOME are all similarly literal.

Read the whole file and the character of it becomes obvious. It is a museum of 2003 spam: advance-fee fraud, body-part enlargement, unaccredited degrees, replica watches, stock pump-and-dump, home refinancing. It is not a description of B2B sales writing, and it was never intended as one.

One mechanical detail that undoes most of the advice built on these lists: a SpamAssassin body rule scores once per message, however many times its pattern appears. None of the rules in 20_phrases.cf sets the tflags multiple option that would change that. Using a word twice costs exactly what using it once costs.

The arithmetic: how much a trigger-word list can actually cost you

Suppose you write the worst B2B email you can and manage to trip four of the milder phrase rules at once — the capitalised urgency phrase, an all-capitals subject, the urgent-business construction and one more at around two points. Total: roughly 4.35. Still under the threshold of 5, and that required actively trying.

Now compare it with what a single non-content signal contributes:

• RCVD_IN_PBL — the sending IP is on the Spamhaus Policy Block List — scores 3.558.
• RCVD_IN_SBL_CSS scores 3.558.
• BAYES_99, meaning the statistical classifier put the message in the 99th percentile of spam-likeness, scores 3.5 in the network-plus-Bayes configuration.
• DMARC_REJECT, meaning the message failed DMARC against a published reject policy, scores 1.797. DMARC_QUAR scores 1.198 and DMARC_NONE scores 0.898.
• SPF_SOFTFAIL scores 0.972 and SPF_FAIL scores 0.919.

And what a good reputation subtracts:

• RCVD_IN_DNSWL_HI — the sending IP is on a high-trust allowlist — scores −5, which single-handedly cancels the entire threshold.
• RCVD_IN_DNSWL_MED scores −2.3. DKIMDOMAIN_IN_DWL scores −3.5. BAYES_00 scores −1.9.

One blocklist listing outweighs every phrase rule you are likely to trip combined. One allowlist entry outweighs all of them twice over. That is the shape of the whole subject, and it is why keeping the sending domain and IP off blocklists is worth more than any amount of thesaurus work.

Why the trigger words are different for every recipient anyway

The Bayes rules above are the giveaway. SpamAssassin's BAYES_* family scores a message against a statistical model trained on the mail that particular installation has already classified. The model is local. A word that is spam-indicative in one organisation's corpus is neutral in another's, and a recruitment agency's filter and a hospital's filter learn different vocabularies from the same English.

The large mailbox providers work the same way at a far greater scale, with per-recipient and per-cohort signals nobody outside them can enumerate. This is the deeper reason a universal trigger-word list cannot exist: the function is not shared. Two recipients at the same company can get different treatment for an identical message, and no public list can encode that.

Anybody selling you a definitive Gmail trigger-word list is inferring from anecdote. Google does not publish one, Microsoft does not publish one, and neither documents word-level scoring at all.

What Google actually says about message content

Google's sender guidelines are the closest thing to a primary source, and what they address is not vocabulary. On content and format specifically, Google states that if your messages are in HTML you should "format them according to HTML standards", that "web links in the message body should be visible and easy to understand", and — the one with real teeth — "Don't use HTML and CSS to hide content in your messages. Hiding content might cause messages to be marked as spam."

Google also asks that From: headers include only one email address, that you not use Re: or Fwd: on messages that are not replies or forwards, and that you not "use emojis or other non-standard characters to imitate graphic elements in messages, with the intent to deceive or influence recipients".

Notice the pattern. Every item is about deception or malformation, not about salesiness. Hidden preheader text in white-on-white, a fake Re: prefix, a tracking pixel in a message that is otherwise plain text, an unsubscribe link disguised as something else — those are the content behaviours that are actually documented as risky. The authentication and complaint-rate requirements that sit alongside them are the larger half of the picture and are covered in detail in what the receiving side actually publishes and measures.

Read the headers instead of guessing at the words

Stop theorising and get the filter to tell you. Send one copy of the message to a mailbox you control that runs a SpamAssassin-based filter — most hosting providers and many corporate gateways do — and read two headers on the received copy.

X-Spam-Status carries the verdict, the numeric score, the threshold in force and the exact list of rules that fired, in a form like Yes, score=6.2 required=5.0 tests=BAYES_99,HTML_IMAGE_ONLY_20,MIME_HTML_ONLY. Those rule names are the answer. Each one is greppable in the public rule files, so you can read the pattern that matched instead of guessing which word did it. Some installations add X-Spam-Report with the same list in longhand.

Authentication-Results, specified in RFC 8601, is the receiving server telling you what it concluded about SPF, DKIM and DMARC. Read it before you touch the copy at all: a dmarc=fail there explains far more filtering than any adjective in your first paragraph. Reading your own authentication records is the check that precedes every content decision.

If the message scores under the threshold and still lands in spam at Gmail or Outlook, the answer is that those providers are not running SpamAssassin and their models are private. The score told you the message is not structurally spammy; the placement is telling you something about reputation.

The content patterns that genuinely change placement

These are the ones with real numbers behind them, in rough order of size:

Image-to-text ratio. SpamAssassin's HTML_IMAGE_ONLY family scores by how little text accompanies the images, with rules in it scoring up to 2.799, and HTML_SHORT_LINK_IMG_1 adds up to 2.215 for a short message that is mostly one linked image. A designed HTML email with a hero graphic and forty words of copy can accumulate several points before anyone reads a word.

HTML-only messages. MIME_HTML_ONLY fires on a message with no plain-text alternative part. Sending multipart/alternative with a genuine text part costs nothing and removes the rule.

Hidden or low-contrast text. HTML_FONT_LOW_CONTRAST scores up to 0.786, and Google names hiding content as a practice that "might cause messages to be marked as spam". The white-on-white preheader trick is the single most commonly shipped version of this.

Shouting. UPPERCASE_75_100 scores up to 1.480 when three quarters or more of the body is capitals. This is the one folkloric rule with a real number attached, and it applies to the body, not to one word.

Link count and destination. The URI rules score the reputation of the domains you link to, not the count directly. A link to a domain already listed on a URI blocklist is worth more points than every phrase rule in this post combined. That includes your own tracking domain if it is shared with other senders.

Malformed structure. Missing MIME boundaries, quoted-printable lines over 76 characters, base64-encoded plain text. Each is small; together they are the profile of a message assembled by a script rather than a mail client.

Autocloz's free plan covers 5 users and 10 mailboxes and sends plain-text-first by default with SPF, DKIM and DMARC monitoring on the sending domain — start free if you would rather fix the mechanics than the adjectives.

How to test a message without spending a domain to find out

Three checks, in order of cost.

1. Score it offline. Run the message through a checker before it goes near a live list. The cold email spam checker flags the structural patterns above — image ratio, HTML-only construction, link count, hidden text — which are the ones with points attached. Subject-line construction is a separate question with its own subject line tester.
2. Read the headers on a real delivery. As described above. This is the only step that gives you rule names rather than heuristics.
3. Run a seed test. Mail a set of monitored mailboxes across Gmail, Outlook and Yahoo and record which folder each probe reached. This is the only method that measures placement rather than a proxy for it, and it is the one that catches a message drifting into Promotions while every content check passes. The seven levers that actually decide placement covers what to change once a seed test comes back poor.

Change one thing between tests. A rewritten message with four simultaneous changes tells you nothing about which change mattered.

What word choice cannot fix, and what Autocloz does not do

No vocabulary decision compensates for a missing DKIM signature, a domain with recorded complaints, or a list with a high invalid-address rate. If placement is poor and authentication is failing, the copy is not the variable, and rewriting it burns a week while the actual cause continues.

Nor does the reverse hold. Clean authentication and a good reputation do not make an irrelevant message welcome. Recipients marking mail as spam is the signal every provider agrees on, and that is a measure of whether people wanted to hear from you — a targeting decision, not a word-level one. Teams evaluating sending platforms on template libraries, as on the Lemlist comparison page, are optimising the layer with the least leverage in it.

Autocloz specifically: it does not filter or rewrite your copy against a trigger-word list, because the list is not a real artefact and pretending otherwise would be selling reassurance. It does not run SpamAssassin on your behalf or claim to reproduce Gmail's or Microsoft's classifiers, which are private and change without notice. Its email sending stack monitors SPF, DKIM and DMARC, sends plain-text-first, and runs placement seed tests when you trigger them — measurements of the outcome, not of the reasoning behind it, and on a cadence you keep rather than one it keeps for you. And nothing here makes placement certain; what it does is remove the failure modes that are documented, measurable and yours to control.