![The History of Email Spam](https://cdn.sanity.io/images/k34k3zzn/production/a98b6917c316e46875338943339a16afd6b9a4f5-4800x2520.png?w=1536&h=806&auto=format)
Summary
Discover how email spam evolved alongside the internet, driving technological advances and privacy laws from the 1970s to today.
The history of email marketing is intricately tied with the history of spam. Perhaps it's more accurate to state that they are tangled together–since the inception of email communication, spammers and bad actors have been in an arms race against technology and email service providers. The entanglement stretches back to the very origins of email marketing and continues unabated to the present day.
Email spam and its history run in parallel with the development of the internet into a bustling hub of commercial activity. The fight against spam is at the center of many technological innovations and cultural landmarks–this fight has shaped the evolution of the internet, how we interact over email, and robust privacy and anti-spam legislation.
This post is a companion to our History of Email Marketing piece. Like that piece, we've used AI-generated images as symbolic representations of each event.
Email Spam in the 1970s
The 1970s saw some of the earliest developments in email marketing history including a number of 'firsts.' The very first email was sent in 1971 by Ray Tomlinson using ARPANET, a precusor to the modern internet, the '@' symbol was introduced, and Queen Elizabeth II became the first head of state to send an email.Of course, perhaps inevitably, the 1970s saw another first: the first email spam message sent.
1978 - First Mass Marketing Email
![1978 First Mass Marketing Email](https://cdn.sanity.io/images/k34k3zzn/production/e04e956dfbbff4a8016f993eac25db824c4e37e5-1024x1024.png?w=760&h=760&auto=format)
Biplane delivering emails over a medieval village
On May 3, 1978, Gary Thuerk sent the world’s first spam email. Thuerk was a marketer at Digital Equipment Corporation (DEC), and his unsolicited email reached approximately 400 ARPANET users. According to legend, this email resulted in an impressive $13 million in sales, clearly demonstrating the power of email marketing, even in its rudimentary form.
The commercial success of Thuerk’s email is widely regarded as the birth of spam. This seminal event marks the beginning of our own history of email spam. While the email allegedly generated significant sales, it also sparked complaints from many recipients who had never received an unsolicited message before.
Email Spam in the 1980s
From major technical development like SMTP and the establishment of DNS to milestones like the first internet worms and the creation of the world wide web, the '80s marked a transformative decade for email marketing. The power of email is undeniable, even in the 1980s, as governments like the United States started enacting legal protections that covered email communications.
1982 - The “From” Header in Email
![1982 The “From” Header in Email](https://cdn.sanity.io/images/k34k3zzn/production/3eafa9f56144331303d3e26dee2dee711149c553-1024x1024.png?w=760&h=760&auto=format)
The "From" header is meant to be a sign of authenticity from sender to recipient.
While it's commonplace today, the "From" header was an important development in email marketing history. Not only does the "From" header help to increase the authority of emails, it has been exploited by bad actors to trick consumers. This specification can be traced back to RFC 922 in 1982.
1986 - Electronic Communications Privacy Act (ECPA)
![1986 Electronic Communications Privacy Act (ECPA)](https://cdn.sanity.io/images/k34k3zzn/production/9568f058c95b7629324bb3d767319933aed64056-1024x1024.png?w=760&h=760&auto=format)
A 1980s courtroom with a judge holding a gavel emitting a protective digital barrier
If you doubt the power of email communications, consider how governments reacted to this new medium. In 1986, the U.S. government extended restrictions on wiretaps to include electronic messages in direct response to growing concerns about privacy and unsolicited messages.
1988 - The Morris Worm
![1988 - The Morris Worm](https://cdn.sanity.io/images/k34k3zzn/production/4fcb34558028468f9da68c04496360e3063d9a4b-1024x1024.png?w=760&h=760&auto=format)
"Attack of the Morris Worm" in a comic book style
The Morris Worm was one of the first worms distributed via the internet. It highlighted, unfortunately, the vulnerabilities of connected systems and the potential for email to serve as a vector for spreading malware. Originally, it was not meant to be malicious–rather just gauge the size of the internet–but due to a programming error, it replicated excessively, fatally slowing down the host computer.
1989 - Creation of the World Wide Web
![1989 Creation of the World Wide Web](https://cdn.sanity.io/images/k34k3zzn/production/9440946362abf86d80e85fbb22db498ba01da834-1024x1024.png?w=760&h=760&auto=format)
A world connected by the World Wide Web.
Tim Berners-Lee proposed the creation of the World Wide Web in 1989. It was implemented in 1990, and, as they say, the rest is history.
Of course, the advent of the Web set the stage for a new age of digital commerce. Growing from humble origins in labs worldwide, the Web has become a juggernaut of commerce, generating trillions of dollars every year. With this opportunity, email spammers had plenty of incentive to trick consumers.
1989 - Launch of the First Commercial Internet Service Providers (ISPs)
![1989 Launch of the First Commercial Internet Service Providers (ISPs)](https://cdn.sanity.io/images/k34k3zzn/production/3bc7f6c1773e2508423c8fc9c2c90eac8db3c8c8-1024x1024.png?w=760&h=760&auto=format)
The internet becomes widely available to the public.
Evolving from its origins as ARPANET, the internet was hosted on private networks. By the late 1980s, however, the internet started to be publicly accessible via the first Internet Service Providers (ISPs). The rapid spread of this technology into the public domain encouraged commerce as well as spammers.
Email Spam in the 1990s
The early inklings of email’s power felt in the 1970s and 1980s came to full force in the 1990s. Major technological innovations, security and filtering measures, the commercialization of the web, and the rapid expansion of internet accessibility created a perfect storm for spammers. The early Internet was a veritable Wild West, and many consumers were still learning to navigate this new realm. The 1990s could be characterized as an arms race between spammers and everyone else, including governments, ESPs, and developers.
1991 - Introduction of PGP (Pretty Good Privacy)
![1991 Introduction of PGP (Pretty Good Privacy)](https://cdn.sanity.io/images/k34k3zzn/production/d59602f71345196b9150b73361d3cafc0ce8b759-1024x1024.png?w=760&h=760&auto=format)
Privacy methods help secure email communications.
Phil Zimmerman created PGP in 1991 introducing a method for secure communication over the internet which included secure email transmissions. The history of PGP itself warrants its own post – from its usage by political activists to a criminal investigation by the US government. Check out the Wikipedia entry!
1994 - AOL Implements Automated Spam Filters
![1994 AOL Implements Automated Spam Filters](https://cdn.sanity.io/images/k34k3zzn/production/06800de75635a4d92b38914baf1fefb7096db21d-1024x1024.png?w=760&h=760&auto=format)
A digital fortress scanning all email messages before they are permitted to pass.
AOL was one of the earliest and most recognizable email providers in the 1990s. From its iconic notification, "You've got mail!" to its widespread adoption, AOL was a mainstay of the internet in the 1990s.
While email gained popularity in the 1990s, so too did the rise of bad actors and spam emails. One of the largest and most influential internet service providers in the United States in the 90s, AOL was at the forefront of the fight against spam. In 1994, AOL introduced automated spam filters to its email system. These filters were designed to detect and block spam before unsolicited emails reached customers' inboxes.
1994 - Green Card Lottery Spam
![1994 Green Card Lottery Spam](https://cdn.sanity.io/images/k34k3zzn/production/2b3edf38f396c170542bc5c23cff6821bd3bbd59-1024x1024.png?w=760&h=760&auto=format)
A digital garden overrun by green card lottery spam weeds.
The “Green Card Lottery” spam event is significant due to its scale and the negative public reaction it received. This event wasn’t perpetrated using email; instead, spam messages were distributed over Usenet, an early discussion board. The message was directed at individuals hoping to apply for the U.S. Green Card Lottery—a legitimate immigration program.
The campaign was run by Laurence Canter and Martha Siegel, two lawyers who were seeking to advertise their services. Clearly, it wasn’t well thought out, as users blocked the two from posting on Usenet. This event, and others like it, signalled the need for regulatory action and served as the catalyst for laws like the CAN-SPAM Act.
Mid-1990s - Introduction of Heuristic Filtering
![1995 Introduction of Heuristic Filtering](https://cdn.sanity.io/images/k34k3zzn/production/953079a84eef723ebfc983cd6abd24e693cccaf6-1024x1024.png?w=760&h=760&auto=format)
A robotic gardener uses heuristic sensors to identify spam-like weeds
The introduction of heuristic filtering in the mid-1990s represented a significant development in the fight against spam. New automated filtering gave ESPs the ability to prevent spam messages from getting through to consumers.
Heuristic filters work by assigning scores to different elements of an email. If the score is above a certain threshold, the email is flagged as spam. Attributes scored include the presence of keywords, the ratio of text to images, the use of capitalization, and other spam indicators. Heuristic filters helped reduce false positives, meaning legitimate emails were less likely to be classified as spam, while also increasing overall accuracy.
1996 - MAPS and RBL Introduction
![1996 - MAPS and RBL Introduction](https://cdn.sanity.io/images/k34k3zzn/production/279126dfbd1ebed9c4aec12d1c60e09986aff9bf-1024x1024.png?w=760&h=760&auto=format)
A vigilant owl standing guard against spam and phishing emails.
Founded in 1996, the Mail Abuse Prevention System (MAPS) is a non-profit organization focused on preventing email spam. The organization is not without controversy, as it found itself in court over the publication of its anti-spam blacklist.
MAPs maintained the Real-time Blackhole List (RBL), a directory of domain names, email servers, and IP addresses that are recognized spammers. This organization is significant as one of the first groups to provide a community-driven solution to combat spam through blacklisting.
1998 - Spam Makes the Dictionary
![1998 Spam Makes the Dictionary](https://cdn.sanity.io/images/k34k3zzn/production/373300e6ee1df5431072312b81a37817c1454fb1-1024x1024.png?w=760&h=760&auto=format)
Spam entering the dictionary in a futuristic library.
The term "spam" was officially recognized in the New Oxford Dictionary, defining it as irrelevant or inappropriate messages sent over the Internet, highlighting its prevalence.
1999 - Melissa Virus
![1999 Melissa Virus](https://cdn.sanity.io/images/k34k3zzn/production/2be61d327ecf3be7f8d0c39044fd2fcb54d65e90-1024x1024.png?w=760&h=760&auto=format)
Sci-fi city under attack by the red, glowing Melissa Virus.
First appearing in March 1999, the Melissa virus was distributed through infected Microsoft Word document attachments. When a user opened the infected document, the virus executed a macro that forwarded the document to the first 50 contacts in the user's Outlook address book. The virus rapidly spread to other email users.
Its rapid spread overloaded email servers due to the volume of emails automatically sent by infected systems, quickly affecting organizations and individuals worldwide. It’s estimated that the Melissa virus caused $80 million in damages. The virus’s creator, David L. Smith, was arrested and sentenced to 20 months in federal prison.
Email Spam in the 2000s
The 2000s were ushered in by the dot-com bubble crashing. The high hopes of the 1990s that ballooned tech stocks like pet.com and others were quickly tempered by new reality. However, this crash didn't dilute the importance of the internet or email; if anything, the world wide web started to become deeply engrained in our cultural.
The 2000s were a transformative decade for email communication. The proliferation of spam and email-borne threats prompted an arms race of technological innovation and regulatory action to protect consumers. The awesome power of the internet -- evidenced by both the dot-com bubble crashing and the increasing role of governments in its regulation -- became fully evident in the 2000s.
Early 2000s - Bayesian Filtering Techniques Introduced
![Bayesian Filtering Techniques Introduced](https://cdn.sanity.io/images/k34k3zzn/production/c8df875ec6b62f96921649e1af6d8e3c74c755cf-1024x1024.png?w=760&h=760&auto=format)
Intricate machinery of the Bayesian Filtering Technique.
First introduced in the late 1990s, Bayesian filtering techniques gained widespread adoption in the early 2000s. These techniques are based on Bayesian probability developed by Thomas Bayes in the 18th-century. In essence, Bayesian probabilities relies on starting with an assumption and then refining that assumption as more information becomes available.
The adoption of Bayesian filtering in email spam helps to detect and block messages. The filter works by incorporating a training phase where the filter is trained by analyzing a large volume of legitimate and spam emails. This helps builds out the initial statistical model. Next, a scoring system is used to assess the likelihood the email is spam. Then, a threshold score is put in place where any email over that score is flagged as spam and blocked.
2000 - ILOVEYOU Virus
![2000 - ILOVEYOU Virus](https://cdn.sanity.io/images/k34k3zzn/production/91ce103bdf6f21601fc759d9896f474d90b5759e-1024x1024.png?w=760&h=760&auto=format)
Office computers overtaken by the heart-shaped ILOVEYOU Virus.
Despite the adorable name, the ILOVEYOU virus that appeared in May 2000 caused widespread damage across the world. Estimates of the economic damage range from a whopping $5 billion to $10 billion. The ILOVEYOU virus was spread via email through an email attachment named "LOVE-LETTER-FOR-YOU.TXT.vbs."
2003 - CAN-SPAM Act Enacted in the U.S.
![2003 CAN-SPAM Act Enacted in the U.S.](https://cdn.sanity.io/images/k34k3zzn/production/500bda2ea4a53914fd390557862cd436c4934f37-1024x1024.png?w=760&h=760&auto=format)
Judge's gavel sends shockwaves through the digital universe.
The US government endeavoured to put the spam back in the can with the 2003 CAN-SPAM act. The act established national standards for commercial emails and required the Federal Trade Commission to enforce these rules. This represents a major step in the legislative and regulatory fight against spam.
2003 - SPF (Sender Policy Framework) Introduced
![2003 - SPF (Sender Policy Framework) Introduced](https://cdn.sanity.io/images/k34k3zzn/production/94ad64d68e1dc34a6889a17ff07de7a244b93b03-1024x1024.png?w=760&h=760&auto=format)
A dome city protected by unwanted spam and phishing emails.
The introduction of the Sender Policy Framework (SPF) marked another significant security advancement in the battle against email spam. This framework was designed to provide a validation system to prevent email spoofing by having domain owners publish SPF records in their Domain Name System (DNS) settings. In effect, this was like proclaiming that email from a particular address was valid and legitimate, whereas any email from other addresses was suspicious.
2003 - Sobig Worm
![2003 - Sobig Worm](https://cdn.sanity.io/images/k34k3zzn/production/90438a60c271b8284b1af4013ec6cfdf1ec71720-1024x1024.png?w=760&h=760&auto=format)
Sobig worm slithering its way into millions of computers.
The Sobig worm once again highlighted the vulnerabilities of email systems and the effectiveness of email as a channel for distributing malicious software. Spread through email attachments, it often disguised files with enticing names, and the emails had ordinary subject lines like “Re: Details” or “Thank You!”
The deception resulted in economic damage amounting to hundreds of millions of dollars. The sheer volume of emails generated by the Sobig worm slowed networks, impacting businesses and individuals worldwide.
2004 - Mydoom Worm
![2004 - Mydoom Worm](https://cdn.sanity.io/images/k34k3zzn/production/43be88a301d9dbd33f1db2e7fb3a8b3644dc8add-1024x1024.png?w=760&h=760&auto=format)
Conveyor belts of emails are infected by the Mydoom Worm.
The Mydoom worm has the distinction of being one of the fastest-spreading email worms at the time. It was first detected in January 2004 and it quickly spread across the world, causing an estimated $38 billion in damages. It infected an incredible 1 million computers with the first 24 hours of its release!
2004 - Microsoft's Caller ID for Email
![2004 - Microsoft's Caller ID for Email](https://cdn.sanity.io/images/k34k3zzn/production/92d18707addb3be43e8f92d683db488411d21464-1024x1024.png?w=760&h=760&auto=format)
A cybernetic garden tended by robotics bees that only pollinate approved flowers.
Microsoft introduced Caller ID for Email in 2004 aimed at improving security by verifying the domain of email senders. Using domain verification has become a tried-and-tested way to combat spam by validating legitimate email senders. Like other verification standards, Caller ID for Email required domain owners to publish DNS records specifying which IP addresses were authorized to send emails on behalf of their domain.
This initiative was part of a larger push towards the development of Sender ID which combined key elements of Caller ID for Email and SPF.
2004 - SenderID Introduction
![2004 SenderID Introduction](https://cdn.sanity.io/images/k34k3zzn/production/5a8b231b27b8fbdfd15ca707cbbc2f94d1f6e4b4-1024x1024.png?w=760&h=760&auto=format)
Enchanted forests where only emails verified and true are permitted to roam.
The result of collaborative efforts led by Microsoft, Sender ID addressed some of the limitations of SPF to provide a framework for verifying the identity of email senders. The goal of SPF and Sender ID was to prevent email spoofing, and Sender ID added a check of the Purported Responsible Address (PRA). The way Sender ID handled PRA checks helped enhance SPF by reviewing both the envelope sender—part of the SMTP transaction that isn’t visible to email recipients—and the “From” address.
Sender ID didn’t become widely adopted, in part due to the complexity of setting it up. However, it did spur further innovation in email authentication and demonstrated the increasing importance of addressing spoofing and phishing.
2004 - Launch of Gmail
![2004 - Launch of Gmail](https://cdn.sanity.io/images/k34k3zzn/production/b79429ab6a6903ba8dc83ef976d85873aa608e3c-1024x1024.png?w=760&h=760&auto=format)
Gmail kicking off an email revolution.
Google's introduction of Gmail included innovative spam filtering techniques that became a benchmark in the industry, significantly reducing the impact of spam on users.
2005 - IronPort Anti-Spam Solutions
![2005 - IronPort Anti-Spam Solutions](https://cdn.sanity.io/images/k34k3zzn/production/b7b998bd88725f82c46f44b0102af66e79bf2541-1024x1024.png?w=760&h=760&auto=format)
An iron knight standing guard at the entrance of a network grid.
Founded in 2000, IronPort Systems specialized in email and web security, but it quickly gained a reputation for its innovative solutions for combating spam, malware, and other email-borne threats. Cisco acquired IronPort for $830 million in January 2007, representing both a major acquisition and a significant addition to Cisco's suite of security products.
Mid-2000s - Introduction of Greylisting
![Introduction of Greylisting](https://cdn.sanity.io/images/k34k3zzn/production/d104e9f232e770e60a2b46c70bc93cbe3723ada6-1024x1024.png?w=760&h=760&auto=format)
An email is restrained by greylisting technology.
Greylisting is an anti-spam technique that temporarily rejects emails from unknown senders, requiring the sending server to retry delivery after a delay. This helps identify spam email servers, as legitimate email servers will try to resend the message, whereas spam servers will not. Once the email is resent, it will be permitted and sent to the recipient’s inbox. While not perfect, as email spammers can develop workarounds, greylisting is used in conjunction with other security methods.
2007 - Storm Worm
![2007 Storm Worm](https://cdn.sanity.io/images/k34k3zzn/production/30f7392dabd38fca4396b86df6d21fdfceb5cd13-1024x1024.png?w=760&h=760&auto=format)
The stormy landscape of the Storm Worm injecting malicious code into email servers.
The "Storm Worm" earned its name because many of the initial emails spreading the virus had subject lines referencing a storm, such as "230 dead as storm batters Europe." The worm spread through email attachments, disguising itself as news reports or other enticing content. Unfortunately, in an all-too-familiar story, users who opened the attachment inadvertently installed the Trojan on their systems.
The Storm Worm is remarkable in part because of its social engineering practices used to entice users to open the email and download attachments.
2007 - Introduction of DKIM (DomainKeys Identified Mail)
![2007 - Introduction of DKIM (DomainKeys Identified Mail)](https://cdn.sanity.io/images/k34k3zzn/production/af9aeca6b55a1e9b1477725b596232788b8d0124-1024x1024.png?w=760&h=760&auto=format)
An email locked up with a digital padlock.
DomainKey Identified Mail (DKIM) was another significant advancement in email security, providing a method for verifying the authenticity and integrity of email content. It works by generating a unique cryptographic signature based on the email's content and headers. This signature is then attached to the email as a DKIM-signature header. The email sender publishes a corresponding public key in their domain’s DNS records, allowing ESPs to cross-check signatures.
DKIM quickly became an industry standard and has been adopted by major email providers and organizations to improve email security.
Late-2000s - CAPTCHA Implementation in Email Sign-Ups
![CAPTCHA Implementation in Email Sign-Ups](https://cdn.sanity.io/images/k34k3zzn/production/ff5a619a45c6eb1d3349817427a28acbac3130bf-1024x1024.png?w=760&h=760&auto=format)
A wizard conjures up puzzles at the gate of an email sign-up portal.
The late 2000s saw the introduction of CAPTCHA technology to help combat spam and automated abuse. CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart” and requires users to pass a test to determine if they are human or a robot.
CAPTCHA remains widely used today and has been a powerful tool in the fight against spam.
Email Spam in the 2010s
The history of email spam is very much an arms race between bad actors developing novel methods to trick consumers and governments, businesses, and developers racing to detect, prevent, and protect consumers from it. Building on the technical and security developments of previous decades, the 2010s saw significant advancements in the fight against spam.
The 2010s introduced new security protocols like DMARC, improved spam filtering, and the early use of AI to protect consumers. Throughout the 2010s, governments worldwide passed landmark legislation to combat spam, from Canada’s Anti-Spam Legislation (CASL) to the European Union’s General Data Protection Regulation (GDPR).
Early 2010s - Cloud-Based Email Security Services
![Early 2010s Cloud-Based Email Security Services](https://cdn.sanity.io/images/k34k3zzn/production/4d5e9f5e8c4cecff20ad245574ee37a4ac726efd-1024x1024.png?w=760&h=760&auto=format)
Email traffic requires tolls and security checks to ensure consumers can enjoy this channel safely.
The adoption of cloud-based email security services represented a shift in how organizations managed and protected their email communications. The exponential growth of email traffic in the 2010s was matched by an increase in the volume and sophistication of spam, phishing attempts, and other malicious activities.
Cloud-based services are hosted solutions that provide protection against common email threats. Operated in the cloud, they can rapidly scale to meet organizational requirements, unlike traditional on-premise hardware and software. Benefits of this approach include scalability, cost efficiency, and automatic updates to address new threats as they emerge.
2010 - Here You Have Virus
![2010 Here You Have Virus](https://cdn.sanity.io/images/k34k3zzn/production/a155a5a5e28b9cae164a742da3df9af26e3d0a3e-1024x1024.png?w=760&h=760&auto=format)
High tech classroom overrun by the Here You Have Virus.
Named after the misleading subject line it used, the “Here You Have” virus spread rapidly through email systems. It exploited human curiosity by enticing users to click on what appeared to be a PDF document. Instead, users were directed to a malicious executable file. Like many other worms in history, it downloaded contacts and self-replicated by sending itself to all contacts in the user’s address book.
2012 - DMARC Introduced
![2012 DMARC Introduced](https://cdn.sanity.io/images/k34k3zzn/production/4fc6f51e6c7aef06bb5d7158238677da0f443349-1024x1024.png?w=760&h=760&auto=format)
DMARC acts like a gatekeeper verifying the authenticity of each message.
Introduced in 2012, Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email authentication protocol that works with SPF and DKIM. DMARC is important because it allows domain owners to specify policies for handling emails that fail authentication checks, providing a mechanism to prevent fraudulent emails and offering reporting capabilities.
DMARC is an essential component of email security, enjoying widespread adoption and proving to be an effective method for combating phishing and spoofing attacks.
2014 - CASL (Canada's Anti-Spam Legislation) Enacted
![2014 - CASL (Canada's Anti-Spam Legislation) Enacted](https://cdn.sanity.io/images/k34k3zzn/production/ab094b7a5a774c70fb31c0ed93e66eb7e1fe4f0e-1024x1024.png?w=760&h=760&auto=format)
CASL passed in Canada is part of a trend of stronger anti-spam legislation.
Enacted in 2014, Canada’s Anti-Spam Legislation (CASL) is considered one of the toughest anti-spam laws in the world. The act applies to all commercial electronic messages sent within, from, or to Canada. It carries hefty penalties for violations, with fines up to $1 million per violation for individuals and $10 million for companies.
Mid-2010s - Integration of Behavioral Biometrics
![Mid-2010s Integration of Behavioral Biometrics](https://cdn.sanity.io/images/k34k3zzn/production/c1caa39817de072efdd04d5c7ba68771342169c1-1024x1024.png?w=760&h=760&auto=format)
A single note out of place is sensed by behavioral biometrics like a conductor hearing a misplaced note.
How we interact with email or any technology is unique and creates a pattern. Behavioral biometrics involves the identification and authentication of users based on behaviors rather than physical attributes. Instead of a fingerprint, you can be identified by how you interact with email. This type of pattern analysis is used in email to detect anomalies, such as a login from an unfamiliar location, which could indicate a threat.
Integrating behavioral biometrics into email security has been effective at thwarting attackers and providing an additional layer of defense. This approach provides real-time threat detection, allowing organizations to respond quickly by identifying and isolating compromised accounts.
Mid-2010s - Implementation of Neural Networks in Spam Filtering
![Mid-2010s - Implementation of Neural Networks in Spam Filtering](https://cdn.sanity.io/images/k34k3zzn/production/e5394c65e730443555aec4d99cf9697d79615885-1024x1024.png?w=760&h=760&auto=format)
Spam filtering through predictive models help isolate signal from noise.
The sheer volume of email communications presents a significant challenge for spam detection at scale. In the mid-2010s, the implementation of neural networks added a potent new weapon to the anti-spam arsenal. Neural networks have an advantage over rule-based spam filters because they continuously learn and evolve based on the analysis of vast datasets. The benefit isn’t just blocking potential spam messages; it’s also ensuring that legitimate emails don’t get incorrectly flagged as spam.
Mid-2010s - Advanced Encryption Techniques for Email
![Mid-2010s - Advanced Encryption Techniques for Email](https://cdn.sanity.io/images/k34k3zzn/production/f2a30fd45abdc7cb8bde44cd9b2d4235f97a1d2b-1024x1024.png?w=760&h=760&auto=format)
Encryption helps to secure communications like a high tech bank vault.
Concerns about data privacy were a central theme of the 2010s. By the mid-2010s, advanced encryption techniques for email significantly improved the security and privacy of digital communications. Key legislation like GDPR required organizations to protect data in transit and at rest, and encryption became essential for both compliance and security.
Encryption techniques saw widespread adoption, with tools like PGP (Pretty Good Privacy) and S/MIME (Secure/Multipurpose Internet Mail Extensions) becoming more accessible to the average user.
2016 - Introduction of Email Authentication, Reporting, and Conformance (ARC)
![2016 - Introduction of Email Authentication, Reporting, and Conformance (ARC)](https://cdn.sanity.io/images/k34k3zzn/production/c04880b1a95ca8b823aaf368b8fe138f3f4144de-1024x1024.png?w=760&h=760&auto=format)
Like runners in a relay race securely passing the security baton from one system to another.
The introduction of Email Authentication, Reporting, and Conformance (ARC) in 2016 was another significant step forward for email security. It was developed to ensure that email authentication was preserved when forwarding authenticated emails. It works by attaching a series of headers to the email with the original authentication checks to allow for downstream servers to independently verify the origin of the email.
2016 - Locky Ransomware
![2016 - Locky Ransomware](https://cdn.sanity.io/images/k34k3zzn/production/9e41e241dc809e73ed33b0ffc1143d2d490ce939-1024x1024.png?w=760&h=760&auto=format)
Ransomware like Locky is like chains trapping users and businesses.
One of the most widespread and impactful ransomware strains of the 2010s, Locky ransomware caused havoc for users and businesses. Locky worked by encrypting files on the victim's computers and then demanding a payment in Bitcoin for the decryption key. It spread through email campaigns enticing users to download attached files that appeared to be invoices, receipts, or other typical business files.
2017 - WannaCry Ransomware
![2017 - WannaCry Ransomware](https://cdn.sanity.io/images/k34k3zzn/production/d823584c17a63e71cbec070ebef270ef42906749-1024x1024.png?w=760&h=760&auto=format)
Global organizations affected by WannaCry ransomware
Like Locky in 2016, the WannaCry ransomware encrypted files and demanded Bitcoin in exchange for decryption keys. The attack is significant not only for the widespread damage it caused, but the exploitation of a vulnerability. To Microsoft's credit, it had recognized and fixed the vulnerability, but many organizations hadn't applied the update leaving them exposed to the WannaCry ransomware.
2018 - GDPR Enforcement Begins
![2018 - GDPR Enforcement Begins](https://cdn.sanity.io/images/k34k3zzn/production/7f9935c2fdcbdb89e6f2d59e7f12975503a9aa54-1024x1024.png?w=760&h=760&auto=format)
European laws have had big impact on international business
Adopted by the European Union in April 2016, the enforcement of the General Data Protection Regulation (GDPR) began on May 25, 2018. GDPR represents one of the most significant pieces of legislation in the history of email marketing. It had an immediate global impact, regulating how organizations could interact with residents of the EU.
One of the key provisions for email marketing was the requirement for explicit, informed consent before collecting or processing personal data, including email addresses. Additionally, organizations must provide opt-out mechanisms and uphold data subject rights, including the right to access, correct, delete, or restrict the processing of personal data.
2018 - Launch of the Brand Indicators for Message Identification (BIMI) Initiative
![2018 - Launch of the Brand Indicators for Message Identification (BIMI) Initiative](https://cdn.sanity.io/images/k34k3zzn/production/52381aef410cbcc8c82d524bb9c8ee60c11bba77-1024x1024.png?w=760&h=760&auto=format)
Email senders can display logos in email boxes to increase trust
BIMI helps to authenticate legitimate brands by displaying brand logos alongside their messages in the inbox. This is aimed at increasing trust and making it easier to identify authentic emails. Learn more about BIMI here.
Email Spam in the 2020s
Heading into the 2020s, our current decade, we must ask if we're in a new age of email security and privacy or if the arms race continues? New regulations like California's CCPA demonstrate the continued legislative fight against spam, while events like the COVID-19 pandemic gave rise to a fresh wave of phishing attacks.
2020 - California Consumer Privacy Act (CCPA) Enforcement
![2020 - California Consumer Privacy Act (CCPA) Enforcement](https://cdn.sanity.io/images/k34k3zzn/production/6cf474ac2d2d102e93607807acce4f843a89a2fd-1024x1024.png?w=760&h=760&auto=format)
The sun rises on a new era of privacy standards.
The COVID-19 pandemic provided an opportunity for bad actors to exploit consumers, leading to a surge in email-based phishing attacks. Unfortunately, despite technological and security advancements, many phishing attacks used social engineering to deceive consumers.
In response, organizations around the world placed greater emphasis on cybersecurity and began investing more in training and education. The ability to recognize and respond appropriately to phishing attacks is a key focus of modern email and cybersecurity training programs.
2020 - COVID-19 Related Phishing
![2020 - COVID-19 Related Phishing](https://cdn.sanity.io/images/k34k3zzn/production/b830b88ddd4e78827aad5007ea2d622588f7b06d-1024x1024.png?w=760&h=760&auto=format)
Malicious actors taking advantage of the COVID-19 crisis to exploit consumers.
A surge in email-based phishing attacks exploiting the COVID-19 pandemic, which included malware and misinformation, emphasizing the role of timely cybersecurity measures in times of crisis.
2021 - Apple's Mail Privacy Protection Announcement
![2021 Apple's Mail Privacy Protection Announcement](https://cdn.sanity.io/images/k34k3zzn/production/ac25bef909c68141f67d30af552f9200838f8e37-1024x1024.png?w=760&h=760&auto=format)
In the innovation lab of Apple, new privacy protection impacts how emails are tracked.
Part of its iOS 15 update, Apple announced its Mail Privacy Protection (MPP) feature. As a direct countermeasure to concerns over user privacy and the increasing use of tracking technologies in email marketing, MPP limits marketers’ ability to track user information through invisible tracking pixels.
Early 2020s - Zero Trust Architecture for Email Systems
![Early 2020s - Zero Trust Architecture for Email Systems](https://cdn.sanity.io/images/k34k3zzn/production/0fda9e4cf119b451aed828d73ab5fd8291031cf0-1024x1024.png?w=760&h=760&auto=format)
Securing email systems as if they were high security digital fortresses.
Zero Trust Architecture (ZTA) is a framework that assumes no entity can be trusted by default. Instead, every access request must be verified before access is granted, whether it’s a login or an email communication. ZTA helps reduce vulnerabilities by requiring more stringent verification for every action and eliminating implicit trust.
Its adoption is occurring in parallel with the rise of remote work and bring-your-own-device (BYOD) policies. ZTA is still being implemented but enjoys broad support, with 96% of organizations stating they plan to implement it.
2022 - EU ePrivacy Regulation Updates
![2022 EU ePrivacy Regulation Updates](https://cdn.sanity.io/images/k34k3zzn/production/9385463ff42727d34a898b6cbe9580c701ee2f33-1024x1024.png?w=760&h=760&auto=format)
Updates to ePrivacy Regulations require businesses to obtain explicit consent.
Often referred to as the “cookie law,” the EU ePrivacy Regulation addresses confidentiality in communications, including the use of cookies, direct marketing, and unsolicited communications. This regulation updated the requirements for businesses to obtain consent from users before collecting, processing, or sharing data for electronic communications.
One outcome of this regulation was the widespread adoption of cookie consent banners that inform users about cookies and obtain their consent. The EU ePrivacy Regulation requires that businesses not set cookies prior to obtaining consent. In addition, websites must offer clear and concise information about cookie policies in a transparent manner.
Early 2020s - Advanced Anomaly Detection Systems
![Early 2020s - Advanced Anomaly Detection Systems](https://cdn.sanity.io/images/k34k3zzn/production/6d764408ca5063aad0b524177772e5da622823b5-1024x1024.png?w=760&h=760&auto=format)
Air traffic controller monitoring radar screens for anomalies.
Advances in neural networks for spam filtering in the mid-2010s have contributed to the effectiveness of advanced anomaly detection systems. Anomaly detection leverages deep learning to analyze vast volumes of email in real-time.
This data helps systems identify typical email user behavior and recognize deviations from the norm. Advanced anomaly detection systems not only help stop email spam in real-time but also reduce false positives, ensuring that legitimate emails aren’t mistaken for spam.
2023 - Google Spam Complaint Threshold Implementation
![2023 Google Spam Complaint Threshold Implementation](https://cdn.sanity.io/images/k34k3zzn/production/8f8b56fb4917b1290d2073937992c6805aecccaa-1024x1024.png?w=760&h=760&auto=format)
Robots cleaning up weeds and beautifying digital gardens.
Ever wonder what happens when you “mark an email as spam” in Gmail? As of 2023, Google implemented a new policy that escalates consequences for email senders who exceed a spam rate of 0.1%. This policy is designed to improve the quality of emails and may have a broader impact as other email service providers adopt similar practices.
2023 - Link Tracking Protection in iOS 17 & macOS Sonoma
![2023 - Link Tracking Protection in iOS 17 & macOS Sonoma](https://cdn.sanity.io/images/k34k3zzn/production/aa0a7c13e38f11fe85841e0b19426493f6bfae4e-1024x1024.png?w=760&h=760&auto=format)
Apple enhanced privacy to help secure consumer's mailboxes
In 2023, Apple reinforced its strong stance on user privacy by introducing Link Tracking Protection in iOS 17 and macOS Sonoma. These protections prevent the use of tracking parameters in URLs, which are often used by marketers to track link clicks. While positive for consumers concerned about privacy, the changes pose a challenge for email marketers seeking to measure the effectiveness of their campaigns.
Learn more: Link Tracking Protection in iOS 17 & macOS Sonoma: Important changes for marketers
The History of Email Spam
From Gary Thuerk’s first and now-infamous unsolicited email to the sophisticated digital landscape of today, the history of email spam underscores both the power and vulnerability of this communication medium. Email’s ability to connect people globally is remarkable; yet, this very strength has been continuously exploited by bad actors. The annals of email are littered with the damage wrought by computer viruses, worms, ransomware, phishing scams, and various other exploits.
In response, a robust framework of countermeasures has evolved, spanning both legislative and technological realms. Legislative bodies worldwide have enacted crucial regulations, such as GDPR and CCPA, to govern email communication, protect data privacy, and safeguard consumer information. Technological advancements, from SPF, DKIM, and DMARC to the implementation of neural networks and deep learning, now serve as the frontline defenses against these persistent threats.
The fight against spam remains a central theme in the history of email marketing—a continuous cycle of measures and countermeasures to combat malicious activities. Modern innovations, including AI-driven anomaly detection systems, Zero Trust Architecture, and privacy-focused updates like Apple’s Mail Privacy Protection and Link Tracking Protection, indicate that this battle is far from over. As technology advances, so too must our defenses, ensuring that email remains a secure and trusted channel for communication.