Who pays for the cost of spam and email delivery?
Published 25 Apr 2025
Updated 18 Oct 2026
13 min read
Summarize with
Updated on 18 Oct 2026: We clarified who pays for spam and email delivery, including retry costs and the economics that keep spam profitable.
The sender pays to originate and transmit email, including connection attempts and retries through the SMTP handoff. The receiver starts paying as soon as its infrastructure handles the connection, then pays for its own filtering, authentication, storage, abuse handling, user interface, and support. That receiver-pays model makes spam economically different from postal mail. With postal mail, the sender pays postage and freight before the message reaches the recipient. With email, the sender often pays a low marginal sending cost, while every receiving network pays to assess and handle the traffic.
Spam creates a negative externality: the sender imposes costs on people and networks that did not agree to receive the mail. The person sending mail chooses the volume, but the mailbox provider and recipient network carry much of the operating cost. That includes CPU time, DNS lookups, storage, quarantine handling, complaint processing, reputation work, security review, and the human time spent deleting, reporting, or investigating bad mail.
- Sender: Pays for sending infrastructure, list acquisition, creative work, and connection attempts with retries through the SMTP handoff.
- Receiver: Pays for connection handling, filtering, storage, abuse desk work, and mailbox protection.
- User: Pays with attention, time, subscription fees, advertising exposure, or workplace support load.
- Legitimate sender: Pays extra when spam forces receivers to tighten filtering and reputation thresholds.
Who pays when an email is accepted or rejected?
Short answer
The sender pays for outbound mail infrastructure and transport. The receiving organization pays to process the connection and message, even when it rejects the attempt during SMTP. For accepted mail, the receiver also pays for anti-abuse processing, authentication evaluation, spam scoring, mailbox storage, quarantine, user complaints, and long-term reputation management.
There is no universal per-message fee paid by the sender to the receiving network. Each side funds its own infrastructure. That split lets a sender generate large volumes while receiving networks pay to defend themselves separately.
Under RFC 5321, a final 250 response after the message data transfers responsibility for the message to the receiving server. It does not guarantee inbox placement. Receiver costs begin earlier, and a server can reject an attempt before receiving the message body. Early rejection avoids some processing and storage costs, but connection handling still costs money.
A temporary 4xx SMTP reply leaves the sending server responsible for queueing the message and retrying later, so both sides incur more work on subsequent attempts. A permanent 5xx reply means the sender should not automatically repeat the same unchanged request. A provider can charge for sending attempts even when mail never reaches an inbox, depending on its billing terms.
Why email is different from postal mail
Postal mail has a high per-piece cost and the sender pays most of it before delivery. That cost limits volume. Email has a very low per-message cost and no universal postage model. The sender can buy or rent sending capacity, but the recipient network still has to process each connection, each message, and each mailbox outcome.
Postal mail
- Payment: The sender pays postage before the item enters the delivery network.
- Volume control: High unit cost discourages low-value mass sending.
- Recipient cost: The recipient still spends time, but not server or filtering budget.
Email
- Payment: The sender pays to reach the receiving server, while the receiver pays to evaluate the attempt and handle the result.
- Volume control: Low unit cost allows millions of attempts when lists and systems are cheap.
- Recipient cost: Mailbox providers pay for filtering, storage, complaints, and abuse response.
This split does not mean the sender pays nothing. Responsible senders pay for consent management, clean data, authentication, monitoring, bounce handling, security review, and support. The issue is that the sender's marginal cost does not rise in proportion to the receiver's defensive work.
Email delivery cost flow from sender system through SMTP to receiver filtering and user impact.
Why spam remains profitable for senders
The 2012 paper The Economics of Spam describes merchants paying for spam distribution and botnet operators renting access to compromised computers. Spam distributors can earn campaign fees or sales commissions without owning the advertised business. A very low conversion rate is enough when the revenue exceeds the sender's own costs.
Compromised accounts and botnets, which are networks of compromised devices, shift part of the sending bill to their owners. Those owners pay for bandwidth and computing resources, then face cleanup and reputation repair. The spammer does not pay the full cost imposed on receiving networks or recipients, so blocking most attempts does not automatically make the remaining traffic unprofitable.
Why email postage has not replaced filtering
A recurring proposal is to make senders attach a micropayment or computational proof-of-work token to each message. The intent is to make marginal cost rise with volume. SMTP has no universal payment authority or mandatory token field, however, so non-participating mail would still need to be classified by receiving systems. For illustration, US$0.01 per message would add US$10,000 to one million messages before ordinary sending costs. That calculation does not establish how much spam a fee would prevent.
- Wanted bulk mail: Even a tiny per-message fee compounds for newsletters, receipts, notifications, and community lists.
- Compromised resources: Abusers can shift computing and bandwidth costs to hijacked accounts or devices.
- Receiver overhead: Providers still have to validate tokens, maintain exceptions, and detect abusive mail with valid payment.
- Interoperability: A new mechanism has to work across independent domains, jurisdictions, clients, and older mail software. Payment setup must also accommodate password resets and account verification emails.
Email therefore uses indirect economic controls instead of universal postage. Domain and IP reputation, authentication, rate limits, rejections, and blocklists can make abusive infrastructure expensive to replace. Those controls move some cost back to senders, but they do not remove the receiver's need to filter every stream.
What receivers pay before and after acceptance
The receiving side starts work when a connection arrives. It can apply rate controls, reputation checks, DNS lookups, and authentication before returning a final SMTP response. Accepted messages then create continuing costs across the mailbox platform. A large mailbox provider has to make these decisions at scale while avoiding false positives that block wanted mail.
|
|
|
|---|---|---|
Connection and authentication | Receiver | Handles sessions, DNS lookups, SPF, DKIM, DMARC, and rate controls. |
Filtering | Receiver | Scores each message for acceptance and inbox placement. |
Storage | Receiver | Keeps spam folders, quarantine, indexes, and logs. |
Complaints | Receiver | Feeds reputation systems and abuse review. |
False positives | Both | Creates support cost for wanted mail. |
Abuse desk | Receiver | Handles reports, takedowns, and policy enforcement. |
Receiver-side costs across SMTP processing and mailbox handling.
Users pay too, even when they use a free mailbox. The cost can sit inside advertising, a paid workplace account, a consumer subscription, slower support, or lost time. Even small handling costs add up across large recipient groups; a successful scam or account compromise creates much larger losses.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
For a sender, the practical move is to test messages before they create avoidable receiver-side work. An email tester run can expose authentication failures and configuration gaps before a campaign reaches recipients. It does not guarantee inbox placement or measure how much a receiver spends processing the mail.
What legitimate senders pay for
Legitimate senders pay twice. First, they pay normal sending costs: platform fees, data quality work, templates, operations, and compliance. Second, they pay the cost of proving they are not part of the abuse problem. That second cost is mostly technical and reputational.
This is where authentication and monitoring matter. DMARC, SPF, and DKIM help receivers distinguish authorized mail from forged mail. DMARC monitoring shows sending IPs and authentication results reported by participating receivers. Domain owners still need to distinguish approved sources, configuration failures, and suspected spoofing; reports do not show every message or prove that an unfamiliar source is malicious.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
Suped, our DMARC reporting and email authentication platform, groups aggregate reports by sending source. Teams can review failing sources, check whether each is approved, and use the reported SPF and DKIM results to prioritize configuration fixes. For teams managing multiple domains or MSP clients, this gives the investigation a consistent starting point without reading each XML report manually.
Best practice
- Authenticate: Configure SPF and DKIM for approved sources. DMARC passes when either method passes and its authenticated domain meets the matching rules for the visible From domain.
- Monitor: Review aggregate reports so failing sources do not quietly become delivery problems.
- Stage policy: Assess forwarding and mailing list traffic before tightening DMARC policy, especially for domains used for general correspondence.
- Alert early: Treat sudden authentication failure as an operational incident, not a reporting detail.
How authentication changes the cost equation
Authentication does not remove the receiver's cost. It gives receivers verifiable domain identity signals for policy and reputation decisions, but also requires DNS lookups and cryptographic checks. Authentication alone does not prove that a message is wanted or safe: spam sent through a compromised authorized account can still pass.
Example DMARC record for monitoring before enforcementdns
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
That record requests aggregate reports without requesting quarantine or rejection for DMARC failures. RFC 9989 defines DMARC, RFC 9990 defines aggregate reporting, and RFC 9991 defines failure reporting. RFC 9989 removed pct and introduced t=y for testing; it requests one policy level less strict, so reject becomes quarantine and quarantine becomes none. It is not percentage-based enforcement. Before tightening policy, assess approved sources and indirect mail such as forwarding and mailing lists.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
A domain health check checks whether published DNS records support that plan. DNS checks must be combined with message-level authentication results and report review before deciding on an enforcement policy.
Blocklists move costs back to senders
Blocklists and blacklists are one way the mail ecosystem pushes cost back toward abusive senders. If a sender's IP, domain, or infrastructure shows enough bad behavior, receivers can reject, throttle, quarantine, or scrutinize that mail earlier in the delivery path. Each receiver chooses which blocklists it uses, so a listing does not mean every provider will block the mail.
For legitimate senders, the problem is spillover. Shared infrastructure, compromised accounts, poor list sourcing, or a sudden spike in complaints can create blocklist (blacklist) exposure that costs money to diagnose and repair. Blocklist monitoring can alert teams to a listing on the lists being monitored; it does not show every receiver's internal reputation decisions.
Cost warning
A blocklist event creates investigation costs and lost revenue when wanted mail is blocked. Identify the sending source and affected mail streams, correct the cause, and then follow the list operator's removal process where one is available.
Suped's blocklist monitoring and DMARC reports give teams separate evidence to compare during an incident. Check whether a listed IP belongs to an approved sending source, review authentication failures, and involve the team responsible for that system. A listing and an authentication failure are different signals; one does not establish the cause of the other.
Legal compliance is not the same as low cost
A message can satisfy a legal checklist and still impose avoidable cost on receivers. The FTC CAN-SPAM guide covers U.S. commercial email requirements such as accurate header information, non-deceptive subject lines, postal address disclosure, and clear opt-out handling. Senders must honor opt-out requests within 10 business days. Those requirements matter, but they do not prove that a recipient wanted the mail.
Consent quality is a cost issue. Purchased, appended, scraped, or loosely permissioned lists increase complaints and filtering pressure. A sender might pay for the list, but the receiver pays for the unwanted messages that arrive. Over time, the sender also pays through lower reputation, more bounces, blocked campaigns, and support escalations.
Low-quality list economics
- Acquisition: The sender pays for cheap reach and accepts weak consent signals.
- Receiver load: Mailbox systems process more complaints, spam placement, and filtering decisions.
- Long-term cost: Reputation drops and wanted mail becomes harder to deliver.
Permission-based economics
- Acquisition: The sender pays more for clear consent and cleaner data.
- Receiver load: Mailbox systems see steadier engagement and fewer user complaints.
- Long-term cost: Delivery operations are more predictable and less dependent on firefighting.
Which email delivery costs can you control?
For a normal business, the useful question is not only who pays. It is which costs you control. You cannot control every receiving filter, but you can control consent, authentication, sending consistency, complaint handling, and how quickly you detect DNS or reputation drift.
Email cost control priorities
A practical way to decide where to spend operational attention first.
High control
Fix first
Authentication, list source, unsubscribe handling, and sender inventory.
Medium control
Tune often
Volume pacing, content patterns, segmentation, and complaint reduction.
Low control
Monitor
Receiver-specific filtering, individual user behavior, and inherited platform reputation.
Spam reports are one of the fastest ways for receiver-side cost to become sender-side cost. Complaints train filters, damage reputation, and create evidence that the mail is unwanted. The details behind spam reports matter because a low absolute complaint count can still be a serious signal when volume is small or engagement is weak.
High sending frequency creates a similar cost shift. If a sender increases volume faster than engagement supports, complaints can increase and sending patterns can trigger rate limits. The sender then pays through throttling, spam placement, and lower conversion. The mechanics behind high sending frequency are why volume planning belongs in the same conversation as authentication.
- Inventory: List every system that sends mail for your domain, including low-volume tools.
- Authenticate: Configure SPF and DKIM for approved systems and verify that messages pass DMARC with the required domain match.
- Measure: Track failures, complaints, bounces, spam placement, and blocklist events.
- Reduce: Remove weak sources, bad addresses, risky acquisition paths, and broken DNS records.
- Enforce: Choose a DMARC policy after testing approved sources and indirect mail flows. Assess mailing list use before considering rejection for general correspondence domains.
Views from the trenches
Best practices
Treat receiver filtering cost as real infrastructure cost, not only a spam-folder detail.
Validate consent claims with evidence before using appended or third-party address data.
Use authentication reports to find broken sources before receivers tighten filtering.
Common pitfalls
Assuming legal language on a vendor page proves that recipients knowingly opted in.
Counting email as free while ignoring storage, filtering, support, and user time.
Waiting for a blocklist or blacklist event before mapping active sending sources.
Expert tips
Budget for receiver checks during SMTP as well as storage and review after acceptance.
Audit suspicious list sources with seed addresses and history checks before sending.
Price reputation risk like a business cost, because lost inbox access affects revenue.
Marketer view
Marketer from Email Geeks says recipient systems pay for server resources, network use, storage, and the time users spend sorting unwanted mail.
2020-07-31 - Email Geeks
Marketer view
Marketer from Email Geeks says true spam often uses stolen or very cheap resources, so the sender's cost stays low while receiver costs multiply.
2020-07-31 - Email Geeks
How to reduce the cost you control
Use the costs you can measure to decide what to fix: sending charges, queue and retry volume, support hours, and revenue lost when wanted messages fail to arrive. Track these alongside authentication failures and complaints rather than treating every delivered-message count as successful inbox delivery.
In Suped, review DMARC results by sending source after DNS or platform changes and investigate new failures. Compare any blocklist alerts with the affected sending IPs, then confirm that fixes hold in later reports. Use campaign and support records to measure business impact, since DMARC reports do not measure revenue or user attention.
