the invention includes an anti - spam protection device installed on the same network as email servers that it protects , or on a separate network that is connected to the networks of protected email servers . inbound email connections route to the protection device , which evaluates each sending server by employing information from server attribute databases and other sources . the method uses a hierarchical score tree , which is comprised of nodes in a dependent , hierarchical structure . each node features a score condition triggered by server attribute information , and a score that contributes to the blocking score . a connection evaluated to a blocking score above a threshold is terminated ; otherwise the sending server is allowed to deliver the email message through the protection device . the protection device optionally allows the use of white lists or black lists to allow or deny certain sending email servers .