1. A method, comprising: receiving an email message that is assumed to be non-spam; determining an IP address associated with a sender of the email message; determining a domain from which the email message appears to have been sent; automatically determining an IP/domain spam score; and automatically associating the IP/domain spam score with a combination of the IP address and the domain.