1. A method, comprising: receiving an email message that is assumed to be non-spam; determining an IP address associated with a sender of the email message; generating an IP address set comprising a combination of portions of the IP address; determining a domain from which the email message appears to have been sent; generating a domain address set comprising a combination of portions of the domain name; generating an IP/domain set by computing a cross-product of the IP address set and the domain set, the IP/domain set comprising elements of the cross-product; determining an IP/domain spam score that represents a likelihood that an email message received from the IP address and the domain is spam; associating the IP/domain spam score with the IP/domain set based at least in part on the elements of the cross-product; storing the IP/domain spam score in association with the IP/domain set in a spam score data repository; identifying, in the spam score data repository, a previously generated spam score associated with the domain; determining a message spam score that is based on the email message assumed to be non-spam; combining the message spam score with the previously generated spam score to generate the IP/domain spam score; and determining whether to treat the email message as spam based on the message spam score.