Transport-level Filtering
Transport-level filtering is accomplished with what is known as Routing Black Lists. These lists are maintained by different organizations. One of the oldest and most respected of these organizations is MAPS (short for "Mail Abuse Prevention System"). They maintain lists of IP addresses used by spammers to send out spam. By subscribing to the MAPS service, a mail server can make decisions on-the-fly about which computers are likely to be sending spam. This enables the mail server to refuse mail from highly-suspect addresses. The IP address of the sender is known as soon as a connection is made, allowing the server to refuse the mail before it is transferred. This proactive refusal saves bandwidth and disk by suppressing the transfer of the email data. MAPS is a service recommended by Sidra Technologies. More information about MAPS is available at the MAPS website
Rule Based Content Filtering
Rule-based content filtering inspects the content of the incoming email to see if it matches certain keywords or phrases commonly found in spam. Additional checks are made to see if parts of the headers (the routing and book-keeping portion of an email, usually helpfully hidden from the user by their email program) are consistent and don't contain forged information. All of these checks are weighted and finally a score for the email is computed. This score is then used to determine the fate of the email based upon user or site-wide defined preferences. A good example of this technology (and perhaps the most widely used) is SpamAssassin, an Open Source product available for free.