In a method for blocking email spams, the header fields and the message body of a received email first are identified. Predefined patterns are identified by matching in the header fields and message body, wherein a data structure of characteristic information is created for each recognized pattern. The characteristic information then are analyzed by rule inference to determine whether the received email is a spam.