The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA.sub.--0 and a receiving message transfer agent MTA.sub.--1; catches MTA.sub.--0's IP address IP.sub.--0, MTA.sub.--0's declared domain D.sub.--0, from-address A.sub.--0; to-address A.sub.--1, and the body of the message; and uses this source and content information to test for unsolicited messages. It interrupts the conversation when MTA.sub.--0 sends a . end-of-message indicator and uses the various test results to decide if the message is suspected of being unsolicited. If the message is suspected of being unsolicited then it logs the rejected message and sends an error reply to MTA.sub.--0 which forces MTA.sub.--0 to send a QUIT command before the body of the message is transmitted; else it logs the allowed message and releases the intercepted RCPT command which allows the conversation between MTA.sub.--0 and MTA.sub.--1 to proceed.