The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA.sub.--0 and a receiving message transfer agent MTA.sub.--1; catches MTA.sub.--0's IP address IP.sub.--0, MTA.sub.--0's declared domain D.sub.--0, from-address A.sub.--0; and to-address A.sub.--1; and uses this source and content based information to test for unsolicited messages. It interrupts the conversation when MTA.sub.--0 sends a RCPT command and uses the various test results to decide if the message is suspected of being unsolicited.If the message is suspected of being unsolicited and to-address is not in the save_spam database then the spam blocker logs the rejected message, sends an error reply to MTA.sub.--0 which forces MTA.sub.--0 to terminate the connection before the body of the message is transmitted. If the message is suspected of being unsolicited and to-address is in the save_spam database then the spam blocker logs the rejected message, substitutes a diversion address A'.sub.--1 for the to-address A.sub.--1 in the RCPT command, and send the modified RCPT command to MTA.sub.--1 and allows the conversation to continue. If the message is not suspected of being unsolicited then the spam blocker logs the allowed message, releases the intercepted RCPT command which allows the conversation to continue.