It depends on how SpamFilter is configured. If the blocked emails are to be quarantined, the SpamFilter must receive the complete email to store it in the database. For this reason, SpamFilter will give a 500 error code (and forcibly disconnect the sender afterwards just to make sure) after the content is received. The same applies if the Bayesian statistical filter is enabled, as all emails must be received and analyzed so that the statistical database can be updated in realtime.

Most filters have options to force the delete of an email, without storing it in the database. In this case, SpamFilter will usually send a 500 error code, followed again by a forced disconnect, after the RCPT TO command is received, before any email content is sent.

Furthermore, there's options to classify emails as spam, store it in the database, but output a 200 "OK" code to the sender to avoid NDR is needed.