Several embodiments, among others, provided in the present disclosure provide for tokenizing portions of an email message, which previously were not tokenized. The tokenizing of these portions generates tokens that are representative of these portions. The generated tokens are used to determine whether or not the email message is spam. In some embodiments, the tokenized portions may include attachments in email messages. In other embodiments, the tokenized portions may include a simple mail transfer protocol (SMTP) email address and a domain name corresponding to the SMTP email address.