Spam traps: the two kinds and how they got on your list

A spam trap is an address that exists to catch senders. Nobody reads it, nobody signed it up for anything, and mail arriving at one is evidence about how you build your list.

Hitting one can get an IP or a domain listed quickly. Which kind you hit tells you what went wrong.

Pristine traps

Addresses created purely as traps and published where only automated collection would find them — in page source, in whois records, on pages no human visits.

They were never valid, never subscribed and never used. There is no legitimate route by which one reaches your list.

So hitting a pristine trap means one of three things: you bought or rented a list, something scraped addresses, or a form accepted an address without any confirmation that the person owned it.

These are the most damaging, because the conclusion is unambiguous.

Recycled traps

Addresses that were real, belonged to someone, went dormant, and after a long period of bouncing were reactivated by the provider as traps.

These are much easier to acquire innocently. An address collected legitimately five years ago, never cleaned, can become one. Hitting a recycled trap means your list has addresses you have not validated in a long time.

Less damning than a pristine hit, and still a listing.

You cannot see them

Traps do not bounce, complain or unsubscribe. They accept mail silently. There is no list to check against and anyone selling you one is selling you nothing.

You find out through the consequence: a sudden listing, or a provider blocking you, with no corresponding change in complaints.

Preventing pristine hits

Never buy, rent or scrape a list. There is no safe source.

Use confirmed opt-in where it matters — a subscription is only real once the address holder clicks a link. This also protects against someone entering an address that is not theirs.

Validate at capture. Syntax and domain checks stop typos; they do not stop a deliberately entered trap, which is what confirmation is for.

Preventing recycled hits

Suppress hard bounces immediately. A recycled trap bounces for a period before it is reactivated. A sender who stops at the first hard bounce never reaches the trap phase.

Remove long-term unengaged recipients. No click in twelve months is a defensible line. Note that opens are an unreliable criterion since Mail Privacy Protection — a proxied pre-fetch looks like engagement from an address nobody reads.

Re-permission rather than delete, if you must. One message asking dormant recipients to confirm, then remove everyone who does not. Accept that most will not.

If you have been hit

Stop sending to the affected segment. Work out how the address got in — the answer is almost always a specific acquisition source or a specific age of record. Remove everything from that source or that period, not just the suspected address, since you cannot see which one it was.

Then follow the delisting process, with an honest account of what you changed. Lists that read requests can tell the difference between a sender who fixed something and one who is waiting out the clock.