A spam trap, sometimes called a honeypot address, is an email address that real people do not use but that mailbox providers and blocklist operators watch. It exists to catch senders who collect addresses carelessly or who never clean their lists. If you send to one, you have shown that your list contains addresses that nobody gave you permission to email, or that you have not maintained it. The result can be blocklisting, lower inbox placement and, at worst, blocked sending. This guide explains what spam traps are, the main types, how they get onto lists, what a hit looks like, and how to reduce the risk.
What a spam trap (honeypot) is
In email, the word "honeypot" usually means a spam trap: an address set up to receive mail that no legitimate sender should send to. Because the address never subscribed to anything, any message that arrives is, by definition, unwanted. Mailbox providers and anti-spam organisations use these addresses as a measuring tool. They do not read the mail. They record who sent it and how often.
The same word has another meaning in network security, where a honeypot is a decoy system that attracts attackers. This article is about the email meaning. The two share an idea: a decoy that real users never touch, so that any contact tells you something.
The main types of spam traps
| Type | What it is | How it usually ends up on a list |
|---|---|---|
| Pristine trap | An address created only to catch senders. It was never used by a person and never signed up anywhere | Scraped from web pages, bought or rented lists, or harvested by bots |
| Recycled trap | An address that once belonged to a real person, was abandoned, and was later turned into a trap | Old lists that were never cleaned, or contacts who stopped engaging long ago |
| Typo trap | An address at a misspelled domain, such as a common mistake in a domain name | Sign-up form typos that were never caught or corrected |
Providers do not publish how they run their traps, and the details change, so treat the table as a general guide. The practical point is the same for all three types: each reaches your list because of how the address was collected or how long it sat unused.
How spam traps get onto a list
- Bought, rented or scraped lists. The fastest route to pristine traps. If nobody gave you the address, you cannot know what it is.
- Old, unengaged contacts. An address that has not opened or clicked in a long time may have been abandoned and later recycled.
- Typos at sign-up. Without confirmation or checking, a mistyped domain goes straight onto your list.
- Imports from other tools. Merging lists from events, partners or old systems without checking consent and age.
- Trading or sharing contacts. Each source adds addresses you did not collect yourself.
What a spam trap hit looks like
You will not get a notice that says "you hit a trap". The signs are indirect: a sudden fall in inbox placement at one provider, new blocklist entries, a rise in blocks or deferrals, or a message from a blocklist operator or a mailbox provider. Some blocklists list an IP address after traps receive mail from it. Our guide to blocklist removal explains how to respond to a listing, and the deliverability incident runbook covers a sudden drop in delivery. You can look for listings with our blacklist check.
Be careful with conclusions. A drop in delivery has many possible causes, including authentication failures, content, complaints and volume spikes. A spam trap is only one explanation. Check the basics first, using the spam troubleshooting checklist.
Why you cannot simply remove the traps
Trap addresses are kept secret on purpose. If lists of them were public, spammers would remove them and carry on. No honest vendor can hand you a list of the traps in your database, and no tool can reliably identify a pristine trap. Be sceptical of any service that claims to remove all spam traps from a list. What you can do is reduce how likely they are to be there in the first place.
How to reduce the risk
- Collect addresses with permission only. Never buy, rent or scrape. See consent records and unsubscribe and the overview of marketing email laws.
- Use confirmed opt-in where the risk is high. A confirmation click proves that a real person controls the address and that it was typed correctly.
- Check addresses at the point of capture. Syntax, domain and mail server checks catch typos before they reach your list. Our email validation returns a typo hint, such as a suggested fix to gmail.com, and the validation guide explains what these checks can and cannot show.
- Remove inactive contacts on a schedule. A sunset policy keeps old, abandoned addresses off your list. See list hygiene and sunset policies.
- Suppress hard bounces and complaints at once. See suppression list management.
- Be careful with imports. Ask where each list came from, when the consent was given, and what the engagement history is. Use a plan such as the one in importing a list with consent evidence.
A validator is not a trap detector. Address checks catch typos and dead domains. They cannot tell you that an address is a pristine trap, and a DNS-only check cannot confirm that a mailbox exists. Use validation to reduce risk, not to promise that a list is safe.
What to do if you think you hit a trap
- Stop sending to the affected segment and pause any campaigns that use the same list.
- Find out where the list came from. If any part of it was bought, rented, scraped or very old, stop using that part.
- Send only to recent, engaged contacts who gave clear consent, until delivery recovers.
- Check authentication and blocklists, and read any message you received from the provider or the blocklist operator.
- Fix the collection method, not just the list. Without that, the same problem returns.
Recovery takes time, and it depends on the provider. Keep volumes modest and pay attention to engagement while you rebuild. The complaint rate guide and deliverability metrics describe what to watch.
Spam traps and your sending reputation
Providers see more than a single send. They look at patterns over time: how many of your recipients bounce, complain, engage or never open, and whether you send to addresses that should not exist. A clean, engaged list sends a steady signal, and a sprawling, aged list sends a worrying one. Spam traps are one of the clearest examples, because they show that a sender is not taking care over who is on the list. If you operate a dedicated IP, these signals apply to that address alone, and the earlier you catch the cause, the less damage you carry forward. Our reputation monitoring page describes how we help you watch these signals.
Keep your list clean from the start Validate addresses when they are collected and keep an eye on reputation signals as you send. Start with the free email validator to check up to 100 addresses.
References and further reading
Frequently asked questions
What is a spam trap in email?
A spam trap is an email address that real people do not use but that mailbox providers and blocklist operators monitor. Mail sent to it shows that the sender collected addresses without permission or did not maintain the list.
What are the types of spam traps?
The common types are pristine traps, which were never used by a person, recycled traps, which belonged to a real person and were later turned into a trap, and typo traps, which sit on misspelled domains.
How do I know if I hit a spam trap?
There is usually no notice. The signs are indirect, such as a drop in inbox placement at one provider, new blocklist listings or a message from a blocklist operator. Other causes are common, so check authentication and content too.
Can I remove spam traps from my list?
Not by name. Trap addresses are kept secret, and no tool can reliably find them. You reduce the risk by collecting addresses with consent, confirming sign-ups, validating addresses and removing inactive contacts.
Does email validation catch spam traps?
It catches typos and dead domains, which helps. It cannot identify a pristine trap, and a DNS-only check cannot confirm that a mailbox exists, so validation lowers the risk without removing it.