A spam trap is an email address that exists only to catch senders with poor list practices: no real person uses it or would ever sign up with it, so any email it receives shows the sender is mailing addresses they should not have. Mailbox providers and blocklist operators run them and use the hits to judge your reputation.
How spam traps work
There are three main kinds:
- Pristine traps Also called honeypot addresses, have never belonged to anyone. They are created and placed where address harvesters will find them, for example hidden in web pages. The only way to reach one is to scrape addresses or buy a list that was built that way.
- Recycled traps were once real. After a mailbox has been abandoned and has bounced for a long period, a provider may reactivate it as a trap. Senders who never clean their lists hit these.
- Typo traps sit on misspelt domains, catching common slips when people type gmail.com or hotmail.co.uk. They catch senders who accept addresses without checking or confirming them.
Traps never open, click or complain, so you cannot spot them by behaviour, and their owners never publish them. The only reliable defence is how you collect and maintain addresses.
Why it matters
A pristine trap hit is serious, because it tells the provider you are mailing addresses that no person gave you. Blocklist operators such as Spamhaus use traps when deciding listings, and a listing on a widely used block list can mean your mail is refused by many receiving servers at once, including business recipients whose security gateways check those lists.
Recycled and typo hits are treated less harshly, but they add up. They point to an old or careless list, and they wear down your sender reputation over time.
For UK businesses, trap hits often expose a compliance gap as well. A bought or scraped list almost always fails PECR’s consent requirement for emailing individuals, and the ICO’s guidance makes clear that consent does not last forever: how long it stays valid depends on the context and on what people would reasonably expect.
Common mistakes
- Buying or renting a list. The most common route to pristine traps, and in the UK almost never compatible with PECR for emails to individuals.
- Reviving a dormant list. An old export from a previous system, mailed after years of silence, is exactly where recycled traps sit.
- Not validating sign-ups. Without typo checks or confirmation, typo traps flow straight in.
- Believing a “trap removal” service solves it. No tool can identify every trap. Removing a few suspect addresses does not fix the habit that let them in.
How to act on it
Prevent rather than cure. Collect addresses only through your own sign-up forms, with bot protection and real-time validation, and use double opt-in for higher-risk sources such as competitions. Remove hard bounces at once, and apply a sunset policy so that long-inactive addresses stop receiving mail before they can turn into recycled traps.
If you suspect a trap problem, because a blocklist has listed you or your reputation has dropped suddenly, look at what changed: a new list source, an import, a re-engagement send to old contacts. Pause that source, send only to recently engaged subscribers, and check your blocklist status before building volume back up.
Working out where a list went wrong is part of the email work I do within digital marketing strategy engagements.