Spam traps are the deliverability equivalent of stepping on a landmine. They look like normal email addresses, accept mail normally, and produce no bounce. But when you send to one, you've tagged yourself as a sender who didn't obtain consent — and the operators of the trap (Spamhaus, Validity, major ISPs) act on that signal hard. A single hit on a pristine trap can put your domain on the Spamhaus DBL within hours.
Three trap types: pristine (never used, planted by trap operators), recycled (formerly real addresses now repurposed as traps), and typo (common typos of real addresses). Get them through scraping, purchasing lists, and not maintaining the list. Verifiers catch some but not all. Sunset policy is the only complete defence.
Pristine traps
Addresses created by trap operators (Spamhaus, Validity, Microsoft, Google, others) for the explicit purpose of catching senders who don't obtain consent. They:
- Are planted in places only scrapers would find them — buried in HTML comments, in obscure pages, in semi-public databases.
- Have never opted in to anything.
- Have never sent any mail (so they don't appear in any legitimate exchange).
- Hit you the first time you send — they don't need repeat offences to flag you.
Pristine traps are the deadliest. A single hit signals to the trap operator that you scraped or bought addresses, and listings on Spamhaus, URIBL or DBL can follow within minutes. Once listed, your domain's sends to participating providers (which is most of them) are routed to spam or rejected outright.
Recycled traps
Addresses that were once real, used by real people, and have been abandoned. After a long inactivity period (typically 6-24 months), the ISP may convert them to spam traps. Mechanism:
- Original user stops using the address.
- ISP eventually disables the mailbox; mail bounces with User unknown for some period.
- ISP re-enables the address as a trap. Now it accepts mail again — but every send signals that the sender hasn't maintained their list.
Recycled traps are common at consumer providers (Yahoo, Hotmail/Outlook). They catch senders who buy old lists, fail to act on bounces, or never sunset inactive contacts.
Typo traps
Common typos of major mail providers, registered as catch-alls by trap operators:
gmial.cominstead of gmail.comyaho.cominstead of yahoo.comhotmial.cominstead of hotmail.comaol.coinstead of aol.com- And dozens more mis-spelt provider domains
Real users type these wrong all the time on signup forms. Without real-time validation, the wrong addresses enter your list. The trap operators harvest them and use them to identify bulk senders who didn't verify input.
Typo traps are the easiest to defend against — real-time signup validation catches them immediately. Yet most signup forms still accept them silently.
Who runs the traps
- Spamhaus. Best-known. Their listings (SBL, DBL, XBL) are referenced by most enterprise mail systems. Pristine trap hits feed directly into DBL listings.
- Validity (formerly Return Path). Operates Sender Score and proprietary trap networks. Used heavily by Microsoft and enterprise ESPs.
- SURBL / URIBL. URL-focused but include sender-tracking components.
- ISPs themselves. Microsoft (Outlook.com), Google, Yahoo, Comcast, Mail.ru, Yandex all run internal trap networks. Their listings are private but affect placement on their properties.
- Major ESPs. Many ESPs maintain seed-trap networks internally to protect their shared IP reputation. Hitting their internal traps gets your account suspended quickly.
How traps end up on your list
- Scraping. Web-scraping email addresses from public pages, LinkedIn, GitHub, etc. Pristine traps are heavily planted in scrape targets.
- Purchased lists. The list seller bought from someone who scraped, who bought from someone who got hold of it via breach. Typical purchased B2C list contains 5-15% trap density.
- Old / inherited lists. Acquiring a list from a previous campaign, employee, or merger without re-validation. Recycled traps accumulate over time in such lists.
- Form submissions without validation. Typo traps enter this way. Also bots filling forms with random addresses.
- List rentals / co-marketing. Renting access to someone else's list is technically distinct from buying, but the trap density problem is identical.
A single Spamhaus DBL listing requires you to: stop sending, identify the source of the hit, clean the list, request delisting (Spamhaus may take days), then resume warming. The domain reputation hit can take weeks more to recover. The total cost of one trap hit on a previously-clean domain runs 1-3 months of normal sending volume.
Why verification doesn't catch all traps
Verifiers maintain databases of known traps. They're useful, but limited:
- Pristine traps are by design known only to the operator and to the spammers who've already hit them. Verifier databases capture some but not all.
- Recycled traps look indistinguishable from real-but-inactive addresses to an SMTP probe. Verifier may flag as "risky" but won't definitively detect.
- Typo traps are usually catch-all domains — every probe succeeds. Detection requires recognising the typo pattern, which the better verifiers do, but not all.
Run verification, but don't treat it as complete protection.
Sunset policy is the real defence
Recycled traps come from inactive addresses that you've kept on your list past their useful life. A 90-180 day sunset policy on inactive contacts removes them before they get repurposed as traps. This is the only complete defence against the recycled-trap class.
For pristine and typo traps, the only complete defence is to not let them onto your list in the first place: never scrape, never purchase, validate every signup in real-time.
Signs you've hit traps
- Sudden drop in inbox placement at one or more major providers.
- Spamhaus DBL listing on your sending domain — check at spamhaus.org/dbl.
- Bounce messages from recipients citing "policy rejection" or referencing blocklist URLs.
- ESP account suspended or warned.
- Sender Score (Validity) drops sharply — often before any public listing.
- Postmaster Tools at Gmail shows IP/domain reputation collapsing.
Recovery after a trap hit
- Stop sending immediately. Don't add fuel to the fire.
- Identify the source — recently added contacts, recently imported list, scraping batch. Quarantine that source.
- Run the entire list through verification. Suppress all flagged.
- Apply aggressive sunset (60-90 days inactivity). Suppress all unengaged.
- If listed on Spamhaus or other public blocklist, request delisting only after cleanup is complete.
- Restart with low volume, engaged-only segments. Re-warm the domain over 4-8 weeks.
- Consider switching IPs (or sending domain) if reputation damage is too severe to recover quickly.
Practical anti-trap rules
- Never scrape addresses. Ever.
- Never purchase lists. Ever.
- Real-time validation on every signup form.
- Confirmed opt-in (double opt-in) where business model allows.
- 90-180 day sunset on inactive contacts.
- Quarterly bulk validation.
- Monitor blocklist status weekly.
- Watch Postmaster Tools daily during high-volume periods.