What is a spam trap?
Updated 24 September 2026 // by Mark Glazer // sourced to Spamhaus, M3AAWG and Google
- 7trap categories the operators describe
- 8.28%of 9,847,723 business domains cannot receive mail today
- 12 monthsminimum dormancy M3AAWG suggests before a recycled trap
- 0.10%Google's spam-rate line in Postmaster Tools
A spam trap is an email address maintained by a mailbox provider, security vendor or blocklist operator for one purpose: to identify senders whose list practice puts mail where it was never requested. The address never opts into anything, so any message it receives is evidence. Hitting traps damages sender reputation and can put your domains and IPs on blocklists. The operators describe seven categories of trap; recycled traps are dead addresses that hard-bounce, often for 12 months or more, before being turned back on, and in ReplyLead's census 8.28% of 9,847,723 business domains already cannot receive mail, which is the dead-domain state that dead-domain traps are drawn from.
Two facts from the people who run them shape everything below. Spamhaus: "Spamtraps are never revealed by their owners." M3AAWG: traps "are designed to be indistinguishable from other email addresses." So no product can list them for you, and the defence is how a list is built and maintained, not a clean-up afterwards. This page gives the trap types as their operators describe them, what those operators and Google ask senders to do, and what we can and cannot measure about it ourselves.
Trap types // What operators require // What we can measure // Score your exposure // Sources
The kinds of trap, as their operators describe them
Most explanations reduce traps to three kinds. The operators publish a longer list, and the distinctions matter because each kind convicts a different practice. The definitions below are quoted or closely paraphrased from Spamhaus's 2022 spamtrap guide and M3AAWG's 2023 document for senders; the sources are linked at the end of the page.
| Type | What it is | What a hit indicates | Source |
|---|---|---|---|
| Pristine (classic) trap | "email addresses never given to a live user or exposed on a website but have started receiving email anyway"; M3AAWG: "an address that has never been active for an email user before its deployment as a spam trap" | Harvesting, address-space probing or dictionary attacks; M3AAWG: "may be a strong indicator of the presence of purchased lists" | Spamhaus, M3AAWG |
| Seeded trap | "email addresses that trap owners create and deliberately scatter - seeding around various places online" | Scraping of the places where the bait was planted | Spamhaus |
| Recycled (dead address) trap | "once-valid email addresses that ISPs have turned off. All mail to these addresses is rejected with a hard bounce for a period of time, often 12 months or more"; then "silently turned back on in the form of spamtraps". M3AAWG "suggests 12 months as a minimum" | Ignored hard bounces or very old data; M3AAWG: "poor list management (or an ancient list), a lack of correct bounce processing, or both" | Spamhaus, M3AAWG |
| Dead domain trap | "Trap owners purchase expired domains and collect mail that comes into them" | Data old enough to predate the domain's death, or no domain-level checking | Spamhaus |
| Typo domain trap | "traps at domains that are similar to common domains: yaaho.com or ynail.com, homail.com"; M3AAWG: "user@gmial.com, user@notmail.com" | Addresses never checked, often pattern-guessed; Spamhaus notes these "are not 'pure' spam traps" and can carry real mail | Spamhaus, M3AAWG |
| Live trap | "email addresses belonging to a real user. Owners use them for real mail, but they use the unsolicited mail coming into those addresses to make blocking decisions" | Sending to people who did not ask; indistinguishable from an ordinary prospect | Spamhaus |
| Domain registration address | Addresses "published in whois records, are frequently harvested and mailed" | Harvesting of registration data | Spamhaus |
Two of these kinds are invisible to any check a sender can run. A pristine trap is a working mailbox, so it verifies as deliverable; a live trap is a real person's mailbox. That is the mechanical reason the operators say traps cannot be cleaned out, only avoided at the source.
How traps get into a cold email list
Nobody adds a trap deliberately; they arrive with the sourcing shortcuts. Purchased bulk lists are the classic carrier. Spamhaus's marketing FAQ puts it without qualification: "Inevitably, purchased lists contain spamtraps or generate abuse complaints and bounces, and then the buyers find themselves blocklisted for spamming." Scraped lists inherit whatever bait was planted where the scraper looked. Old exports recycled from a previous company or campaign carry addresses that have since died and been reborn as traps. Pattern-guessing addresses from names without live verification manufactures typo-class risk directly. This is one reason list building is a process question rather than a shopping question.
What the trap operators and mailbox providers ask senders to do
Rather than paraphrase, here is what the three most relevant published sources say, and what each means for a B2B list. Quotations are verbatim.
| Source | What it says | What it means for a B2B list |
|---|---|---|
| Spamhaus, spamtrap guide (2022) | "We strongly urge people to view spamtraps as proof of a data collection or hygiene issue and not be misled into conducting a hunt for spamtraps. Attempting to locate and remove traps only treats the symptom and not the underlying problem." | Fix the source that produced the hit; do not buy a "trap removal" pass. |
| Spamhaus, Marketing FAQs | "Never buy or rent email addresses from anyone." Its standard recommendation is "to only send mail to addresses that have gone through a confirmed opt-in process." | Purchased data is out. Cold outreach does not meet the confirmed-opt-in standard, so every other control has to be tighter, not looser. |
| M3AAWG, Help! I Hit a Spam Trap! (2023) | "Senders should consider implementing a policy for suppressing recipients who remain chronically unengaged or non-deliverable. This minimizes the possibility of future trap hits should those addresses be converted into recycled spam traps." If hits correlate with an acquisition method, "the acquisition method should be discontinued." | Permanent suppression of hard bounces and non-responders; treat a data source as a unit that can be switched off. |
| Google, Email sender guidelines | "Keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." "Don't purchase email addresses from other companies." "Don't send messages to people who didn't sign up to get messages from you." | Watch the Postmaster spam rate per sending domain; keep per-mailbox volume conservative so one complaint cannot move the rate. |
What we can and cannot measure
We cannot measure trap hits, and neither can any other sender. Operators do not publish their addresses or notify senders, so a trap hit is only ever visible through its consequences. Nothing on this page is a count of traps.
What we can measure is the population that recycled and dead-domain traps are made from: addresses and domains that have died. Two first-party reads describe it.
First-party evidence - the dead-address population, not trap hits
9,847,723 domains in our MX census; 8.28% cannot receive mail today
Spamhaus describes dead-domain traps as expired domains bought by trap owners and turned back on. Our census of 9,847,723 business domains measures how much of a B2B universe is already in that dead state.
Method and limits. Census: one representative MX lookup per domain over 9,847,723 distinct domains from our B2B contact data; a domain is counted as unable to receive mail only when it does not resolve, publishes a null MX (RFC 7505), or has neither an MX nor an address record; domains with an address record but no MX are counted as mail-capable under RFC 5321 implicit MX. The 0.67% figure is a single two-day read on one programme in August 2026, used as our planning number, not a market rate. Neither figure is a trap count; both describe the precursor population. Provider shares from the same census are on the email provider market-share page.
Two consequences follow for list handling. First, a domain can die between the day a list was built and the day it is sent to, which is why we verify immediately before sending rather than trusting a flag attached weeks earlier; the mechanics are on why verified email lists still bounce. Second, dead addresses that pass verification still exist at a low rate, so every hard bounce is suppressed permanently and never retried; that is the M3AAWG suppression policy above applied literally, and it is the one practice that cannot be skipped because recycled traps are built from exactly those addresses. Catch-all domains add a third case, addresses that cannot be confirmed either way, which is handled as its own segment on the catch-all email page.
What hitting one costs
A single trap hit is not a death sentence, but it always costs something. Spamhaus's marketing FAQ: "ISPs often block email that generates a lot of spam complaints, or that hit their traps, resulting in a loss of inbox delivery, reputation and revenue." M3AAWG describes the consequences for a sending platform as ranging from filtering or a lower delivery priority to being "blocklisted and their mail rejected across a broad swath of the internet." The visible symptoms are the generic ones - placement quietly degrading, more mail landing in spam, gateway rejections rising - which is exactly why traps are hard to diagnose from the outside: they look like every other reputation problem. What makes them distinctive is the cause recorded on the receiving side, which you never get to read.
Why you cannot reliably clean traps out
The uncomfortable fact: a pristine trap verifies as deliverable. It is a real, working mailbox that accepts mail; that is its job. Verification removes dead addresses, which protects you from recycled traps' precursor state, but it cannot flag a live mailbox as bait, and it cannot see a live trap at all. The honest defences are structural, and they are the ones the operators themselves list:
- Never send to purchased bulk lists. Spamhaus: "Never buy or rent email addresses from anyone." We treat this rule as absolute.
- Build lists from primary evidence - people demonstrably in the role at the company today - rather than from aged aggregate files. M3AAWG's remediation advice is to discontinue any acquisition method that correlates with hits.
- Verify live, immediately before sending, so recycled-trap precursors (dead addresses) are caught while they are still catchable.
- Honour every bounce, permanently. Recycled traps are built from addresses that kept receiving mail after they hard-bounced; see hard bounce vs soft bounce for what to suppress.
- Watch recency. Data about who works where decays continuously; the older the row, the higher the odds its address or domain has died since.
- Keep per-mailbox volume conservative. A low daily volume per mailbox keeps one complaint or one hit from moving a domain's reputation.
Score your list's trap exposure
Six questions about how the list was built, mapped to the trap taxonomy above. The result is not a number pretending to be a measurement - traps are invisible from the sending side - but it tells you which of the three trap kinds your current practice exposes you to, and which structural defence closes each gap. Runs in your browser; nothing is sent anywhere.
Answer the six questions above to see which trap kinds your current practice exposes you to.
Traps, complaints and the reputation ledger
Traps sit alongside spam complaints and bounces in the ledger receiving providers keep on every sender. Google's published expectation, measured in Postmaster Tools, is a spam rate below 0.10%, never reaching 0.30%. Trap hits are a separate signal that operators use in filtering and blocklisting decisions without publishing thresholds; what they say publicly is that a hit is evidence of how the address was obtained. A programme that keeps per-mailbox volume conservative, verifies live and builds from primary evidence has little surface area for either; a programme built on bought data meets both, and usually learns it from a blocklist notice. How the receiving stack treats the rest of a message is covered on the deliverability page.
Most rejections are not traps. SMTP error codes shows which documented responses mean the recipient is gone and which point at the sender or the message.
When this page does not apply
- You send confirmed opt-in marketing email. The operator guidance quoted here is written for permission mail first; this page reads it for B2B cold email, which starts outside that model.
- You want a count of your own trap hits. No sender can measure that; operators never reveal trap addresses. The census figures describe dead domains, the precursor population, not traps.
- You need a blocklist removal procedure. Follow the listing operator's own delisting instructions; this page covers how traps enter a list and how to keep them out.
- You are reading this months from now. The census figures are from ReplyLead's B2B Email Infrastructure Index 2026 Q3 (published 20 September 2026), and the operator documents carry their publishers' dates; re-check them before relying on a threshold.
How this page was built and checked
Trap types, quotations and thresholds come from the operators' own published documents (Spamhaus 2022, M3AAWG 2023, Google's sender guidelines), linked with check dates below. The dead-domain figures are ReplyLead's MX census: one representative MX lookup per domain over 9,847,723 distinct business domains; a domain counts as unable to receive mail only when it does not resolve, publishes a null MX (RFC 7505) or has neither an MX nor an address record. The 0.67% figure is a single two-day read on one programme in August 2026. We did not test for, buy or seed any trap addresses. Last checked 24 September 2026.
Common questions
How do you know if you hit a spam trap?
Directly, you usually do not. Spamhaus states that spamtraps are never revealed by their owners, and trap operators do not notify senders. The indirect evidence is a reputation decline you cannot explain with bounces or complaints, or a blocklist entry naming your domain or IP. By the time either is visible, the fix is list-source surgery, not address removal.
Is there a spam trap list or database you can check a list against?
Not from the people who run the traps. Spamhaus says spamtraps are never revealed by their owners, and M3AAWG says traps are designed to be indistinguishable from other email addresses. Any product that claims to hold the operators' trap addresses is inferring, not reading. Spamhaus's own advice is that attempting to locate and remove traps only treats the symptom and not the underlying problem.
Can email verification detect spam traps?
It reliably catches dead addresses, which is what recycled traps are built from, so it removes the precursor state. It cannot flag a pristine trap, because a pristine trap is a working mailbox that accepts mail and therefore verifies as deliverable. Verification is necessary and insufficient; sourcing and suppression discipline do the rest.
Do spam traps ever reply?
No. M3AAWG notes that whatever their type, traps do not send email or subscribe to lists. Any address that replies to you is by definition not a trap, which is one more reason reply-focused, low-volume, verified outbound is structurally safer than volume sending.
What spam rate do mailbox providers expect?
Google's Email sender guidelines say to keep spam rates reported in Postmaster Tools below 0.10% and to avoid ever reaching 0.30% or higher. Google publishes that figure for senders using Postmaster Tools; trap hits are a separate signal that operators do not quantify publicly.
Are spam traps a problem for legitimate B2B cold email?
Only through bad sourcing and ignored bounces. Traps punish scraped, purchased and stale data and senders who keep mailing addresses that hard-bounced. Note that Spamhaus's standard is confirmed opt-in, which cold outreach does not meet; the defences on this page reduce the specific risks that standard exists to prevent, they do not turn cold email into permission email.
What are the types of spam traps?
The operators describe seven: pristine (classic) traps, seeded traps, recycled (dead address) traps, dead domain traps, typo domain traps, live traps and domain registration addresses. Spamhaus counts domain registration addresses as a subset of live traps. Two of these kinds are invisible to any check a sender can run: a pristine trap is a working mailbox that verifies as deliverable, and a live trap is a real person's mailbox. Recycled traps hard-bounce first, often for 12 months or more, before being turned back on.
Can spam traps be detected?
Not directly. Spamhaus says spamtraps are never revealed by their owners, and M3AAWG says they are designed to be indistinguishable from other email addresses, so no product can list them. What a sender can catch is the precursor population: in ReplyLead's census 8.28% of 9,847,723 business domains cannot receive mail today, and verifying live, immediately before sending, catches dead addresses while they are still catchable. Honour every hard bounce permanently, because recycled traps are built from addresses that kept receiving mail after they bounced.
Sources
- Spamhaus, Spamtraps - fix the problem, not the symptom (The Spamhaus Team, February 15, 2022): trap taxonomy, "never revealed by their owners", "treats the symptom".
- Spamhaus, Marketing FAQs: purchased and rented lists, confirmed opt-in, consequences of complaints and trap hits.
- M3AAWG, Help! I Hit a Spam Trap! (February 2023): definition, "indistinguishable from other email addresses", taxonomy, suppression and remediation guidance.
- Google, Email sender guidelines: Postmaster Tools spam-rate thresholds, purchased addresses, permission, one-click unsubscribe for bulk senders.
- ReplyLead, MX census mail-capability record (9,847,723 domains) and the August 2026 dead-address bounce read; how we source and check numbers is in our editorial standards.
- Google: Email sender guidelines FAQ: how the spam-rate thresholds are measured and applied to bulk senders. checked 24 September 2026.
- RFC 7505, A 'Null MX' No Service Resource Record (IETF): the null MX record a domain publishes to refuse all mail, one of the three dead-domain states counted in the census. checked 24 September 2026.
- Every external source above was checked on 24 September 2026.
Trap defence is a sourcing discipline - ours
Primary-evidence list building and live verification before every send are how ReplyLead's cold email and LinkedIn campaigns stay off blocklists, and our pay comes mostly from revenue you close.
How we build lists Why mail lands in spam How ReplyLead runs outbound