How Spam Traps Get Onto Your List, and How to Keep Them Off

Spam traps get onto a list through a small number of routes: addresses that were bought, rented or scraped from the web; typos nobody confirmed; old addresses that died and were later reactivated as traps; and bots filling in your forms. Each route is a collection or hygiene failure, and each has a specific fix.

That framing matters, because the instinct after a blocklisting is to go looking for "the trap". Spamhaus puts it bluntly: "We strongly urge people to view spamtraps as proof of a data collection or hygiene issue and not be misled into conducting a hunt for spamtraps." (Spamhaus)

This post walks through each door a trap comes through, what verification can and cannot do about it, and a small measurement we ran on typo domains that shows why "the domain has mail servers" proves very little.

What a spam trap actually is

A spam trap is an address that never asks for mail, used by a mailbox provider, blocklist or monitoring company to spot senders who mail people without permission. M3AAWG's definition: "an email address used to collect, record, and monitor spam and other unsolicited or abusive email. Spam traps are designed to be indistinguishable from other email addresses." (M3AAWG, Help! I Hit a Spam Trap!, 2023)

The one thing all traps share, in M3AAWG's words, is that "they don't send email or subscribe to email distribution lists or newsletters". So any trap on your list is, by definition, an address that did not sign up. See the spam trap glossary entry for the short version.

The main trap types and where each comes from

Each trap type maps to one specific failure in how addresses were collected or maintained. The taxonomy below combines M3AAWG's three core types with the extra categories Spamhaus describes.

Trap type	What it is	How it gets on your list	What it says about you
Pristine (classic)	Never used by a person	Harvested from the web, dictionary attacks, bought or rented lists	You are mailing people who never opted in
Seeded	Planted deliberately, e.g. in page source code	Scraping, or buying from someone who scrapes	Same as pristine
Recycled (dead address)	Once real, abandoned, bounced for a long period, then reactivated	Old data you kept mailing, or bounces you never processed	Poor hygiene, poor bounce handling
Dead domain	Expired domain bought by a trap operator	Old lists containing addresses at defunct companies	Old, unmaintained data
Typo	Misspelled domain such as gmial.com	Unconfirmed form entries, point-of-sale and scanning errors	You do not confirm addresses
Role / registration	postmaster@, abuse@, admin@, often published in WHOIS	Scraped or bought lists	Purchased or harvested data

Sources: M3AAWG, Spamhaus.

On the weighting: Spamhaus says typo traps "are not 'pure' spam traps, can contain a lot of real mail, and are generally weighted accordingly", while M3AAWG says pristine trap hits "may be a strong indicator of the presence of purchased lists". In a separate article Spamhaus says typo and recycled traps together make up the majority of traps, and pristine traps "a small percentage overall" (Spamhaus).

Route 1: bought, rented or scraped lists

Buying, renting or scraping a list is the most reliable way to acquire pristine and seeded traps, because those addresses exist only in places a scraper or list seller would find them. Nobody else has them.

Seeded traps are placed "in webpage source code, for example" (Spamhaus), precisely so that the only way to obtain them is automated harvesting. A list vendor who scraped them will sell them to you alongside real addresses, and nothing in the file distinguishes the two.

M3AAWG lists "purchased, rented or e-pended lists" and "addresses harvested off websites" among the ways traps end up on lists. The fix is not a better vendor. It is not mailing data where the person never asked to hear from you.

Route 2: typos nobody confirmed

Typo traps arrive through genuine sign-ups that were mistyped and never confirmed. A real person meant gmail.com and typed gmial.com. M3AAWG says this "type of hit often indicates a failure of the customer to confirm the recipient's address, and can be caused by transcription or scanning errors".

High-risk points of entry named by M3AAWG include point-of-sale entry and trade show lists, where a person types an address on someone else's behalf, or a badge scanner misreads one.

What we found when we looked up 23 typo domains

To see what a typo domain looks like to a basic checker, we looked up the MX and A records of 23 common misspellings of Gmail, Hotmail, Outlook, Yahoo, iCloud and AOL using dig against Cloudflare's resolver (1.1.1.1) on 2 October 2026 at 03:37 UTC. We did only DNS lookups and opened no mail connections. Raw results are in the research file for this post.

What the DNS said	Count	Domains
Publishes a working MX record	10	gmil.com, gamil.com, gnail.com, hotmial.com, hotmil.com, notmail.com, outlok.com, outloo.com, ynail.com, iclod.com
No MX, but has an A record	4	gmial.com, hotmal.com, homail.com, yaho.com
Publishes a "null MX" (accepts no mail)	4	gmail.co, yahooo.com, yhoo.com, aol.co
Resolves to nothing	3	gmal.com, gmaill.com, hotmail.co
Unusual (unusable MX, or points at a parking service)	2	yaaho.com, icoud.com

Three things stand out.

Ten of the 23 typo domains are set up to receive mail. An address at any of them passes a syntax check and an MX check. If your form validation stops at "the domain has mail servers", every one of these sails through.

The four "A record only" domains can still receive mail. Under RFC 5321 section 5.1, when a domain has no MX record a sending server falls back to its A record. So "no MX" does not mean "undeliverable".

Several typo domains share the same mail host. hotmial.com, notmail.com and outlok.com all point at mail.h-email.net; gmil.com and hotmil.com both point at mail.yaxmail.net. Someone is deliberately collecting mail for misspellings of several major providers at once. We do not know who operates these hosts or whether they feed a trap network, and we make no claim that they do. The point is that mail to these domains is received by somebody who is not your intended recipient.

The four null-MX domains (RFC 7505) are the good outcome: they declare that they accept no mail, so a message bounces immediately instead of landing somewhere unknown.

You can check any domain the same way with our MX lookup tool.

Route 3: old addresses that died and came back as traps

Recycled traps get onto lists by already being there. The address was real when it was collected; the person left the job or abandoned the inbox; the provider turned it off; and much later it was turned back on as a trap.

Spamhaus describes the lifecycle: "All mail to these addresses is rejected with a hard bounce for a period of time, often 12 months or more. After consistently rejecting mail for a pre-determined period, the addresses are silently turned back on in the form of spamtraps." M3AAWG suggests 12 months of inactivity as a minimum before conversion.

That lifecycle tells you exactly how a recycled trap gets you: you kept mailing an address that was hard-bouncing and did not remove it, or you stopped mailing a segment for a long time and then mailed it again. M3AAWG flags the second case specifically: "Special care should be taken when segmentation results in some recipients receiving mail who have not been sent to for an extended time, during which an address may have been retired and repurposed as a spam trap."

Spamhaus is direct about the consequence: a lack of sunset policy combined with poor bounce management is "the recipe for inclusion on the Spamhaus Blocklist (SBL)" (Spamhaus on sunset policies).

Route 4: bots and incentivised forms

Bots submitting your sign-up forms will add pristine traps for you. M3AAWG notes that "spam traps are sometimes added to lists by automated form submissions" and recommends checking web analytics for unusual spikes.

M3AAWG also names collection methods that put "any email address over the right email address": incentivised sign-ups, social media sign-ups, refer-a-friend forms, sweepstakes, and single opt-in forms. A refer-a-friend form is a particularly clean example: the address is typed by someone other than its owner, which is the definition of no permission.

What email verification can and cannot do about traps

Verification cannot reliably identify spam traps, and anyone selling it as a trap detector is overselling. It does reduce trap risk on specific routes. Here is the honest split.

Trap type	Can verification help?	Why
Pristine / seeded	No, not reliably	The address is a real, working mailbox. The server accepts it exactly as it would a person's.
Recycled, while still dead	Yes	During the bouncing phase the server rejects the mailbox, so verification returns invalid and you remove it before it is reactivated.
Recycled, after reactivation	No, not reliably	It now accepts mail like any live mailbox.
Typo domain	Partly	Some typo domains have no mail servers or a null MX and fail. Others accept everything, which a verifier can only report as catch-all or risky, not as a trap.
Role / registration	Partly	A verifier can flag admin@, abuse@ and similar as role addresses so you can choose not to mail them.

The useful insight is timing. A recycled trap is catchable only during its dead period, so regular verification of an ageing list removes addresses while they are still saying "no such user". Verify once a year and the window can close between checks.

SimpleVerifier, for what it is worth, follows the same limits: it reports unconfirmable addresses (including catch-all domains) as risky rather than valid, and flags role and disposable addresses separately. None of that makes it a trap detector, and we would not describe it as one.

How to keep traps off your list

The fixes are all at the point of collection or in routine hygiene. In order of impact:

1. Do not buy, rent or scrape lists. This is the only route to pristine and seeded traps, and no amount of cleaning makes it safe.
2. Confirm addresses at sign-up. Confirmed (double) opt-in means a typo or a bot submission never becomes a subscriber. Google's own sender guidelines say: "Confirm each recipient's email address before subscribing them." (Google)
3. Validate as the address is typed. M3AAWG's best practice is "to validate the email address as it is entered, and to prompt the subscriber to re-enter their address if validation fails". Suggesting gmail.com when someone types gmial.com catches the commonest typo traps; see catching email typos at signup.
4. Process every hard bounce, immediately. A hard bounce today is a recycled trap candidate later.
5. Run a sunset policy. Spamhaus notes mailbox providers can investigate an address unengaged for "anywhere from three to twelve months". Suppress long-unengaged contacts rather than letting them age into the conversion window. Our guide to writing a sunset policy covers the details.
6. Be careful reviving old segments. If you must mail a segment that has been dormant for months, verify it first and send it slowly.
7. Protect forms from bots. Rate limits, a challenge where needed, and an eye on analytics for odd spikes.
8. Keep role addresses off marketing lists. Spamhaus says registration addresses "should almost NEVER be on a marketing mailing list".

If you have already hit one

Treat a trap hit as an audit trigger, not a deletion job. M3AAWG's remediation questions are a good template: how was each list created, when did the trap hits start, which segment or source correlates with them, and can every address from that source be removed. If a blocklist is involved, see how to get removed from an email blacklist.

The takeaway

Every spam trap on a list arrived through a door you can name: a list you did not build, a typo you did not confirm, a bounce you did not process, or a dormant segment you revived. Verification closes part of one door, the dead-address phase of recycled traps. Confirmed opt-in, bounce processing and a sunset policy close the rest.