GLOSSARY

What is a Spam Trap?

A spam trap, or honeypot address, is an email address that belongs to no real person, planted or recycled by a mailbox provider or blocklist operator so that any message arriving at it is evidence the sender is mailing addresses it never obtained consent for.

Try Pinlyx free See the email inbox

Free forever plan · No credit card required · Cancel anytime

Quick definition

The defining property: it never bounces, never complains and never unsubscribes. Silence is how it works.

What it means

Blocklist operators and mailbox providers need a way to tell a sender who acquired a list from a sender who earned one. Asking is useless. Measuring complaints only catches senders whose recipients bother to complain. So they use a control group of addresses that provably has no consent attached to it, because the addresses never belonged to anyone who could give consent.

Mail arriving at one of those addresses is close to proof. There is no legitimate path by which a company that only mails people who asked to hear from it can reach an address that no person ever typed into a form. That is what makes a spam trap such a powerful signal, and why the penalty attached to hitting one is disproportionate to the single message involved.

The uncomfortable property, for an operator, is the silence. Every other deliverability problem announces itself: a bounce returns a code, a complaint arrives through a feedback loop, an unsubscribe writes a row. A trap accepts your message and says nothing at all, and you find out weeks later when an entire provider stops delivering.

The four kinds, and what each one accuses you of

Treating all traps as one category loses the diagnosis. Each type is created differently and therefore implies a different failure in your process, which the table further down sets out in full. The short version: a pristine trap says the list was harvested, a recycled trap says you are ignoring hard bounces, a typo trap says there is no validation at capture, and a role address says nobody filtered the import.

Note what is not a trap. Seed addresses used by inbox-placement testing services are real mailboxes the vendor controls and you deliberately mail; they measure placement and do not report you. Do not confuse a seed list with a trap network.

How you find out, indirectly

Because the trap is silent, every signal is second order. The ones worth wiring an alert to:

Single-provider collapse. Delivery to one mailbox provider falls off while the others stay flat. Traps are operated per provider, so the damage is rarely uniform.
Reputation drop without a complaint spike. A Google Postmaster Tools domain reputation falling from high to low while complaints stay at zero is close to a signature.
A wave of 4.7.0 deferrals. Receivers throttle before they block. Deferrals are the warning; rejections are the verdict.
A public listing. The rejection text names the blocklist and gives a lookup URL, which is the only fully explicit evidence you will get.

The arithmetic of a purchased list

Buying a list is the single behaviour that produces pristine trap hits, and the numbers do not work even before ethics or law enter the discussion. A hundred thousand purchased addresses will typically contain a double-digit percentage of dead mailboxes, a meaningful share of role accounts, and some number of traps that you cannot detect in advance. One pristine hit is enough to trigger a listing that suppresses delivery for your genuine customers too, on the same sending domain, on the same day.

The cost is never the wasted send. It is that the domain your real customers receive receipts and password resets from is now the domain that got listed. This is also the argument for sending outbound campaigns from a separate subdomain, so that the blast radius of a mistake stops short of your transactional mail. See domain warm-up for how to stand that subdomain up properly.

Prevention, in the order that matters

Never buy, rent, scrape or swap a list. This one rule removes the entire pristine category.
Use confirmed opt-in. The only message an unverified address ever receives is the single confirmation request.
Honour hard bounces on the first occurrence. A recycled trap was a hard bounce for months before it became a trap; suppressing it then is what prevents the hit now. See suppression list.
Run a sunset policy. Stop mailing anyone with no open, click or reply for a defined window: 90 days for high-frequency sending, up to a year for quarterly mail. This is the only real defence against recycled traps.
Validate at capture, not later. Syntax, an MX lookup on the domain, a known-typo suggestion, and a disposable domain list. Reject and ask again rather than silently correcting.
Protect the signup form. Rate limit per IP, add a challenge, and drop submissions that arrive faster than a human can type, so a bot cannot use your form to bomb someone else.
Interrogate every import. Ask where the file came from and when. A CSV whose provenance nobody can describe is a purchased list until proven otherwise.

Related concepts

Bounce rate: ignoring hard bounces is precisely how recycled traps are created.
Suppression list: the mechanism that turns a bounce into a permanent decision.
Domain warm-up: subdomain separation limits how far a listing can spread.
Lead magnet: the legitimate way to acquire addresses that will never be traps.
Cold outreach: the activity most at risk, and the one where sourcing discipline matters most.

How Pinlyx handles it

Contacts captured through Pinlyx forms are validated at entry with syntax, MX and typo-domain checks, and the form endpoints are rate limited so a bot cannot use them to bomb a third party. Hard bounces write a permanent suppression on the first occurrence rather than after a retry budget, which is what keeps recycled traps out of later campaigns. Engagement is tracked per contact so a sunset rule can be applied as a segment filter rather than as a manual cleanup, and campaign sending runs on a subdomain separate from transactional mail, so a listing on one cannot silence the other.

What a hit looks like

The trap says nothing. The receivers say plenty.

These are the only messages you will ever get about a trap hit, and they arrive days later.

A blocklist rejection

554 5.7.1 Service unavailable; Client host [46.225.21.115] blocked using
 zen.spamhaus.org; https://check.spamhaus.org/query/ip/46.225.21.115

550 5.7.1 Unfortunately, messages from [46.225.21.115] weren't sent. Please
 contact your Internet service provider since part of their network is on
 our block list (S3140). You can also refer to
 https://postmaster.live.com/pm/postmaster.aspx  [Name=Protocol Filter Agent]

421 4.7.0 [TSS04] Messages from 46.225.21.115 temporarily deferred due to
 unexpected volume or user complaints

None of these mention a trap, and none name a recipient. They are statements about the sending IP, which is why suppressing individual addresses in response is the wrong move.

The shape of the data before it happens

-- addresses that have never engaged and never bounced.
-- a trap sits in exactly this population: accepted, silent, forever.
SELECT c."Id", c."Email", c."CreatedAt", c."SourceLabel"
  FROM contacts c
 WHERE c."LastOpenedAt"  IS NULL
   AND c."LastClickedAt" IS NULL
   AND c."LastRepliedAt" IS NULL
   AND c."HardBouncedAt" IS NULL
   AND c."CreatedAt" < now() - interval '180 days'
 ORDER BY c."SourceLabel";

-- group by SourceLabel. one import or one form will dominate the result,
-- and that is the batch to quarantine.

Trap taxonomy

Four kinds, four different accusations.

Type	Where it comes from	What a hit proves	Severity
Pristine	An address created purely as a trap and published where only an automated harvester would find it: inside an HTML comment, in a WHOIS record, on a page with no inbound links.	The list was scraped or bought. No human ever typed this address into a form, because no human ever saw it.	Highest. A single hit can produce a blocklist listing, and the operator assumes intent rather than sloppiness.
Recycled	A real address that its owner abandoned. The provider bounces it as unknown for six to twelve months, then reactivates it as a trap.	Poor list hygiene. You are still mailing addresses you were told did not exist, which means you are ignoring hard bounces.	Moderate. Recoverable, and usually the first sign that a sunset policy is missing.
Typo domain	Misspellings of large providers, registered by trap operators specifically to catch mail sent to addresses nobody validated.	No validation at the point of capture. The address entered your database exactly as it was mistyped.	Moderate, and entirely preventable with a domain suggestion step on the form.
Role and abuse	Addresses like abuse or postmaster at a domain, monitored by the operator rather than used for correspondence.	A list that was not filtered for role accounts, or an import that swept a company website.	Lower on its own, but a strong marker of the list-building method behind it.

The sunset rule

Stop mailing people who stopped reading.

A recycled trap is an address that was real, was abandoned, bounced for months, and was then reactivated. Every step of that sequence is visible to a sender who is paying attention, and invisible to one who is not. The rule that catches it is boring: if a contact has not opened, clicked or replied within your sunset window, stop sending to them.

Ninety days is right for weekly sending, six months for monthly, a year for quarterly. Run one re-engagement message from a separate subdomain before you drop them, and treat silence as the answer. A list that shrinks on a schedule delivers better than one that only grows.

Spam traps: FAQ

What senders ask once delivery to one provider stops for no visible reason.

You do not, directly, and that is the design. A trap accepts the message silently: no bounce, no complaint, no unsubscribe. The evidence is always indirect: delivery to one provider collapsing while others stay normal, a Google Postmaster Tools domain reputation dropping a grade with no matching complaint spike, a sudden wave of 4.7.0 deferrals, or a listing appearing on a public blocklist. If you can only detect it by inference, you have to prevent it by process.

No, and anyone selling one is selling either a stale copy or an invention. Trap operators keep the addresses secret because a published trap is a useless trap. Reputable validation services can flag known-bad patterns, disposable domains and dead mailboxes, which removes recycled and typo traps indirectly, but nobody can hand you the pristine list.

It depends on the trap and the volume around it. One hit on a recycled trap inside an otherwise engaged campaign is usually absorbed. One hit on a pristine trap, particularly at a blocklist operator that runs its own, can produce a listing within hours, because a pristine hit is treated as proof of harvesting rather than as an accident. The asymmetry is the point: the traps that are hardest to avoid are also the least damaging.

Fix the cause first, and be able to describe it in one paragraph. Some listings expire automatically once the behaviour stops, so the correct action is to wait. Others require a request that explains what changed. Requesting delisting twice without having actually changed anything is the fastest way to lose the benefit of the doubt, and repeated requests are themselves recorded.

It removes almost all of it. A confirmed opt-in means the only message that ever reaches an unverified address is the single confirmation request, so typo and pristine traps never receive your campaigns. It does not eliminate recycled traps, because those addresses genuinely confirmed years ago, which is why you also need a sunset policy that stops mailing anyone who has not engaged for many months.

Yes, and it is a common and under-discussed route. Someone else spam bot submits your form with a harvested address as a way of hitting a target through you, which is list bombing. Your system then dutifully sends a confirmation message to what may be a trap. Rate limit the form per IP, add a challenge, never send anything but the single confirmation to an unverified address, and drop signups that arrive faster than a human could type.

Keep reading

Bounce rate

Ignoring hard bounces is exactly how a recycled trap gets created.

Suppression list

The mechanism that turns a single bounce into a permanent decision.

Domain warm-up

Subdomain separation is what stops one listing from silencing your receipts.

Lead magnet

The legitimate acquisition path, where consent is recorded at capture.

Cold outreach

The workflow most exposed to trap risk, and how sourcing discipline fixes it.

Email marketing automation

Sequence design, sunset segments and the deliverability guardrails.

Ready to ship

The list you never bought is the one that delivers.

Pinlyx validates addresses at capture, suppresses hard bounces on the first occurrence, and keeps campaign sending on a subdomain separate from your transactional mail.

Start free Talk to sales

Free forever plan · GDPR-ready · No credit card required