# Spam Traps: What They Are and How to Keep Them Off Your List

> Spam traps are addresses that exist to catch bad lists. The seven kinds Spamhaus names, how cold email lands on each, and how to keep them off your list.

Canonical: https://ballast.to/blog/spam-traps
Last updated: 2026-10-28

A spam trap is an email address that no person uses to sign up for anything. It's run by a blocklist operator, a mailbox provider or an anti-spam company, and since nobody ever handed it out, any email it receives came from a list built the wrong way: scraped from websites, bought, guessed, or old enough that the people on it are gone. Hitting traps can get your domain or sending IP listed and pull the rest of your mail toward spam. You can't find the traps on your list. You avoid them by knowing where every address on it came from.

## What is a spam trap?

An address kept only to observe who emails it. Trap operators don't publish their addresses, don't answer from them and don't unsubscribe. They use what arrives as evidence: a sender who keeps hitting traps has a data problem, and the operator's blocklist, or the mailbox provider's filter, acts on that.

Spamhaus, one of the main blocklist operators, puts it plainly in its own guidance: trap hits confirm an underlying problem with how the data was collected. The trap isn't the problem. It's how they find out about yours.

## What types of spam traps are there?

Most articles list three kinds. Spamhaus describes seven, and the finer split is more useful, because each one tells you how the address got onto your list.

| Kind | What it is | How a cold email list picks it up |
| --- | --- | --- |
| Classic (pristine) | An address never given to anyone or published, some on domains that accept mail for any address | Guessing addresses, especially at catch-all domains |
| Seeded | An address hidden where only a scraper finds it, such as a page's source code | Scraping emails from websites, or buying from someone who did |
| Typo domain | An address at a lookalike domain, like `yaaho.com` | Typos in hand-typed or form-collected data |
| Dead address | A real address the provider shut down, which bounces for a while and is then turned back on as a trap | Old lists, and ignoring hard bounces |
| Dead domain | An expired domain bought by a trap operator | Old lists full of companies that no longer exist |
| Live | A real person's mailbox whose unsolicited mail feeds blocking decisions | Emailing anyone who didn't expect it at volume |
| Domain registration | Role addresses published in WHOIS, such as `postmaster@`, `abuse@`, `admin@` | Scraped WHOIS data and role addresses in general |

Two details from Spamhaus are worth knowing. Dead address traps reject mail for a set period, often 12 months or more, before they're reactivated, so a sender who stopped at the first hard bounce never reaches them. And typo-domain traps aren't pure traps: they receive plenty of real mail by accident, so Spamhaus gives them less weight than the others.

## How does cold email end up hitting spam traps?

Through the list, every time. These are the routes I see most often in cold outreach:

- **Scraped emails.** Pulling every address off a site's pages is exactly what seeded traps are placed to catch.
- **Bought lists.** Spamhaus's FAQ says purchased lists inevitably contain traps, and that permission isn't transferable. A list sold to you was almost certainly sold to others too.
- **Guessing addresses.** Generating `first.last@`, `f.last@` and `first@` for every name and sending to whichever the verifier doesn't reject. On a domain that accepts every address, nothing is rejected, and classic traps live on exactly those domains. More on that in [what a catch-all email is](https://ballast.to/blog/catch-all-email).
- **Old exports.** A CRM export or data vendor file from a few years ago carries dead addresses and dead domains. If you never emailed them, you never saw the year of bounces that came before they turned into traps.
- **Role and WHOIS addresses.** `abuse@`, `postmaster@` and `admin@` are read by the people who decide whether you're a spammer. They don't belong in outreach.

## What happens when you hit a spam trap?

Nothing you can see at first. There's no bounce, no reply and no notice. What changes is how receivers treat your mail afterwards.

A blocklist operator may list your domain, your sending IP, or both. Every mailbox provider and company filter that uses that list then rejects or filters your mail, sometimes for every mailbox on the domain at once. Mailbox providers also run their own traps and feed what they catch into their own filters, which you'll never see listed anywhere.

If you send from Google Workspace or Microsoft 365 mailboxes, the IP addresses belong to Google or Microsoft, so the reputation you're putting at risk is your domain's. That's the reason to keep cold email off your main company domain: if a sending domain gets listed, your invoices and support replies keep working.

## How do you know if you've hit a spam trap?

Usually through a symptom, because nobody tells you directly:

- **A blocklist listing.** [The blacklist check](https://ballast.to/check/blacklist) looks up a domain on 3 domain lists, Spamhaus's among them, and its mail servers on 6 IP lists. If you send through your own SMTP server, look up its IP on the operators' sites too.
- **Replies drop across every mailbox on one domain at once.** One mailbox going quiet is usually that mailbox. All of them going quiet the same week points at the domain.
- **Bounces with block codes.** `5.7.x` refusals that start suddenly, or messages naming a blocklist in the reason. [Soft bounce vs hard bounce](https://ballast.to/blog/soft-vs-hard-bounce) explains how to read them.

A verifier can flag some known traps. ZeroBounce, for example, has a `spamtrap` result. It's worth having, but it can only catch traps someone has already identified, and classic traps are built so that nobody can. Spamhaus's FAQ is blunt that services promising to remove traps from a list don't work as claimed, and that it regularly sees "cleaned" lists in its traps. A verifier makes a decent list cleaner. It can't make a bad source safe.

## How do you keep spam traps off a cold email list?

1. **Know the source of every address.** If you can't say where a lead came from, don't email it. No bought lists, no addresses scraped from websites.
2. **Don't guess at catch-all domains.** A guessed address that can't be verified is how classic traps get onto lists.
3. **Verify before the first email, and again for anything you haven't emailed in months.** People leave, mailboxes close, and a closed mailbox can come back as a trap.
4. **Suppress every hard bounce, in every campaign, for good.** Dead address traps spend a long time bouncing before they're switched on. A sender that stops at the first bounce never reaches the trap.
5. **Catch typos when you import.** `gmial.com` and `hotmial.com` aren't the person's address.
6. **Leave role addresses out.** Especially `abuse@`, `postmaster@`, `admin@` and `hostmaster@`.
7. **Check your sending domains for listings every week.** A listing you find on Tuesday costs you a lot less than one you find a month later.

## How do you get off a blocklist after hitting traps?

Fix the source first, then ask. Spamhaus says only Spamhaus decides what it lists and removes, and that the only way off a listing is to fix what caused it. In practice:

1. Pause every campaign sending from the listed domain.
2. Find the list or segment behind it. A recent import, a new data vendor or an old export is the usual answer.
3. Stop using that source, and remove the leads that came from it, including the ones that haven't bounced.
4. Look up the listing on the operator's site and follow its removal steps. Most explain what they saw.
5. When you start again, start slowly, with verified leads you can trace.

Asking for removal before you've fixed anything usually ends with the same listing coming back.

## When traps aren't the reason your email goes to spam

Spamhaus makes a related point about its own traps: a trap hit is a signal of a list problem, not the thing to blame. If no listing shows up anywhere, look at the usual suspects first: authentication (run [the domain check](https://ballast.to/check)), how many emails each mailbox sends a day, and how many of your leads bounce. Trap hunting won't fix any of those.

## What Ballast does to keep traps off your list

When you import leads, Ballast marks typos of the big providers (`gmial.com`, `hotmial.com` and similar), disposable domains and domains with no mail server as invalid, and shared inboxes like `abuse@`, `postmaster@` and `info@` as risky. With your own ZeroBounce key connected, a `spamtrap` answer marks the lead invalid as a known spam trap. Every hard bounce is suppressed across the whole workspace, so no campaign emails that address again, and every domain you add is checked against the blacklists daily. The [acceptable use policy](https://ballast.to/legal/acceptable-use) also rules out purchased, rented or scraped consumer lists. The [leads docs](https://ballast.to/docs/leads#verification) list every check.

## FAQ

### What is a spam trap email?

An email address that exists only to catch senders with bad lists. Nobody signs up with it, so mail sent to it shows the sender's list was scraped, bought, guessed or out of date.

### Can an email verifier find spam traps?

Only known ones. Some verifiers flag addresses already identified as traps, but classic traps were never published anywhere, so no tool can detect them. Where the list came from matters more than any verification.

### Do spam traps open emails or click links?

Some can. Spamhaus says researchers check the mail that reaches classic traps, links included, so a click is possible. Those traps are a small share of the total and shouldn't skew your numbers.

### What is a recycled spam trap?

Another name for a dead address trap: a real address that was shut down, bounced mail for a long time, often 12 months or more, and was then reactivated as a trap.

### Are role addresses like info@ spam traps?

Not usually, but `abuse@`, `postmaster@` and the addresses published in WHOIS records are read by the people who handle spam reports, and Spamhaus lists them as a trap category. Leave them out of cold email.

### Can I remove spam traps from my list?

Not reliably. Spamhaus calls trap hunting a fix for the symptom. Stop using the source the traps came from, and remove every lead from it, not only the ones that bounced.

## Sources

- [Spamtraps: fix the problem, not the symptom](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/), Spamhaus, 15 February 2022, checked 28 October 2026.
- [Marketing email FAQ](https://www.spamhaus.org/faqs/marketing-email/), Spamhaus, checked 28 October 2026.
- [Unravelling the myths of spamtraps: clicking links](https://www.spamhaus.org/resource-hub/deliverability/unravelling-the-myths-of-spamtraps-clicking-links/), Spamhaus, 1 November 2023, checked 28 October 2026.
- [ZeroBounce API documentation](https://www.zerobounce.net/docs/email-validation-api-quickstart/), for the `spamtrap` result.