TL;DR
- Spam traps are addresses with no real person behind them. Mail to one tells the trap's operator you're mailing without permission.
- There are three kinds: pristine (never used), recycled (abandoned, then repurposed) and typo (misspelled domains).
- No verifier can reliably detect pristine traps, including us. Verification helps with recycled and some typo traps. List hygiene does the rest.
What a spam trap is
Mailbox providers and blocklist operators (Spamhaus is the best-known) run addresses that no person reads. Since nobody could have signed up with them, any mail they receive is evidence the sender got the address from somewhere it shouldn't have: a scraped page, a bought list, or a list so old the people have left. Hits can lower your sender reputation, push you to spam, or get your IP or domain listed on a blocklist.
Trap operators don't publish their addresses or their exact rules, for obvious reasons. Treat any claim of a precise "safe number of trap hits" with suspicion.
The three types
| Type | What it is | How it gets onto lists | Can verification help? |
|---|---|---|---|
| Pristine | An address created only to be a trap. It never belonged to anyone and never signed up for anything. | Planted in web pages and directories where scrapers and list sellers collect it. | No. It accepts mail like a real mailbox, so the SMTP check says "deliverable". |
| Recycled | A real address that was abandoned, then reactivated by the provider as a trap. | Old lists and contacts nobody has emailed in years. | Partly. During the dormant period the address usually hard bounces, and that's when re-verifying catches it. |
| Typo | An address on a misspelled domain, such as a common misspelling of a big webmail provider. | People mistyping their address on a form, with no confirmation step. | Sometimes. If the typo domain publishes no mail records we mark it invalid_domain. If it accepts mail, it looks normal. |
Why pristine traps can't be detected
Verification asks the domain's mail server whether it will accept mail for an address, and stops before sending anything
(how that works). A trap is designed to answer that question exactly like a real
mailbox: 250 OK. There's no flag in the reply, no public list of trap addresses, and the operators change them. Any
verifier that claims to detect pristine traps reliably is overstating what's possible. The defence is not mailing addresses you
didn't get with permission.
How recycled traps work, and why old lists are risky
When someone leaves a job or abandons a webmail account, the address stops existing. For a period, mail to it hard bounces with
something like 550 5.1.1 (see hard vs soft bounce). A sender who keeps mailing
it through months of bounces is clearly not cleaning their list. Some providers then reactivate the address as a trap, and it starts
accepting mail again.
That's why verification helps here: run an old list through a verifier and the dead addresses come back undeliverable before they turn into traps. Re-verify any list that's been sitting for a few months, and remove hard bounces as soon as they happen.
What MailExchange does and doesn't do
- Does: flags dead mailboxes (
rejected_email) and dead or mail-less domains (invalid_domain), which removes the addresses most likely to become recycled traps. - Does: flags disposable domains and role addresses, which are common on scraped lists.
- Doesn't: detect pristine traps, or tell a typo-trap domain that accepts mail from a real one. We don't sell a "spam trap detection" result because we can't back it up.
How to stay clear of traps
- Don't buy or scrape lists. That's how pristine traps get in.
- Verify before every campaign, not just once. Lead data decays as people change jobs.
- Remove hard bounces immediately, and stop mailing contacts who haven't engaged in a long time.
- Confirm signups. A confirmation email, or a real-time check on the form, stops typo addresses at the door.
- Watch for sudden drops. A jump in spam placement or a new blocklist listing after a campaign often points to one bad list source.