Spam trap

Also called: Spamtrap, Honeypot address.

Anti-spam organizations and mailbox providers run addresses that no real person uses. Amazon SES describes a spamtrap as "a dormant email address that is used exclusively to lure unsolicited email." Some were never published anywhere; others are old addresses that were abandoned, bounced for a long time, then reactivated as traps.

Hitting one says your list was bought, scraped carelessly or never cleaned. The organizations keep the addresses secret, so you can't simply look them up and remove them. Amazon SES notes that purchased lists can contain spamtraps, which is one reason its terms prohibit sending to them.

Verification can't reliably detect a trap, because a trap is a working mailbox by design. The defenses are about sourcing and hygiene: use addresses the business published itself, avoid bought lists, re-verify old data, drop addresses that bounced in the past, and remove people who never engage.

Abandoned domains that accept all mail are a related risk for local lists. A closed business's catch-all domain can keep accepting messages long after anyone reads them.

Example

A company buys a ten-year-old list of contractors. Some addresses were abandoned and turned into traps, and its sending domain is listed by an anti-spam organization within a week.