What Is a Spam Trap? Pristine vs Recycled Addresses

A spam trap email address is a decoy inbox that a blocklist operator, a mailbox provider or a researcher watches so it can identify senders who are mailing addresses they were never granted. Nobody signs up to a trap and nobody reads its mail. The whole purpose of the address is to be undeliverable in every legitimate sense: if a message lands in it, the sender is by definition mailing without permission or with a stale list.

The term covers three distinct things that behave differently once they are on your list. Pristine traps were never real. Recycled traps used to be real and were retired. Typo traps sit on domains that look like popular providers but exist only to catch fat-finger addresses. Each one is a diagnosis of a different mistake, and telling them apart is what makes the definition useful.

The verdict up front: three traps, three list-hygiene failures#

If you only remember one thing, remember that a spam trap is not a spam filter and it does not block mail on its own. It is an observation post. Anti-abuse groups such as Spamhaus and the M3AAWG use trap hits as evidence when they decide whether a sender belongs on a blocklist, and mailbox providers use their own internal traps to score reputation.

The three trap types map cleanly onto three different failures in how a list gets built and maintained. A pristine hit says an address entered your list without ever consenting. A recycled hit says an address stayed on your list years after its owner walked away. A typo hit says your signup process accepted a misspelled address as valid. If you can name the type, you can name the fix — even though you will almost never learn the address itself.

Pristine vs recycled vs typo traps at a glance#

What is a pristine spam trap?#

A pristine spam trap is an address that was never a working mailbox for a human. Blocklist operators create them, then plant them where address harvesters and list vendors will find them — hidden in the source of a web page, seeded into sold or rented lists, salted into leaked databases. The addresses are indistinguishable from real ones on the wire; they resolve to a real domain and accept mail. They just have no owner.

Because a pristine trap has no prior relationship with any sender, the only way to mail one is to have gotten the address from somewhere other than its owner. That is why a pristine hit is close to proof that some part of your list was acquired without consent. Spamhaus describes trap hits as evidence of an acquisition-or-hygiene problem, and pristine hits sit on the acquisition side.

• Purchased or rented lists — vendors know traps get seeded into these, and often add their own to catch resellers.
• Scraped or harvested addresses — traps are planted in public page code specifically to catch scraping.
• Appended data — a third party matched names to addresses that were never given to you.
• Guessed patterns — mailing sales@, info@ or firstname.lastname@ combinations invented from public directories.
• Signup forms with no confirmation step — a bot can plant an address that no real person ever approved.

What is a recycled spam trap?#

A recycled spam trap started life as a real address for a real person. That person moved on — changed jobs, switched providers, forgot the account existed — and the mailbox went dormant. After a long dormancy the provider stopped delivering to it, let it hard-bounce for months, and eventually reactivated the address for its own use as a trap. Spamhaus describes recycled traps plainly as addresses that were once valid but are no longer used.

So a recycled hit is a hygiene verdict rather than an acquisition one. The address was almost certainly opted in at some point; the failure is that you never let it go once it stopped engaging. Mailbox providers publish very little about the exact dormancy windows they use, but the mechanics are the same everywhere: dormancy, bounces, silence, then reactivation.

• No sunset policy — mail keeps flowing to people who have not opened or clicked in a year or more.
• Ignored bounces — hard bounces are not being removed promptly, so a dying address stays on the list.
• Re-engagement blasts to dead weight — mailing a long-cold segment to 'win them back' is exactly how you surface its recycled traps.
• List cleaning that only runs before a big send, not continuously, so decay accumulates.

What is a typo trap email address?#

A typo trap sits on a domain that looks almost right — gmial.com, yaho.com, hotnail.com — and is registered by an anti-abuse operator or a defensive owner precisely to catch mistyped addresses. The signup form on a legitimate business does not always validate the domain part of an email; a subscriber types '[email protected]' by accident and it goes onto the list. From then on, every message aimed at that record hits a trap.

Typo traps sit awkwardly between pristine and recycled. The address on your list came from a real person who did want to hear from you, so there is genuine intent at the source; but the address itself never resolved to a mailbox they owned. In practice receivers weight typo hits less severely than pristine hits, because they read as a signup-flow error rather than a scraped list. The fix is on the form, not the list.

How each type ends up on a list#

The three trap types come from three different processes on your side, which is why 'clean your list' is not one operation but three. The table above lists the entry points; this section makes the pathways concrete so a diagnosis is possible from behaviour, not from an address you cannot see.

1. 1

   Pristine: an address enters without a person ever choosing you

   You bought a list, an appender guessed at a match, a form accepted a bot submission, or a scraper collected an address that a blocklist operator had planted to catch scrapers. The common thread is that no owner ever gave you permission — often no owner exists at all.

2. 2

   Recycled: a real address goes silent, then gets reused against you

   Someone opted in, engaged for a while, then stopped. Your list did not act on the silence. The provider eventually stopped delivering, let the address hard-bounce, and reactivated it as a trap. You kept mailing anyway, because your process treats a lack of bounces as continued permission.

3. 3

   Typo: a real person mistypes and your form does not check

   A subscriber intends to enter a valid address, misses a key on the domain, and the form accepts it. If no confirmation email is sent — or if the confirmation is soft — the wrong address stays on your list forever, and every send to it lands on a look-alike trap.

Can you remove a spam trap from your list?#

Not directly, because the address is a secret. Blocklist operators and mailbox providers do not confirm which address was the trap, for the same reason a bank does not publish its account-security questions. If you could scrub the trap out, you could keep mailing everything else without changing anything, which is the exact behaviour the trap exists to catch.

What you can remove is the pathway that let the trap onto the list. That looks different for each type: fix acquisition for pristine, fix hygiene for recycled, fix the signup form for typo. If those three doors are closed, the individual trap on your list stops mattering — you will stop mailing it because it will fail the process, not because you identified it.

How validation services are packaged (verify on the vendor)#

There is no shortage of tools that claim to detect spam traps, and the honest thing to say is that none of them can guarantee a clean list. A well-hidden pristine trap looks like a valid inbox, and a recycled trap will accept mail again once it is reactivated. Validation still helps by clearing obviously dead, malformed and typo-adjacent addresses, and by segmenting risk before you send.

We do not print competitor prices here because packaging changes month to month and the number goes stale before this page does. Instead, here is the shape you will see when you go read each vendor's own page — verify the current number on their pricing page before you commit.

Who each trap actually targets#

Match your situation to the description that fits, because the type you are most exposed to determines which process you have to change first.

• Pristine traps mostly hit senders who do cold outbound, buy or rent lists, append data, scrape addresses, or accept signups without a confirmation step. Any of those puts an address on the list that no person ever gave you.
• Recycled traps mostly hit permission-based senders with an aging list — legitimate marketers, newsletters and older SaaS lifecycle programs that never adopted a sunset policy and still mail people who went silent years ago.
• Typo traps mostly hit consumer signups at scale — ecommerce checkouts, event registrations, lead-gen forms — anywhere a person can type an address in a hurry and hit send without a confirmation loop.
• Every bulk sender should watch the spam rate as an early warning. Google tells bulk senders to keep their Postmaster Tools spam rate below 0.10% and never to reach 0.30% (Gmail sender guidelines, as of August 2026); a climbing rate often precedes a trap-driven listing.

A third option, honestly: what none of this is about#

This page has stayed on the sending side because that is where spam traps live. There is a separate, adjacent question — 'how does my inbox decide what to show me?' — and it is worth naming it plainly so a reader does not conflate the two. Spam filtering at the mailbox is receiver-side: it uses authentication (SPF, DKIM, DMARC), sender reputation, content signals and behavioural history to score each inbound message.

The two problems interact but are not the same job. Sender-side hygiene keeps your list clean so mailbox providers keep trusting you; receiver-side filtering decides what lands in someone else's inbox once it arrives. Buying a validation service will not clean up an inbox you read from, and buying a good email client will not clean up a list you send to. Confusing them wastes money in both directions.

Where AI Emaily fits — and where it doesn't#

We build AI Emaily, and this is a post about outbound list hygiene, so the honest thing to say up front is that AI Emaily is not the tool for this problem. It is a receiving-side email client — the inbox you read and reply from. It is not an email service provider, a list-validation service, a deliverability tester or a blocklist monitor, and it will not scrub traps out of a list or repair your sending reputation. Anti-abuse groups like Spamhaus have built harder on outbound reputation intelligence than we ever will, and if that is the job you have today, they and the validation vendors above are where to go.

The adjacent thing we actually do is on the mail that reaches you. AI Emaily reads sender authentication and behaviour on inbound messages so its spam and phishing protection can flag what does not belong in the inbox you work in — approve-before-send, undo, and a full audit trail on the actions the agent takes. That is a different job from protecting the list you send to, and we are not going to imply otherwise. AI Emaily comes with a 7-day free trial on the Pro and Autopilot plans (card required, $0 if you cancel before day 7); there is no free-forever plan.