Equivocating about spamtraps
What is a spamtrap? According to a post I saw on Twitter:
By definition, a spam trap is an email address maintained by an ISP or third party, which neither clicks nor opens emails, meaning it does not actively engage with the emails it receives.
That’s not the definition of a spamtrap at all.
A spam trap is an email address that does not belong to an actual person but still receives unsolicited bulk / commercial email. The usefulness of a trap is that there is no discussion about whether or not the recipient asked to receive the email. As no one owns that address, it could never legitimately be signed up to receive email.
Can someone else sign it up for email? Yes, but that’s not a legitimate opt-in.
Can some spammer create the email address? Yes, but that’s not a legitimate opt-in.
Can the address be scraped off a website? Yes, but that’s not a legitimate opt-in.
If you’re sending mail to an address without a legitimate opt-in, then you’re sending spam.
Traps are used as a way to identify senders who are sending mail without permission. The presence of a trap does not mean that the whole list is bad. It does not mean that no one gave permission to receive mail from that sender. But the presence of a trap does mean there is some problem with list management and hygiene resulting in some people getting mail they never asked to receive.
But the never existing address is only one type of trap. Some ISPs, and individuals, repurpose abandoned email addresses in order to identify poor senders. Sometimes they bounce emails to these addresses before repurposing them. Sometimes they just pull the MX out of DNS. Sometimes they just stop using it for a long period of time. In any case the idea is that any legitimate senders (personal correspondents and such) have stopped using that address and have moved onto whatever the new person’s email address is. After a certain period of time, anyone sending mail to that address doesn’t have any permission to send mail there. For bulk mail that implies the sender is spamming.
I am generally very careful in my language when talking with people. I don’t use the generic term spam trap very often, but instead talk about how an address might have gotten onto a list without permission.
For instance, I consider my original .com address a trap these days. I stopped signing it up to mailing lists sometime in the late 90s and while I still get some email there (primarily from discussion lists) anything commercial is spam because I didn’t ask for it. But when I’m reporting it I tell the upstream abuse address “this is an address I stopped using prior to 2000.”
I also have traps that are addresses that were only ever published on websites (mostly contact addresses) but those websites are no longer live. When I am reporting spam to those addresses I say “this is a contact address only used on a website and never used to sign up for mail.”
I have traps that are addresses that have never existed. Some of the web scrapers that spammers were using were so broken they created addresses that delivered to me. I have one that is infoggnn@. This is not a valid address, has never been a valid address, has never had a person behind it, but I still get tons of spam to it. When I am reporting spam to those addresses I say “this is an address created by a spammer when scraping another address off my website.”
I try to be clear in my language, but the reality is all of these addresses are spamtraps. They are addresses I never gave to anyone for commercial email. Even the address from pre-2000 wasn’t used to sign up for commercial mailing lists. I had a hotmail address I used at the time for commercial mail.
Spamtraps are not addresses that simply don’t engage with mail. In fact, there are some traps that will pull images and click on links. Not many, not frequently, but it is a false assumption that traps never engage with mail.
While I try to be clear when discussing different kinds of traps, I have to wonder why I spend so much time explaining and sidestepping calling the mail spam. It’s an address that delivers to me. I never gave it to whomever is sending to it. I never consented to receive mail there. So why am I protecting the spammer by pretending there’s some innocent explanation for why they’re spamming me?
More on Spamtraps