Red Flags: Spam Traps, Complaints & Blacklists

Three things damage your sender reputation faster than anything else: hitting spam traps, getting spam complaints, and landing on a blocklist. This article explains what each one is, how it happens, and how to prevent it or recover from it.

The three red flags

• Spam trap hits: you send to an address that exists only to catch bad senders.
• Spam complaints: readers click “Report spam” on your email.
• Blocklist listings: your IP address or domain appears on a public list of known spam sources.

Mailbox providers like Gmail and Outlook treat each of these as strong evidence that you send email people didn’t ask for.

Spam traps

What a spam trap is

A spam trap (also called a honeypot) is an email address that should never get wanted email. Mailbox providers, anti-spam groups and blocklist operators run them. Nobody signs up for anything with a trap address. So anyone who emails one either got the address the wrong way or kept it far too long. The trap’s owner records the hit and may share it with providers and blocklists.

There are three kinds:

Pristine traps

A pristine trap never belonged to a real person. It’s placed where only a machine would find it:

• hidden on web pages, where scrapers (programs that copy addresses from websites) collect it,
• slipped into data brokers’ lists,
• mixed into lists that shady vendors sell.

Hitting a pristine trap is serious, because there’s no innocent explanation. Nobody signed up with that address, so it was scraped, bought or made up. It can get you listed on major blocklists such as Spamhaus and damage your reputation at many providers at once.

Recycled traps

A recycled trap was once a real person’s address. Here’s how one comes about:

1. Someone uses jo@example.com every day.
2. They stop using it.
3. The provider closes the account. Email to it now bounces with a “user unknown” error (a 550 code).
4. After months of bounces, often 6 to 12, the provider turns the address into a trap.
5. Anyone still sending to it hits the trap.

A recycled trap hit means you kept emailing an address that bounced for months. Your bounce handling is broken, or you never clean your list. One hit does less harm than a pristine trap. Repeated hits show a deeper list problem, and the damage grows.

Typo traps

Typo traps sit on domains that look like big email providers with a spelling mistake:

• gmial.com instead of gmail.com
• yaho.com instead of yahoo.com
• hotmal.com instead of hotmail.com

A hit means your signup form accepted a mistyped address without checking it. Typo traps do less harm than the other two kinds, but many hits add up over time.

How to avoid spam traps

Pristine traps:

• Never buy, rent or scrape email lists. That’s the only way pristine traps get onto your list.
• Use double opt-in: send a confirmation email and add the address only after the person clicks the link.

Recycled traps:

• Remove hard bounces (permanent failures like “user unknown”) the first time they happen.
• Stop sending to addresses that soft bounce (fail temporarily) in three or more campaigns in a row.
• Remove people who haven’t opened or clicked in 180 days or more.
• Run your list through an email verification service now and then to catch closed accounts.

Typo traps:

• Check addresses on your signup form as people type them.
• Catch common typos: “Did you mean gmail.com?”
• Show the address back to the person so they can spot mistakes.
• Use double opt-in, so a mistyped address never gets confirmed.

How to spot a trap hit

You can’t tell which addresses on your list are traps. They look exactly like normal addresses on purpose. But you can spot the effects:

• A sudden blocklist listing, especially on Spamhaus.
• Trap hits in SNDS, Microsoft’s dashboard for senders.
• A sudden, steep drop in inbox placement with no other explanation.
• A warning from your ESP (email service provider). Some ESPs hear about trap hits from trap operators.

Spam complaints

What a complaint is

A complaint happens when a reader clicks “Report spam” or “Junk”. The provider records it. If the provider runs a feedback loop (a service that forwards complaints to the sender), you get a report too.

Your complaint rate is the number of complaints divided by the number of emails delivered. These are common rules of thumb:

Complaint rate	Status	What to do
Below 0.05%	Healthy	Keep doing what you’re doing
0.05–0.1%	Raised	Find the cause
0.1–0.3%	Dangerous	Act now
Above 0.3%	Critical	Pause sending and fix the cause

0.3% sounds tiny. But it’s 30 complaints for every 10,000 emails. It’s also the limit Gmail and Yahoo set for bulk senders, and going over it seriously hurts your inbox placement.

Why people complain

1. They didn’t sign up, or forgot that they did. This is the most common reason. The address came from a bought list, from co-registration (signing up for one thing and getting email from another company), or from a signup long ago.
2. Unsubscribing is hard. If the link is hidden, broken, or needs a login, people click “Report spam” instead. It’s quicker.
3. The email isn’t what they expected. Someone signed up for weekly tips and gets daily sales emails.
4. You send too often. Even happy subscribers complain when email piles up.
5. They don’t recognise you. An unfamiliar From name or a vague subject line looks like spam.

How to reduce complaints

Make unsubscribing easy:

• Put a clear unsubscribe link in every email.
• Add one-click unsubscribe headers, so Gmail and Yahoo can show their own unsubscribe button:

List-Unsubscribe: <https://newsletter.example/unsubscribe?id=8f3a2c>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The first line gives the address that unsubscribes this reader. The second line tells the provider that a single click is enough, with no extra page to fill in.

• Don’t ask people to log in or give a reason.
• Process unsubscribes the same day.

Set expectations at signup:

• Say what you’ll send and how often.
• Show a sample email.
• Let people choose how often they hear from you.
• Send a welcome email straight away.

Send what people signed up for:

• If they asked for blog posts, send blog posts.
• If they asked for weekly, send weekly.
• Don’t add people to other lists without asking.

Be easy to recognise:

• Use your brand name as the From name.
• Keep the same From address in every campaign.

Act on feedback loop reports at once:

• Sign up for every feedback loop you can, such as Microsoft’s JMRP and Yahoo’s CFL.
• Stop emailing anyone who complains, automatically.
• Never email them again unless they sign up again.

Blocklists

How blocklists work

A blocklist (also called a blacklist) is a database of IP addresses and domains linked to spam. Anti-spam organisations run them. When your email arrives, the receiving server looks up your sending IP, and often the domains in your links, on one or more blocklists. If it finds a match, it may reject your email or send it to spam.

The main blocklists

Spamhaus is the most influential. Most big providers and many company mail systems use its data. It runs several lists:

• SBL: IPs that Spamhaus’s investigators have found sending spam.
• XBL: IPs of hacked or infected machines that send spam. It includes data from the CBL (Composite Blocking List).
• DBL: domains found in spam, both sending domains and domains in links.

A Spamhaus listing can stop almost all of your email from being delivered. To get removed, fix the cause first. Then look up your IP or domain on Spamhaus’s website and follow its removal steps. Spamhaus may ask what you changed.

Barracuda (BRBL) is popular with email gateways (filtering systems that sit in front of company mail servers) and smaller providers. A listing mostly affects email to businesses. You can ask for removal on Barracuda’s website, and requests are usually handled quickly.

SpamCop lists IPs based on spam reports that people send it. Fewer providers use it than Spamhaus. A listing expires on its own about a day after the reports stop, so the fix is to stop whatever caused them.

You may still see SORBS in older guides and tools. It shut down in 2024, so you can ignore it.

How to stay off blocklists

Each habit prevents a different kind of listing:

• Collect addresses cleanly: no pristine traps.
• Keep complaints low: no complaint-based listings.
• Remove bounces quickly: no recycled traps.
• Keep your servers and accounts secure: nobody hijacks them to send spam.
• Keep volume steady: no sudden spikes that automated systems flag.

Getting removed from a blocklist

1. Find out which list and what’s listed: an IP, a domain, or a link domain.
2. Check the scope. Is it one IP, all your IPs, or your domain?
3. Find the cause. Look at recent campaigns for complaint or bounce spikes, or anything you changed.
4. Fix the cause. Remove the bad list segment, fix the setup, or secure the hacked system.
5. Ask for removal using that blocklist’s own process.
6. Check it worked. Confirm the listing is gone and delivery has recovered.
7. Stop it happening again. Add monitoring and safeguards for that cause.

If providers are rejecting your email outright, see Incident: Block Bounces.

Watching for listings

Use an automated blocklist monitor:

• Check your sending IPs against Spamhaus, Barracuda and SpamCop.
• Check your sending domains and link domains against Spamhaus DBL, SURBL and URIBL.
• Set up an alert for any new listing.
• Check at least every few hours. A listing can do damage quickly.

When red flags pile up

The worst case is when all three red flags hit together. It usually starts with one bad decision, such as mailing a bought list:

1. The bought list contains spam traps, which leads to a blocklist listing.
2. People who never signed up complain, and the complaint rate shoots past 0.3%.
3. The listing and the complaints lead to more listings.
4. Your email goes to spam or gets blocked, so even your loyal readers stop seeing it.
5. Engagement falls, so providers lower your reputation further.
6. Recovery takes weeks, and you lose sales and customers along the way.

This can all happen within a day or two. Preventing it is far cheaper than recovering from it.

Checklist

Go through this list regularly:

• The complaint rate is below 0.05% for each campaign.
• You’re not listed on Spamhaus, Barracuda or SpamCop.
• Hard bounces are removed the first time they happen.
• Your active lists have no one who hasn’t engaged in 180 days.
• Your signup forms check address format and catch typo domains.
• Feedback loop complaints are removed within 24 hours.
• DMARC reports show no unexpected authentication failures.
• Your spam rate in Google Postmaster Tools is below 0.1%.
• SNDS doesn’t show yellow or red for any of your IPs.
• Nobody on your team buys, rents or scrapes lists. Ever.