How to Stop Spam Before It Starts

Filtering spam is fighting the symptom. Almost all of it exists because an address was handed over at some point and then travelled further than intended. Cutting the supply is far more effective than sorting the output, and it takes less effort.

Where unwanted mail comes from

Signups you have forgotten. The dominant source. A tool you tried once, a shop from four years ago, a forum you posted in twice. Each of them is still sending, and each has your address on a list somewhere.

Lists that were sold or shared. Many privacy policies permit sharing with "partners", which is a category with no fixed size. One address given to one company becomes an address held by dozens.

Breaches. Company databases leak regularly and end up in collections that are traded, combined and mined. Your address, once in one, is in all of them permanently.

Scraping. An address published anywhere public, including in a forum post or on a personal page, is harvested within days.

Notice that all four start the same way: you gave an address to somebody. That is the point where the problem can still be prevented.

How one signup becomes a dozen senders

The step people cannot picture is the middle one: the address left a company you recognise and arrived at companies you do not. Three routes account for most of it, and none of them requires anything illegal.

List rental. The company that holds your address never hands over the file. It sends a message on somebody else's behalf, which is why mail arrives advertising a brand you have never dealt with, sent through a platform belonging to one you have. The renter pays per send and, if you respond in any way, learns that the address is worth buying outright.

Co-registration. One form, several beneficiaries. A prize draw or a quiz carries a single line about sharing with sponsors, and the list of sponsors sits in a document nobody opens. From one tick, your address legitimately reaches every company on it, and each of them then counts as a sender you agreed to.

Appending. A company holding your name, postcode and phone number can buy the matching email address from a broker rather than ask you for it. The mail then arrives from an organisation you never gave an address to at all, which is exactly what it looks like.

Why some addresses attract mail nobody leaked

Volume also depends on the address itself, which surprises people.

Spammers guess. A list of common first names, surnames and role words is run against a domain, and whatever does not bounce goes on a list. Short and predictable local parts collect mail purely because they are easy to invent, without ever having been given to anyone.

Role addresses are the extreme case. Anything beginning with info, sales, contact, admin or support at a domain is assumed to exist and is mailed constantly.

The lesson applies wherever you get to choose. A distinctive local part attracts less unaddressed junk than a plain first name, and on this service the same logic has a second edge: an address nobody can guess is also an address nobody else can open while it exists.

The four habits that matter

Never give a real address for a one time need. A download, a code, a discount, a wifi login. These are relationships that end in five minutes and should cost an address that ends in five minutes.

Use a different address for each significant service. If you use aliases, make them specific. When unwanted mail arrives at the alias you gave to exactly one company, you know precisely who leaked it, and you can shut that alias off without touching anything else.

Do not publish an address as text. Anywhere public, in any format. Scrapers find it faster than people do.

Treat unsubscribe links from unknown senders with suspicion. For a legitimate company, unsubscribing works and is the right move. For a spammer, it confirms a live human reads that address, which makes it more valuable, not less. If you never signed up, mark it as spam instead.

What to do about the mail you already get

The supply lines are open, so this part is repair rather than prevention.

Sort by sender in your mail client and look at the largest sources first. Unsubscribe from the ones you recognise and once agreed to. Block the ones you do not.

For anything important still arriving at a compromised address, change the address on that account to an alias before you do anything else. Then the old address can be allowed to rot.

Do not delete an old address that important services still use, at least not until you have moved them. A deleted address bounces, and a bouncing recovery address is how people lose accounts.

Where a disposable address fits

It fits the first habit exactly. When something demands an address for a transaction that will be over in a minute, a disposable address satisfies the form, delivers the code, and then removes itself from existence. There is no list it can end up on afterwards, because there is no address.

It does not fit the others. For services you keep, you need something that lasts, and that means an alias or your real address with a filter.

A one hour cleanup that actually works

If your current inbox is unmanageable, this order gets the most result for the least effort.

Sort by sender, not by date. Almost every mail client can group this way. The top ten senders usually account for more than half the volume, and dealing with ten things is possible where dealing with four thousand is not.

Handle the top ten first. For each: unsubscribe if you recognise them and once agreed to it, block if you do not.

Move important accounts before deleting anything. Bank, employer, government, domain registrar, anything with money attached. Change the address on those to something you control permanently, and verify each change actually took effect.

Then set up a filter, not a rule per sender. One filter that files anything containing "unsubscribe" into a separate folder catches almost all marketing mail without you naming a single company.

Leave the old address alive. Deleting it makes messages bounce, and a bouncing recovery address is how people lose accounts. Let it rot quietly instead.

What to do the next time a form asks

The habit is one question, asked in the second before you type: will I want mail from these people again?

If yes, alias. If no, disposable. If you genuinely cannot tell, treat it as no, because upgrading later is easy and downgrading is not.

That question, asked consistently, is the whole of spam prevention. Everything else is cleanup.

The realistic outcome

You will not get to zero. Addresses already leaked stay leaked, and some services you genuinely want will always send more than you would like.

What changes is the direction. Right now, every month adds new senders to the pile. With the habits above, the pile stops growing, and the existing one slowly becomes irrelevant as those addresses are retired.