How Spam Emails Actually Work — And How to Stop Them

Spam feels random because it arrives from unknown senders about products you've never heard of. But the spam ecosystem is highly organized, commercially motivated, and surprisingly sophisticated. Once you understand how it actually works, you can make much more effective decisions about protecting your inbox.

Where your address comes from: the list supply chain

Every spam campaign starts with a list. Building or buying that list is the foundational step, and there are several established channels for it.

Data breaches are the largest source of fresh email addresses on underground markets. When a company is breached, the extracted database — which almost always includes email addresses — gets packaged and sold. A single large breach can supply tens of millions of addresses to spam operations within weeks.

Web harvesting uses automated bots that crawl the public internet looking for anything that matches the pattern of an email address. Forum posts, social media profiles, company websites, academic papers, press releases, comment sections — anywhere an email address appears in plain text, a harvester will collect it.

Co-registration is one of the less-discussed methods. When you sign up for a service and accept their terms of service, you may be consenting (buried in the legal text) to your email being shared with "partners." Some services make their primary revenue not from the product they offer but from monetizing the signup data they collect.

How spam is actually sent

Here's what surprises most people: major spam campaigns aren't sent from the spammer's own servers. If they were, those servers would be identified and blacklisted within hours.

Instead, spam is sent through botnets — large networks of compromised computers belonging to ordinary people. When a device gets infected with certain types of malware, it can be recruited into a botnet and used to send thousands of emails per day. The device owner typically has no idea this is happening.

This is why spam appears to come from thousands of different IP addresses and sender domains. The sending infrastructure is constantly rotating, making blanket IP blocking ineffective. By the time a spam IP gets blacklisted, the campaign has already moved to different infrastructure.

Why spam filters aren't enough on their own

Spam filters have become very sophisticated, but they're fighting an arms race with an adaptive adversary. Spammers constantly modify their techniques to evade current filter signatures: using image-based content instead of text, introducing deliberate misspellings, rotating sending domains, or structuring emails to look like legitimate newsletters.

More importantly, spam filters can only catch email after it arrives. They don't prevent your address from being on the list in the first place. A filter that catches 99% of spam still lets 1% through — and if you're receiving thousands of spam emails a month, that's still dozens reaching your inbox.

The only reliable prevention

The only approach that reliably prevents spam is keeping your real email address off spam lists in the first place. This means being selective about who gets it.

For any signup where you don't need ongoing access — downloading a resource, trying a free tier, entering a competition, accessing a one-time offer — a disposable email address is the appropriate tool. The disposable address receives whatever confirmation email you need, and if it ends up on a spam list afterward, it doesn't matter. Your real inbox is never involved.

For your existing address, if it's already heavily spammed, the most effective long-term solution is separating it from future signups. Keep it for genuine ongoing relationships, use a secondary address for lower-trust signups, and use disposable addresses for everything else.

What to do if your inbox is already overloaded

If you're dealing with a heavily spammed inbox right now, a few things actually help. Your email provider's unsubscribe feature (built into Gmail, Outlook, and Apple Mail) is more reliable than clicking unsubscribe links inside emails — the latter can confirm your address is active. For senders you've never interacted with, delete without engaging. Clicking anything in a spam email, including the unsubscribe link, confirms to the sender that your address is active.

Creating inbox filters that automatically archive or delete recurring spam senders provides short-term relief. But for a long-term clean inbox, the habit change matters more than any filter: stop giving your real address to low-trust services going forward.