How to stop spam email: what works, and what makes it worse

Where the spam actually came from

There are four ways an address ends up on a list, and they leave different fingerprints. Which one it was matters more than it sounds, because the remedy is different in each case — and three of the four cannot be undone after the fact, which is the entire argument of the last half of this guide.

Three of those four rows end in the same admission: once an address is on a list, it is on the list. There is no authority to appeal to, no central opt-out that a spammer honours, and no button anywhere that recalls it. What you can still change is what you hand over next — which is why this guide ends where it does rather than with a longer list of filters.

The unsubscribe link: when it works, and when it confirms you exist

Unsubscribing from a company you really did sign up with works, and works quickly — because since 2024 the large mailbox providers have made it a condition of delivery rather than a courtesy. A sender pushing bulk mail at Gmail, Yahoo Mail or Outlook.com has to offer a one-click unsubscribe, act on it within two days, authenticate its mail and keep complaints under about a third of a percent. A sender who ignores that stops arriving at all. From your side of the wire, compliance looks like this:

From: "Example Shop" <news@example.com>
List-Unsubscribe: <https://example.com/u/8f21c4>,
        <mailto:unsubscribe@example.com?subject=unsub-8f21c4>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Authentication-Results: mx.example.org;
        spf=pass smtp.mailfrom=mail.example.com;
        dkim=pass header.d=example.com;
        dmarc=pass header.from=example.com

Two of those lines are the mechanism. List-Unsubscribe declares where to opt out, in a header rather than in the prose; List-Unsubscribe-Post says the sender will accept a single POST as the entire conversation, with no page to load and no form to fill in. That pair is what your mail app reads to draw an Unsubscribe link beside the sender's name — and it is a different request from the one in the body of the message.

Which turns a decision that feels risky into one with three outcomes:

There is an unsubscribe button beside the sender's name

Use it. Your provider makes the request, the sender learns only that one address opted out, and Gmail and Outlook.com both record the click as a signal about that sender.

There is no button, but you are certain you have an account there

Open the message with remote images off, check in the header that dmarc=pass names the brand's own domain, and then use the link. The certainty is doing the work here, not the link.

You never signed up, or the header does not check out

Click nothing in it. Report it as spam and close it. The link is a tracking URL, it is unique to you, and following it is exactly how a list that guessed your address confirms the guess.

The mailto: form in the same header exists for the same purpose and is safe in the same cases — it sends a bare message and takes no browser with it. It is also the form nothing has implemented well in twenty years, so treat it as a fallback rather than a plan.

Mark as spam, block or delete: what your provider learns from each

Four controls sit within a centimetre of one another in every mail app, and they do four unrelated things. Only one of them makes next month quieter.

Mark as spam / Report spam

The only one that trains anything. Your own filter learns from it at once, and the report is pooled with everybody else's: a sender whose complaint rate crosses roughly a third of a percent starts landing in the spam folder for people who never complained at all. It is the most effective button on this page.

Block sender

A rule inside your account only, matched against an address or a domain the sender chose and can change in a second. Useful against one persistent human, useless against a campaign — which is why the same offer returns from news-2@ the following week.

Delete

Teaches nothing at all. The message is gone and the filter is exactly as wrong as it was a moment ago, so the next one lands in the inbox too. This is the most common mistake in this article.

Move it to a folder, or filter it away

Hides the problem from you and from the filter in one movement. Worth doing for mail you asked for and do not want to see; actively counterproductive as a way of dealing with mail you never asked for.

Report phishing

A different pipeline from spam at both Google and Microsoft, with people and takedown requests at the end of it. Use it when a message is impersonating somebody — a bank, a colleague, a delivery firm — rather than merely selling something.

There is a fifth control, and it counts as much as the first: moving a message out of the spam folder is also training. A newsletter you rescue teaches the filter that this sender is wanted, in your account and in the aggregate. It is why a filter you have used honestly for a year is better than one you have never touched.

Ten seconds in the header, before you decide anything

Everything above turns on a single question — is this sender who it says it is — and the answer is three lines of text that every mail app can show you. Here is the same shop as before, except that it is not:

From: "Example Shop" <news@examp1e-shop.net>
Return-Path: <b7f2@mailer-4471.example.net>
Authentication-Results: mx.example.org;
        spf=pass smtp.mailfrom=mailer-4471.example.net;
        dkim=none;
        dmarc=none

Nothing there is a forgery in the technical sense. spf=pass is perfectly true: the sender really does control mailer-4471.example.net and really did authorise itself to send from it. What is missing is any statement at all about example.com, whose name is in the display line and whose brand the message is wearing. Four things to look at, in this order:

1. The address, not the name. Example Shop is free text that a sender types. The part in angle brackets is the claim — and here it reads examp1e-shop.net, with a digit standing in for a letter.
2. dmarc=, and whose domain it names. dmarc=pass header.from=example.com means the brand's own domain vouched for this message. dmarc=none means nobody did. A pass on a domain other than the one in From: proves only that a stranger owns a domain.
3. Return-Path: against From:. Real bulk senders route bounces through their own sending infrastructure, so the two rarely match exactly. What should match is the organisation: mail.example.com under example.com is normal, mailer-4471.example.net under it is not.
4. Whether there is a List-Unsubscribe at all. Its absence from something claiming to be a marketing message is itself the answer — a real bulk sender cannot afford to leave it out any more.

What opening it gives away, before you touch anything

A message you never asked for is a question about you, and answering it costs the sender nothing and you something. Four things leave the moment you open one with images on:

• That the address is live and read by a person. The single most valuable fact about any address on a list, and the one that decides whether it gets sold on.
• When you read it, and how often. The pixel is requested every time the message is displayed, not once.
• Roughly where you are, and what you read on. The request carries an IP address and a user agent like any other.
• Which of their messages you opened. The URL is unique per recipient, so the answer is per-address rather than in aggregate.

Every mainstream provider now proxies remote images, which blunts the location half of that but not the confirmation half: the request still happens, and it still says that an address opened the message. Blocking images until you ask for them is a setting in every mail app and the best default on this page. Email tracking pixels covers the mechanism, and what blocking them does and does not buy. Here they are blocked by the policy the message is served under rather than by editing it, so there is nothing to switch on.

The only fix that scales: a different address per service

Every control above is a way of reacting to mail that has already arrived at an address the sender already has. The one approach that reduces the volume rather than sorting it is to make the address itself expendable — so that a leak names the service that leaked it and can be cut without touching anything else. There are four ways to do that, and they differ in ways worth knowing before you pick one:

The choice is not between them once and for all; it is made per sign-up, and the question that settles it is the one from burner, alias or temp mail: would you mind losing this account? For a shop you will buy from once, a disposable address is both the right answer and the cheapest. For your bank it is a catastrophe. For the two hundred sign-ups in between, an address on a domain you own is the one that keeps working.

A plus tag is on this list because it is what people reach for first, not because it belongs above the others. It sorts mail beautifully and hides nothing at all.

The address that is already out there

An address that is on the lists is on them for good, and starting again from a blank one is worth less than it feels: a new address collects the same lists in about the same time, unless what you hand over changes as well. So the useful move is not a fresh start but a triage, in this order:

1. Stop making it worse. Do not publish it in plain text on a page, do not use it as the public contact for a domain, and give the next form something else.
2. Move what you cannot afford to lose. Banking, government, your domain registrar, and above all the recovery address on your other accounts. That is a short list, and it is the whole reason to do any of this.
3. Change the recovery address first, the login address second. In that order, every time. Doing it the other way round is how people lock themselves out of the account they were trying to protect.
4. Leave the rest alone. Two hundred shopping accounts do not need migrating. Let them keep the old address, and let the old address become the one you skim rather than the one you live in.
5. Then let the filter work. Report rather than delete, rescue whatever was wrongly caught, and give it a month. A filter you have trained honestly beats any rule you can write by hand.

The point of a triage is that it ends. There is no version of this where the old address becomes clean again; there is a version where it stops mattering, and it takes an afternoon.

The short version

1. Prefer the Unsubscribe button your mail app puts beside the sender's name to the link inside the message.
2. Unsubscribe only from senders you can prove: dmarc=pass on the domain that is in From:.
3. Click nothing at all in a message you never signed up for. The link is the measurement.
4. Report as spam rather than deleting. Deleting teaches your filter nothing.
5. Rescue wrongly filtered mail as well — that is training too, in the other direction.
6. Turn remote images off by default, in every mail app you use.
7. Give the next sign-up an address that exists only for it: a tag if that is all you have, an address on your own domain if you can, a disposable one if you never want to hear from them again.

The first six make this month quieter. The seventh is the only one that makes next year quieter.

Questions