How to Stop Spam Emails: A Practical Playbook That Actually Works

To stop spam emails, you need to cut off the sources that leak your address, let your provider's filter do the heavy lifting, add your own rules for what slips through, and unsubscribe only from legitimate senders. The single most effective long-term habit is to stop handing your real address to sites you do not fully trust, and use a temporary inbox such as VookMail for those sign-ups instead. This playbook walks through every layer, in the order that gives the fastest results.

Key takeaways

• Spam is a supply problem. Most spam reaches you because your address was shared, sold, leaked in a breach, or scraped from a public page. Reducing where your address appears is more effective than any filter.
• Use the "Report spam" button, not delete. Reporting trains your provider's filter and lowers the sender's reputation; deleting teaches it nothing.
• Unsubscribe only from senders you recognize. For unknown senders, clicking a link can confirm your address is live.
• Build a few precise filters rather than dozens of vague ones, and review your spam folder weekly for false positives during the first month.
• Split your identity: a primary address for important accounts, and a disposable address for one-off downloads, forums, coupons and trials of tools you are evaluating.
• Never use a disposable address for banking, government, work or primary social accounts, because you will lose access when the inbox expires.

What counts as spam, exactly?

Spam is unsolicited bulk email: messages sent in large volumes to people who did not ask for them. That definition matters because it separates three very different problems that people lump together:

1. True spam from senders you never dealt with: fake pharmacies, "you have won" notices, crypto schemes, SEO offers, and so on.
2. Graymail: newsletters and promotions you technically agreed to at some point, often by leaving a pre-ticked box checked. These are legal in most places and usually honor an unsubscribe request.
3. Malicious email: phishing, malware attachments, invoice fraud and impersonation. These are a security issue first and a clutter issue second.

Each needs a different response. Graymail is solved by unsubscribing. True spam is solved by filtering and reporting. Malicious email is solved by filtering, reporting, and never interacting. If you treat everything the same way, for example by clicking unsubscribe on a phishing message, you can make the situation worse.

Where does spam come from? Diagnose before you fix

Before changing settings, spend ten minutes working out how your address is leaking. Spammers get addresses in a small number of predictable ways:

• Data breaches. When a service you used is breached, its user list, often including email addresses, can end up in collections traded among spammers. Breach notification services let you check whether your address appears in known breaches.
• List selling and "partner" sharing. Some sites share or sell sign-up data. The privacy policy usually discloses this with phrases such as "trusted partners" or "third parties for marketing purposes".
• Scraping. Bots crawl websites, forum posts, public profiles, code repositories and PDF documents looking for anything that matches the pattern of an email address.
• Dictionary and guessing attacks. Spammers generate common names at popular domains (for example first names, first.last combinations, info@, sales@) and send to all of them. Short and common addresses get more of this.
• Sign-up forms you forgot. Contests, Wi-Fi portals, free downloads, browser extensions, and "enter your email to see the result" quizzes.
• Infected contacts. Malware on a friend's device can harvest their address book, including you.

How to trace the source with plus-addressing

Many providers, including Gmail and Outlook, support plus-addressing (also called subaddressing): mail sent to yourname+shopname@example.com lands in yourname@example.com. If you register at a shop with a tagged address and later receive spam addressed to that exact tag, you know who leaked or shared it. The limitation is that it does not hide your real address; anyone can strip the tag and some spammers do exactly that. It is a diagnostic tool, not a shield.

How to read email headers to find the real sender

The visible "From" name is trivial to fake. The headers tell you more. In most webmail clients, open the message menu and choose "Show original" or "View message source". Look for:

• Received: lines, read from bottom to top, show the chain of servers the message passed through.
• Authentication-Results: shows whether the message passed SPF (was it sent from a server the domain authorizes?), DKIM (is the cryptographic signature valid?), and DMARC (does the visible From domain align with the authenticated domain?).
• Return-Path: the envelope sender, where bounces go. A mismatch with the From address is not proof of spam, but combined with failed authentication it is a strong sign.
• List-Unsubscribe: legitimate bulk senders include this header so your client can show a one-click unsubscribe button.

A message that claims to be from your bank but fails DMARC is almost certainly forged. A newsletter that passes all three checks and has a List-Unsubscribe header is probably graymail you can safely unsubscribe from.

Step-by-step: how to stop spam emails in your current inbox

Here is the order that gives the biggest improvement for the least effort.

Step 1: Turn on and trust your provider's spam filter

Large mailbox providers run filters trained on enormous volumes of mail, and they see campaigns across millions of users at once. Your own rules can never match that. Make sure filtering is not disabled, and check that you have not created old rules that bypass it, such as "never send to spam" rules for broad domains. If you use a desktop client with a custom IMAP setup, confirm that server-side filtering is still on; the client's local junk filter is a second layer, not a replacement.

Step 2: Report, do not just delete

When spam reaches your inbox, use "Report spam" or "Junk". Providers use these reports in two ways: as training data for the classifier that decides what you see, and as reputation signals against the sending domain and IP address. Bulk senders whose messages get many complaints see more of their mail filtered for everyone. Deleting leaves no signal at all.

Equally important: when a real message lands in spam, mark it "Not spam". False negatives and false positives both teach the filter.

Step 3: Unsubscribe from graymail, in bulk

Search your inbox for the word "unsubscribe" and sort by sender. You will typically find a few dozen senders responsible for most of the clutter. For each one you recognize:

1. Use your client's built-in unsubscribe button if it appears near the sender's name. It uses the List-Unsubscribe header, so you do not need to visit the sender's site.
2. If there is no button, use the unsubscribe link in the footer, but only after checking that the link points to the sender's own domain or a well-known email service provider.
3. Never enter a password on an unsubscribe page. A legitimate unsubscribe needs at most your email address, and usually not even that.
4. Give it time. Many jurisdictions allow senders several business days to process a request.

Step 4: Block persistent individual senders

Blocking works well against a single sender who keeps using the same address, such as a company that ignores unsubscribe requests. It works poorly against true spam, which rotates sender addresses constantly. Do not spend time blocking every spam address; report it instead.

Step 5: Create a small set of precise filters

Filters (called rules in Outlook) let you act on patterns your provider's filter misses. Good filters are narrow. Examples that are usually safe:

• Messages containing a phrase that only ever appears in a specific recurring spam campaign you keep receiving.
• Mail sent to a plus-address tag you used for a site that has since leaked it, for example everything to yourname+oldshop@ goes straight to trash.
• Messages from a domain you never do business with that keeps getting through.

Filters that are usually a mistake: blocking whole countries' top-level domains, blocking single common words like "free" or "offer", and blocking everything with an attachment. These cause false positives that are hard to notice because you never see the mail you lost.

Step 6: Review the spam folder weekly for a month

After you change rules, check the spam folder once a week. You are looking for legitimate messages that were misfiled. Most providers delete spam automatically after around 30 days, so a weekly check is enough to catch mistakes before they disappear.

How do I stop spam from reaching me in the first place?

Cleaning an inbox is reactive. Prevention keeps it clean. The core idea is address compartmentalization: you do not give the same address to your bank and to a random forum.

Use a primary address only where it matters

Your primary address should be reserved for accounts where losing access or missing a message would genuinely hurt: banking, government services, employers, healthcare, your main cloud account, your domain registrar, and people you know. Keep this list short and deliberate.

Use a temporary email for low-trust, one-off sign-ups

A temporary email (also called disposable email or throwaway email) is an inbox you can use immediately without registering, which expires after a short time. It is ideal when a site requires an address just to show you something once: a whitepaper download, a forum thread you want to read, a one-time verification code for a tool you are trying out, or a Wi-Fi portal.

With VookMail, an address is created automatically the moment the page loads. There is no sign-up and no password. You can:

1. Open vookmail.com and use the address shown, or type your own username and pick one of about 31 domains, such as privoxmail.com, veylax.com or mailnexio.com.
2. Press the yellow shuffle button if you want a random address instead.
3. Click the copy button and paste the address into the site's sign-up form.
4. Watch the inbox; it updates in real time, so confirmation codes and links appear without reloading. Attachments are supported.
5. If you are signing up on your phone but reading on your computer (or the other way round), scan the QR code to open the same inbox on the other device.
6. When you are done, use Delete, or simply leave it: messages and attachments are removed automatically after about one day.

Whatever list that address ends up on, the spam never reaches your real inbox. That is the entire point: you are not filtering spam, you are making it impossible for it to find you.

Use plus-addresses or aliases for medium-trust accounts

Some accounts sit in between. A shop you buy from occasionally needs to reach you with receipts and shipping notices for months, so a one-day inbox is the wrong tool. For these, a tagged plus-address or an alias from your mail provider is better: messages keep arriving long-term, and if the address starts receiving spam you can filter or disable it.

Comparison: which address should you use where?

Stop publishing your address in plain text

If your address appears on a website, a public profile, a CV uploaded to a public site, a code repository, or a PDF, scrapers will find it. Options:

• Use a contact form instead of a mailto link on your own site, with server-side validation and rate limiting.
• If you must show an address, use a role address (for example contact@yourdomain) that you can filter aggressively or replace, rather than your personal one.
• In code repositories, configure your version control tool to use a no-reply or private commit email that the hosting platform provides.
• Remove old addresses from documents you control; scrapers revisit archived pages.

Obfuscation tricks like writing "name at domain dot com" stop the laziest scrapers but not determined ones. They help a little; they are not a solution.

Read the checkbox before you click "Sign up"

Many forms include a pre-ticked box for marketing or "partner offers". Unticking it takes one second and prevents a whole category of graymail. If a form makes marketing consent mandatory to use a basic feature, that is a good signal to use a temporary address for it.

How to unsubscribe safely without making spam worse

The advice "never click unsubscribe" is half right. It applies to true spam, not to legitimate senders. Here is a decision process:

1. Do you recognize the sender and remember signing up? If yes, unsubscribe. Legitimate senders process these requests, and in many jurisdictions they are legally required to.
2. Is it a real brand but you never signed up? Check authentication in the headers. If SPF, DKIM and DMARC pass for that brand's domain, unsubscribing is generally safe. If they fail, it is impersonation; report it as spam or phishing.
3. Is the sender unknown, or the content obviously spammy? Do not click anything. Report as spam. Clicking any link, including "unsubscribe", can tell the sender your address is real and actively read.
4. Does the unsubscribe page ask you to log in or enter personal details? Close it. That is a phishing pattern.

Why remote images matter

Spam and marketing emails often include a tiny invisible image, a tracking pixel, with a unique URL per recipient. When your client loads it, the sender learns that you opened the message, roughly when, and sometimes your approximate location from your IP address. Some providers now proxy images, which hides your IP but may still register an open. To reduce this, set your client to ask before loading remote images, or to block them by default for senders not in your contacts.

How to handle spam on a domain you own

If you run your own domain, whether for a small business or personal use, you have extra tools and extra responsibilities.

Publish SPF, DKIM and DMARC records

These DNS records do not directly reduce the spam you receive, but they stop spammers from successfully forging your domain, which protects your recipients and your domain's reputation, and they reduce the backscatter (bounce messages for mail you never sent) that lands in your own inbox.

• SPF is a TXT record listing the servers allowed to send mail for your domain, for example v=spf1 include:_spf.yourprovider.example -all. The -all at the end tells receivers to reject anything else.
• DKIM publishes a public key so receivers can verify a signature that your mail server adds to each outgoing message.
• DMARC tells receivers what to do when a message fails alignment: p=none (monitor only), p=quarantine (send to spam), or p=reject. Start with p=none and a reporting address, review the aggregate reports for a few weeks, then tighten.

Avoid catch-all mailboxes

A catch-all accepts mail for any address at your domain. It is convenient but turns every dictionary attack into delivered spam. Prefer explicit addresses and aliases, and let mail to unknown recipients be rejected at the SMTP stage.

Protect web forms

Contact and sign-up forms on your site are spam entry points too. Use server-side validation, rate limiting per IP, a hidden honeypot field that humans never fill, and double opt-in for mailing lists so a bot cannot subscribe arbitrary addresses. Double opt-in also protects you, because you will not end up sending mail to people who never asked for it.

How to recognize dangerous spam: a checklist

Some spam is not just clutter; it is an attack. Treat a message as suspicious if any of these apply:

• It creates urgency: account suspended, payment failed, package held, legal action, "within 24 hours".
• The display name is a known brand but the actual address is a free mail account or an unrelated domain.
• Links show one address in the text but hover reveals a different domain, often with extra words or hyphens added to a real brand name.
• It asks you to log in, confirm payment details, or "verify" your account through a link.
• It contains an unexpected attachment, especially compressed archives, documents asking you to "enable content" or macros, HTML files, or disk images.
• It asks you to buy gift cards, change bank details for an invoice, or keep the request secret.
• Authentication results in the headers show SPF, DKIM or DMARC failures for the domain it claims to come from.

If a message might be real, do not use its links. Open the service by typing its address yourself or using its official app, and check there. For requests involving money, verify by phone using a number you already have, not one in the email.

Common mistakes that make spam worse

• Replying to spam, even to say "stop". It confirms the address is live and reaches a real human.
• Forwarding spam to friends to warn them. Report it instead, and describe it in your own words if you want to warn someone.
• Using one address for everything. A single breach then exposes the address you rely on for banking.
• Creating dozens of broad filters, which silently delete legitimate mail.
• Disabling the spam filter because it once misfiled a message, instead of marking that message as not spam.
• Entering your address in "check if your email was hacked" sites you do not know. Use well-known breach notification services only.
• Using a temporary address for an account you will need again. When the inbox expires, you cannot receive password resets. Temporary email is for one-off use.
• Installing "spam blocker" browser extensions or apps that request full access to your mailbox, without checking who makes them and what they do with your data.

A 30-minute cleanup routine

If your inbox is already overwhelmed, this routine gives most people a dramatic improvement in one sitting:

1. Minutes 0 to 5: Search for "unsubscribe", sort by sender, and list the top 20 senders by volume.
2. Minutes 5 to 15: Unsubscribe from the recognized ones using the built-in unsubscribe button. Report the unrecognized ones as spam.
3. Minutes 15 to 20: Bulk-archive or delete everything older than a few months from those senders.
4. Minutes 20 to 25: Create two or three precise filters for the patterns that remain.
5. Minutes 25 to 30: Bookmark a temporary email generator so the next time a site asks for an address just to show you something, you do not reach for your real one.

Ongoing habits: the weekly and monthly checklist

Every time you sign up somewhere

• Ask: will I need this account in a month? If not, use a disposable address.
• Untick marketing and partner boxes.
• Skim the privacy policy section about sharing with third parties.

Weekly

• Scan the spam folder for false positives and mark them "Not spam".
• Report anything that slipped into the inbox.

Monthly

• Unsubscribe from any newsletter you have not opened in the past month.
• Review your filters and delete any that no longer match anything.
• Check a breach notification service for your primary address.

Edge cases: when the standard advice does not apply

Spam that appears to come from your own address

This is almost always forgery. SMTP lets any sender write any From address, and the message may even claim to be from you with a threat about "hacking your account". Check the headers: it usually fails authentication. Mark it as spam. Change your password only if you have other evidence of compromise, such as sent messages you did not write or unknown login sessions; in that case also enable two-factor authentication and review forwarding rules, because attackers often add a hidden rule that forwards your mail elsewhere.

A sudden flood of sign-up confirmations

If you suddenly receive hundreds of "welcome" or "confirm your subscription" emails, someone may be subscribing your address to many lists at once. This is sometimes used to bury a real alert, such as a purchase or password change notification, under noise. Before cleaning up, search the flood for security notices from your bank, shops and email provider, and check your important accounts directly. Then create a temporary filter for common confirmation phrases while it subsides.

Spam in a shared or family mailbox

Filters learn from everyone who reports. If one person marks newsletters as spam while another wants them, the filter gets mixed signals. Agree on a rule: unsubscribe from what nobody wants, and filter what only some want into a separate label.

Calendar and file-sharing spam

Spammers also abuse calendar invitations and document-sharing notifications, because they arrive from legitimate services and pass authentication. Configure your calendar to only add invitations from known senders automatically, and do not open shared documents from people you do not know.

Why temporary email is a prevention tool, not a loophole

Temporary email is sometimes misunderstood as a way to cheat sites. Its legitimate value is privacy and spam control: you control who gets a long-lived way to contact you. That is the same principle as not giving your phone number to every shop cashier who asks.

There are limits you should respect. Some large platforms block disposable domains, and you should not try to work around that; it is their decision and their terms. A disposable address should never be used for fraud, abuse, evading a ban, or creating accounts that break a site's rules, including repeated sign-ups to claim the same free trial or promotion multiple times. And it should never be used for anything important, because the inbox and its messages are gone after about a day. You can read more about how VookMail handles messages in its privacy policy and the acceptable uses in the terms and conditions.

Used within those limits, a temporary inbox is one of the few anti-spam measures that works before spam exists rather than after.

How the layers fit together

Think of spam defense as layers, each catching what the previous one misses:

If you only do two things, do the first and the third: protect your address and report what gets through. For more guides on email privacy, browse the VookMail blog.

Frequently asked questions

Can you completely stop spam emails?

No single step stops all spam, but combining a good provider filter, safe unsubscribing, custom rules, reporting, and keeping your real address private with a temporary email for low-trust sign-ups reduces spam to a trickle for most people.

Is it safe to click unsubscribe in a spam email?

Only for senders you recognize and actually signed up with. For unknown or obviously malicious senders, do not click anything; mark the message as spam instead, because clicking can confirm your address is active.

Why do I get spam from my own email address?

Usually the From header has been forged. Email lets the sender write any From address, and SPF, DKIM and DMARC checks are what catch forgeries. Mark it as spam and, if you own the domain, publish a strict DMARC policy.

Does marking email as spam actually help?

Yes. Major providers use spam reports as training signals for their filters and as reputation signals against the sending domain and IP, so consistent reporting improves filtering for you and for other users.

How does a temporary email help stop spam?

A temporary email address such as one from VookMail receives confirmation messages for low-trust sign-ups and then expires, along with its messages, after about a day. Any list that address ends up on never reaches your real inbox.

Should I change my email address to escape spam?

Only as a last resort. A new address helps if the old one is on many lists, but without new habits it will fill up too. Migrate important accounts gradually and protect the new address from the start.

Are spam emails dangerous?

Many are only annoying, but some carry phishing links, malicious attachments or payment scams. Never open unexpected attachments, verify requests through a separate channel, and never enter passwords from a link in an email.