Equivocating about spamtraps

What is a spamtrap? According to a post I saw on Twitter:

By definition, a spam trap is an email address maintained by an ISP or third party, which neither clicks nor opens emails, meaning it does not actively engage with the emails it receives.

That’s not the definition of a spamtrap at all.
A spam trap is an email address that does not belong to an actual person but still receives unsolicited bulk / commercial email. The usefulness of a trap is that there is no discussion about whether or not the recipient asked to receive the email. As no one owns that address, it could never legitimately be signed up to receive email.
Can someone else sign it up for email? Yes, but that’s not a legitimate opt-in.
Can some spammer create the email address? Yes, but that’s not a legitimate opt-in.
Can the address be scraped off a website? Yes, but that’s not a legitimate opt-in.
If you’re sending mail to an address without a legitimate opt-in, then you’re sending spam.
Traps are used as a way to identify senders who are sending mail without permission. The presence of a trap does not mean that the whole list is bad. It does not mean that no one gave permission to receive mail from that sender. But the presence of a trap does mean there is some problem with list management and hygiene resulting in some people getting mail they never asked to receive.
But the never existing address is only one type of trap. Some ISPs, and individuals, repurpose abandoned email addresses in order to identify poor senders. Sometimes they bounce emails to these addresses before repurposing them. Sometimes they just pull the MX out of DNS. Sometimes they just stop using it for a long period of time. In any case the idea is that any legitimate senders (personal correspondents and such) have stopped using that address and have moved onto whatever the new person’s email address is. After a certain period of time, anyone sending mail to that address doesn’t have any permission to send mail there. For bulk mail that implies the sender is spamming.
I am generally very careful in my language when talking with people. I don’t use the generic term spam trap very often, but instead talk about how an address might have gotten onto a list without permission.
For instance, I consider my original .com address a trap these days. I stopped signing it up to mailing lists sometime in the late 90s and while I still get some email there (primarily from discussion lists) anything commercial is spam because I didn’t ask for it. But when I’m reporting it I tell the upstream abuse address “this is an address I stopped using prior to 2000.”
I also have traps that are addresses that were only ever published on websites (mostly contact addresses) but those websites are no longer live. When I am reporting spam to those addresses I say “this is a contact address only used on a website and never used to sign up for mail.”
I have traps that are addresses that have never existed. Some of the web scrapers that spammers were using were so broken they created addresses that delivered to me. I have one that is infoggnn@. This is not a valid address, has never been a valid address, has never had a person behind it, but I still get tons of spam to it. When I am reporting spam to those addresses I say “this is an address created by a spammer when scraping another address off my website.”
I try to be clear in my language, but the reality is all of these addresses are spamtraps. They are addresses I never gave to anyone for commercial email. Even the address from pre-2000 wasn’t used to sign up for commercial mailing lists. I had a hotmail address I used at the time for commercial mail.
Spamtraps are not addresses that simply don’t engage with mail. In fact, there are some traps that will pull images and click on links. Not many, not frequently, but it is a false assumption that traps never engage with mail.
While I try to be clear when discussing different kinds of traps, I have to wonder why I spend so much time explaining and sidestepping calling the mail spam. It’s an address that delivers to me. I never gave it to whomever is sending to it. I never consented to receive mail there. So why am I protecting the spammer by pretending there’s some innocent explanation for why they’re spamming me?
More on Spamtraps

Related Posts

Are you sure? Part 2

There was a bit of discussion about yesterday’s blog post over on my G+ circles. One person was telling me that “did you forget you opted-in?” was a perfectly valid question. He also commented he’s had the same address for 20 years and that he does, sometimes forget he opted in to mail years ago.
As an anti-spammer with the idea that it’s all about consent, I can see his point. Anti-spammers, for years, have chanted the mantra: “it’s about consent, not content.” Which is a short, pithy way to say they don’t care what you send people, as long as the recipients themselves have asked for it.
This is the perfect bumper sticker policy. As with most bumper sticker policies, though, it’s too short to deal with the messy realities.
I’m not knocking consent. Consent is great. Every bulk mailer should only be sending mail to people who have asked or agreed to receive that mail.
But if your focus is on delivery and getting mail to the recipient’s inbox and getting the recipient to react to that mail then you can’t just fall back on consent. You have to send them mail that they expect. You have to send them mail that they like. You have to send them mail they will open, read and interact with.
If your permission based recipients are saying they forgot that they signed up for mail, that is a sign that the sender’s program is futile. These are people who, at one point or another, actually asked to receive mail from a sender, and then the mail they receive is so unremarkable that they totally forget about the sender.
Maybe that’s another reason the question “are you sure you didn’t forget you opted in” from clients bothers me so much. If I signed up and forgot that points to problems in your program, mostly that it’s totally unremarkable and your subscribers can forget.

Read More

Audit trails are important.

One of the comments on my Spamtraps post claims that audit trails should be maintained by recipients, not senders.

Read More

Broken signup processes

DJ Waldow wrote a post on explicit permission over on Mediapost. I think he hit on some interesting bits and wanted to comment on them. In order to comment on a Mediapost blog, you have to register.
I’ve thought about it before, but every time I start the process I get to the page asking for detailed demographic information and decide no. This time, I was inspired enough by DJ to get to the second page of the signup process. This requires me to identify what type of marketing I’m interested in and won’t let me past the page until I click something. I’m not interested in anything, so I close the webpage. I can always write my own blog post responding to DJ.
I return to my inbox to discover a welcome message from Mediapost. It seems I am now a member and will be receiving email and specials and all the stuff I didn’t want from them.
This isn’t unusual. There are tons of websites on the net that don’t require you to complete a signup process in order to be added to their database. One of the worst I experienced was 1-800-Pet-Meds. They added me to their database when I abandoned a cart (what I wanted required a prescription from them, whereas I could just go into my vet’s and pick it up, so I’ll just pay the vet’s prices). They added me to their mailing list and couldn’t unsubscribe me because I was not in their customer database. Everything was done with the magic order number, which I didn’t have because I never ordered with them. That was fun to sort out.
It’s a bad idea to add people who don’t complete the signup or purchase process to your mailing lists. If you’re worried about losing a potential customer, then you can send mail reminding them to complete the process (or purchase). If you’re very into customer service, you can ask them if they are interested in future specials from you: would you like to opt-in to our mailing list anyway? Or you can give them the opportunity to remove their information from your database.

Read More