How to Stop Spam Emails: 21 Strategies That Work in 2026

This is the condensed procedure. Each step below is expanded later in the guide with the reasoning and tradeoffs, but if you only have five minutes, doing these six things in order will remove the large majority of new spam within a week or two, because most inbox filters relearn quickly once you stop training them with inconsistent signals (deleting spam without reporting it, for example, teaches the filter nothing).

The order matters. Fixing the intake problem (step 1 and 2) before you touch filter settings (step 6) is what separates a durable fix from a temporary improvement, because filters can only act on mail that already reached your provider - they cannot stop a company from selling your address to a third party once it has it.

• Step 1: Audit where your primary address is currently exposed - contact forms, loyalty programs, old forum signups.
• Step 2: Replace low-trust signups going forward with a disposable or alias address.
• Step 3: Mark unwanted mail as spam/junk, not just delete, so the filter learns the sender pattern.
• Step 4: Unsubscribe only from legitimate senders you recall opting into; never click unsubscribe on unsolicited mail.
• Step 5: Check your address against a breach-monitoring service and rotate any reused passwords.
• Step 6: Enable your provider's strictest spam/phishing filter tier and review the spam folder weekly for false positives.

Spammers do not typically guess addresses one at a time; they buy or scrape lists in bulk. A sudden jump in volume almost always traces back to one exposure event weeks or months earlier - a breach at a retailer, a data broker sale, or your address being posted publicly somewhere a scraper found it.

It is worth distinguishing volume spam (marketing you never asked for, sent to thousands of addresses at once) from targeted spam (messages referencing your name, a recent purchase, or a real account you hold). The second category is far more likely to be phishing built from breach data and deserves more caution, not less, even though it looks more 'personal' and therefore more legitimate.

• Check haveibeenpwned.com or your password manager's breach-monitoring feature for your address.
• Search your own name plus email address in quotes to see where it appears publicly.
• Review recent account signups - free trials and one-off purchases are the most common leak points.

This is the single highest-leverage strategy on this list because it prevents exposure rather than cleaning up after it. Every signup form, gated PDF, coupon code, or Wi-Fi login form is a place your primary address can be sold, breached, or resold to list brokers. A disposable address makes that exposure irrelevant.

The tradeoff is recovery: a disposable inbox is the wrong choice for anything you need to log back into later - banking, healthcare portals, or any account with password-reset flows tied to that address. Reserve disposable addresses for one-off or low-trust interactions, and use a permanent alias (see the next section) for services you may need again.

• Good use cases: newsletter trials, gated downloads, one-time coupon codes, forum registrations, Wi-Fi captive portals.
• Bad use cases: banking, healthcare, tax filing, anything with account recovery you'll need in 6+ months.
• A temporary email address you generate for a single session is one of the fastest ways to test this - try it at /temporary-email.

An alias forwards to your real inbox but lets you identify the source of a leak - if you sign up for a retailer as retailer@yourdomain.com and start getting spam from a different company at that alias, you know exactly who sold your data. A disposable address, by contrast, is not even connected to your real inbox, so nothing forwards and nothing to trace back - the tradeoff is you also can't recover it.

Gmail and most providers support '+' addressing (yourname+retailer@gmail.com) for free, though it is trivially stripped by list brokers who know the trick. A dedicated alias service or your own domain is harder for a spammer to normalize away.

No filter is purely content-based anymore. Providers like Gmail and Outlook weight sender and domain reputation heavily, which is why a brand-new domain sending its first bulk email is far more likely to be filtered than an established one - regardless of the actual content.

This is also why training your filter matters: consistently marking unwanted mail as spam (not just deleting it) and consistently marking misfiled legitimate mail as 'not spam' both feed signal back into the model that is specific to your account, on top of the provider-wide reputation signals.

• Sender/domain reputation - built over the sending domain's history, not just this message.
• Authentication results - SPF, DKIM, and DMARC pass/fail (covered in a dedicated section below).
• Content and link analysis - urgency language, mismatched display URLs, attachment types.
• Your personal signal - what you've marked spam or not-spam historically.

Check your provider's settings for options like Gmail's 'enhanced safe browsing' and phishing-warning settings, or Outlook's junk-email protection level (No Automatic Filtering / Low / High / Safe Lists Only). Moving from the default to a stricter tier is usually a five-minute change with a meaningful reduction in spam volume.

The cost is more false positives - legitimate mail occasionally lands in spam. Review your spam folder roughly weekly rather than never, so a missed invoice or password reset doesn't sit there unnoticed for a month.

Legitimate marketing mail in the US is required by the CAN-SPAM Act to include a working unsubscribe mechanism and honor it within 10 business days - so for real senders, unsubscribing works and is the right move. The risk is entirely with unsolicited or spoofed mail, where the 'unsubscribe' link itself may lead to a tracking pixel or a phishing page rather than an actual opt-out.

A reasonable rule: if you recognize the sender and recall subscribing, unsubscribe. If you don't recognize the sender, mark it as spam instead and let the filter handle it - do not interact with the message at all.

• Recognize the sender and remember opting in → unsubscribe is safe and required to work under CAN-SPAM.
• Don't recognize the sender, or it feels off → mark as spam, do not click anything in the message.
• List-Unsubscribe header (one-click, no page visit) is generally lower-risk than an embedded link.

The distinction matters because the response is different. Marking bulk advertising spam is largely about filter hygiene; a phishing attempt aimed at your bank login or employer credentials warrants reporting to the impersonated organization, and in serious cases to a national fraud-reporting body, in addition to marking it as spam.

Phishing comes in several forms worth knowing by name: standard phishing (mass, generic impersonation), spear phishing (personalized, using details about you), whaling (targeting executives specifically), clone phishing (a near-identical copy of a real email with a swapped malicious link), and business email compromise, where an attacker gains access to a real corporate mailbox and sends fraudulent payment requests from inside it.

AI-generated phishing has removed the spelling-and-grammar tell that used to be reliable, so treat polished writing as no signal at all in either direction. The more durable signals are structural: does the sender domain actually match the organization, does the link's real destination match its displayed text, and is the message asking you to do something a legitimate organization would never ask for by email (send a password, gift card codes, or urgent wire transfer)?

Hovering over a link (desktop) or long-pressing it (mobile) reveals the actual destination before you click. If the underlying URL doesn't match the brand it claims to be from, treat the message as phishing regardless of how convincing the rest of it looks.

• Urgent or threatening language ('act now', 'account will be closed').
• Sender domain altered subtly (e.g. a swapped letter or added hyphen).
• Generic greeting ('Dear Customer') instead of your actual name.
• Requests for passwords, one-time codes, or payment details via email.
• Display text and actual link destination don't match on hover.
• Unexpected attachments, especially executables, archives, or macro-enabled Office files.

QR codes in email bypass link-scanning tools that check URLs in text, because the destination is only readable after scanning. Treat an unexpected QR code in an email the same way you'd treat an unexpected link: verify the sender independently before scanning.

TOAD attacks are effective specifically because the phone call feels like confirmation rather than a second attack - never use a phone number provided in the suspicious email or the follow-up call itself; look up the organization's number independently.

• Quishing: malicious QR codes replacing traditional links to dodge URL scanners.
• AI-generated phishing: no longer identifiable by poor grammar or spelling.
• TOAD (telephone-oriented attack delivery): a follow-up phone call reinforcing a phishing email.

Speed matters more than perfection here. Change the password on the affected account first, from a device you trust, before doing anything else - attackers often act on stolen credentials within minutes. Then check for account changes an attacker might have made to maintain access even after a password reset: added recovery email addresses, forwarding rules, or new connected apps.

If you entered financial information or believe money was sent, contact your bank or payment provider immediately - most card networks have a limited window to reverse fraudulent charges, and acting within hours meaningfully improves your odds of recovery.

• Clicked a link only: run a full malware/antivirus scan; disconnect from the network if you're unsure what the link triggered.
• Entered a password: change it now from another device, enable 2FA, check for new forwarding rules or recovery emails.
• Sent money or card details: contact your bank/payment processor immediately, then file a fraud report (see the regional section below).

SPF (RFC 7208) publishes a DNS record listing which mail servers are authorized to send for a domain. DKIM (RFC 6376) attaches a cryptographic signature to outgoing mail that receivers can verify against a public key in DNS, proving the message wasn't altered in transit and genuinely originated from that domain's signing key. DMARC (RFC 7489) ties the two together and publishes a policy - monitor, quarantine, or reject - for what receiving servers should do with mail that fails both checks, plus a reporting address for abuse visibility.

For individuals, the practical relevance is that mail failing these checks is exactly the profile of a spoofed sender, and most modern filters weight authentication failures heavily. For anyone who runs a domain and sends email from it - even a small business - implementing all three is one of the most effective anti-spoofing steps available, and increasingly a requirement for reliable inbox placement at Gmail and Yahoo.

A `p=none` policy means the domain owner is only collecting reports, not instructing receivers to reject failing mail - so its presence alone doesn't guarantee protection. This matters if you're evaluating whether a business email you received is likely genuine: a domain with no DMARC record at all, or one stuck at `p=none` for years, is easier to spoof convincingly.

This check is more useful for security teams and IT admins evaluating vendor or partner domains than for everyday inbox users, but it's a quick way to sanity-check whether a company that claims to take security seriously has actually enforced anti-spoofing on its own domain.

A tiered system - one address for people who need to reach you personally, a secondary address for online shopping and subscriptions you might want to keep, and disposable addresses for everything else - keeps any single leak contained to one tier instead of your whole digital life.

A monthly ten-minute audit of active subscriptions catches services you forgot you signed up for, which are both a spam source and, if breached later, a source of your data circulating for years without your knowledge.

• Primary address: only people you know and accounts you can't afford to lose.
• Secondary address: online shopping, subscriptions you might renew.
• Disposable address: everything else, especially anything you'll use once.
• Monthly audit: review active subscriptions and unsubscribe from anything unused.

Because BEC messages come from a genuinely compromised account, they pass SPF, DKIM, and DMARC and look identical to normal correspondence from that person. Content filtering alone cannot catch it - the defense is procedural: any request to change a payment destination, wire funds, or share sensitive data should be confirmed by phone using a number looked up independently, never a number or reply provided in the email itself.

Organizations should also apply the same authentication and 2FA practices to shared or departmental mailboxes as they do to individual accounts, since these are common BEC entry points and are often under-secured relative to executive accounts.

The mechanism is exposure reduction, not detection. A temporary inbox will not identify a phishing email any better than a permanent one - the same red flags apply. What it does is shrink the number of places your long-term address exists, which over years measurably reduces how often it appears in a breach, because it was simply never given out in the first place.

It also creates a useful signal: if a disposable address created solely for one website starts receiving phishing attempts, you know precisely which company leaked or sold it, information you would not have if you'd used your primary address for the same signup.

CAN-SPAM applies to commercial email, not to fraud or phishing specifically - phishing is prosecuted under separate wire-fraud and computer-fraud statutes, but the reporting channel for the message itself is the Anti-Phishing Working Group (APWG), a coalition that aggregates phishing reports from ISPs, banks, and security vendors. Forwarding a suspicious message to reportphishing@apwg.org contributes it to blocklists used across the industry.

For consumer fraud broadly - including phishing that led to financial loss - the FTC's reportfraud.ftc.gov intake feeds directly into law enforcement referral networks. This is distinct from simply marking a message as spam in your inbox, which only affects your own filter.

• Phishing emails → forward to reportphishing@apwg.org
• Consumer fraud / financial loss → file at reportfraud.ftc.gov
• Commercial spam violating CAN-SPAM (no working unsubscribe, forged headers) → report to the FTC as above

Each country's reporting path feeds a national blocklist and fraud-intelligence system, and using the correct one for your region gets the report to people who can actually act on it, rather than a generic inbox. If you operate a temporary or disposable email tool for users in multiple regions, it's worth linking each region to its own reporting authority rather than defaulting everyone to the US process.

Regional legislation also differs meaningfully in scope: CASL in Canada is broader than CAN-SPAM, requiring express or implied consent before sending most commercial electronic messages at all, not just an opt-out mechanism after the fact. The Australian Spam Act 2003 similarly requires consent, identification of the sender, and a functional unsubscribe facility.

• United Kingdom: report@phishing.gov.uk (NCSC); fraud via Action Fraud. See /uk/temp-mail for UK-specific guidance.
• Canada: Canadian Anti-Fraud Centre (CAFC); spam enforcement under CASL via the CRTC. See /ca/temp-mail.
• Australia: Scamwatch (ACCC); spam enforcement under the Spam Act 2003. See /au/temp-mail.
• United States: reportphishing@apwg.org and reportfraud.ftc.gov under CAN-SPAM. See /us/temp-mail.

Mobile mail clients frequently show only a display name, not the full sender address, unless you tap to expand it - always expand and check the actual address before trusting a message that appears to be from a known contact or brand.

Because mobile browsers render pages differently, a phishing site optimized for mobile can look more convincing on a phone than the same page would on a desktop browser with more visible chrome (address bar, security indicators).

• Tap to expand the sender's full address rather than trusting the display name.
• Long-press links to preview the destination before tapping.
• Be skeptical of unexpected app-install or 'update required' prompts inside an email.

No spam filter, however advanced, achieves 100% accuracy - vendors avoid publishing precise catch rates because they vary enormously by mailbox, sender mix, and time period, and any specific percentage claim you see quoted online should be treated skeptically unless it cites a named, dated study.

The 'unsubscribe makes it worse' myth is only half-true: it's accurate for illegitimate senders (who use the click to confirm your address is live) and false for CAN-SPAM-compliant legitimate senders (who are legally required to honor it). The skill is telling the two apart, which is why the sender-recognition rule earlier in this guide matters more than a blanket policy either way.

These categories overlap in practice - a phishing email that also carries a malicious attachment is both phishing and a malware vector - but distinguishing them helps you choose the right response. Spam alone: mark as spam. Phishing: mark as spam and consider reporting to APWG or your national body. Malware attachment: do not open it under any circumstances, even 'to check', and report it the same way as phishing.

• Spam: unsolicited bulk mail, usually advertising.
• Phishing: deception aimed at stealing credentials, payment info, or access - can be bulk or highly targeted.
• Malware email: delivers malicious software via attachment or linked download, often combined with phishing.