How do you protect public email addresses like info@ from spam?

Every business needs at least one address strangers can write to. The problem is that an address on a public web page is also visible to every spammer's scraper. You can't make a published address private again, but you can choose which addresses you publish, how mail to them is handled, and how easily you can replace one that's been overwhelmed.

Why do public email addresses get so much spam?

Because they're easy to collect. Spammers run programs that crawl websites and pull out anything shaped like an email address, a practice called address harvesting.

It's been measured. In 2002, the FTC and its partners ran a "Spam Harvest", seeding undercover addresses in different places online. The FTC reported that "Eighty-six percent of the e-mail addresses posted at newsgroups and Web pages received spam". The figures are old, but the mechanism hasn't changed.

US law treats harvesting as an aggravating factor. Under 15 U.S.C. § 7704(b), part of the CAN-SPAM Act, sending unlawful commercial email to an address "obtained using an automated means from an Internet website" whose operator said it wouldn't share addresses counts as an aggravated violation. Dictionary attacks, which guess addresses by combining names, are covered too. That doesn't stop overseas spammers, but it shows how established the practice is.

Harvesting isn't the only route. Role addresses such as info@, sales@ and support@ are also guessable. RFC 2142, published in 1997, standardized names such as INFO, SALES, SUPPORT, ABUSE and POSTMASTER, so a spammer can mail info@ at any domain without visiting your website at all.

Which addresses should you publish?

Publish role addresses. Keep personal addresses off public pages.

Role addresses have a practical advantage beyond spam. When someone leaves, the mail still goes to the team. And because the address belongs to the function, you can change who reads it without telling the world.

Why personal addresses on websites are risky

A published personal address is a gift to spear phishers. It confirms the address format your company uses, which makes every colleague's address guessable, and it tells attackers who does what. The UK NCSC's phishing guidance advises organizations to consider what visitors to the website need to know, "and what detail is unnecessary (but could be useful for attackers)". See spear phishing vs phishing vs whaling for why that matters.

Does hiding your email address from bots work?

Partly. Obfuscation means displaying the address in a way people can read but simple scrapers can't. Common methods:

• Writing it out: info [at] example [dot] com
• Building the address with JavaScript when the page loads
• Encoding characters as HTML entities
• Showing the address as an image

These stop basic scrapers that search page source for the usual address pattern. They don't stop scrapers that run page scripts like a browser does, or that recognize common substitutions. They also have costs: an image or a spelled-out address can't be clicked or copied easily, and screen readers may read it awkwardly, which hurts real visitors.

The bigger limit is that the address leaks anyway. It appears in every reply you send, in your partners' address books, in mailing lists, and in any data breach involving those contacts. Treat obfuscation as a small extra, never as your spam strategy.

Should you use a contact form instead?

For most businesses, a contact form should be the main route, with one role address as a backup. A form keeps the address itself off the page and lets you collect the information you need.

A form needs protection of its own, or it becomes a spam relay into your inbox:

1. Add a honeypot field. A hidden field people never see but bots fill in. Reject submissions where it's filled.
2. Rate-limit submissions per IP address and per session.
3. Use a challenge such as a CAPTCHA only if the first two aren't enough, because challenges add friction for real visitors.
4. Validate fields on the server, and refuse links in fields that shouldn't contain them, such as a name.
5. Never use the visitor's address as the From address. Send from your own domain and put the visitor in Reply-To. Our guide to website form emails going to spam explains why.
6. Don't send an auto-reply that repeats the message content. Spammers can abuse those to send their own text to third parties through your form.

Role mailbox, shared mailbox or distribution list?

A role address needs somewhere to go. The main options:

Microsoft 365 shared mailboxes

Microsoft Learn suggests shared mailboxes for "Company information addresses" and "Support email addresses". Key points:

• A shared mailbox "can store up to 50 GB of data without assigning a license to it". Users who open it need their own licensed mailbox.
• It "supports a maximum of 25 users". Beyond that, Microsoft suggests a Microsoft 365 group.
• "Always block sign-in for the shared mailbox account and keep it blocked." An unattended account with a password is a takeover risk.
• Only people inside your organization can be given access.

Once the shared mailbox exists, decide who owns it and who reviews its held mail; our shared mailbox spam protection guide has a policy template.

Google Workspace groups

In Google Workspace, a Google Group can receive mail at a shared address, and its Collaborative Inbox features let members assign and track conversations. Posting policies control moderation and spam handling. If a group holds back legitimate mail, Google's troubleshooting page explains how to relax Spam message handling, and notes that "messages identified as high-confidence spam are always rejected even when you relax spam controls for a group."

How do separate aliases per channel help?

Give each public channel its own address, all delivering to the same shared mailbox. For example:

• info@ on the website contact page
• hello@ on printed brochures and business cards
• events@ on trade show materials
• careers@ on job adverts

This does two things. First, you can see where spam comes from. If events@ is suddenly flooded, you know which list leaked. Second, you can retire one address without disturbing the others. Stop publishing it, then reject or quarantine its mail after a sensible changeover period.

Plus addressing is a lighter version for individuals. In Exchange Online it's "enabled by default", and lets a user give out name+tag@ addresses that arrive in their normal mailbox, according to Microsoft Learn. It's useful for sign-ups, but anyone can remove the tag to reach the main address, so it's no substitute for separate published aliases.

Two things to avoid:

• A catch-all. It accepts mail for every made-up address at your domain, so every guess lands. See why catch-all addresses attract spam.
• Unmonitored aliases. An address nobody reads still collects spam, and occasionally a real customer. Delete old aliases rather than leaving them active.

How should you filter public addresses?

Public addresses get the most spam and the most genuine mail from strangers. That combination is exactly where filters make mistakes, so the goal is to filter firmly without losing leads.

1. Filter before the mail reaches the mailbox. An inbound filter at the MX level stops most spam and malware before it lands in a shared mailbox that several people open. See how spam filters work.
2. Quarantine instead of deleting. A real sales inquiry from an unfamiliar domain can look like spam. Holding it lets someone check.
3. Send a digest to the mailbox owner. iBlockSpam gives every address a personal quarantine with scheduled digest emails (hourly, daily, a chosen weekday or a custom schedule), plus a domain-wide quarantine for admins. Choose a frequency that matches how fast you need to answer leads.
4. Be strict about attachments on careers@. CVs arrive as attachments from strangers, which is the profile attackers imitate. Quarantine risky types; see dangerous email attachment types.
5. Block repeat offenders centrally with domain-wide allow and block lists, rather than in each user's mail client.
6. Watch false positives. If real mail is being held, follow our false-positive guide before loosening anything.

Checklist for public addresses

1. List every address published on your website, in print, in directories and on social profiles.
2. Replace any personal addresses on public pages with role addresses.
3. Route each role address to a shared mailbox, group or helpdesk, not to one person.
4. Block sign-in on shared mailbox accounts.
5. Put a protected contact form on the website as the main route.
6. Give each channel its own alias, and record where each is published.
7. Turn off any catch-all, and confirm abuse@ and postmaster@ work.
8. Filter role addresses with quarantine and digests, and check the digest daily for leads.
9. Review the aliases each year and retire any that are swamped or unused.

Next steps

• Audit what your website publishes today, including old PDFs and staff bio pages.
• Check where your domain's mail is delivered with the MX Lookup, and run the free Email Health Check for SPF, DKIM and DMARC.
• Move info@ and sales@ to shared mailboxes if they still land in one person's inbox.
• If spam to public addresses is overwhelming the team, read how to stop spam for a whole domain.