# How do you protect public email addresses like info@ from spam?

URL: https://iblockspam.com/blog/protect-public-email-addresses-from-spam
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Keep info@, sales@ and careers@ addresses usable: how address harvesting works, what obfuscation can't do, safer contact forms, shared mailboxes and filtering.

## Short answer

Assume any address you publish will be harvested. Publish role addresses such as info@ or sales@, never personal ones, and route them to shared mailboxes so several people can triage. Use a protected contact form for most inquiries, give each channel its own alias so you can retire one, and filter role addresses with quarantine instead of hiding them.

Every business needs at least one address strangers can write to. The problem is that an address on a public web page is also visible to every spammer's scraper. You can't make a published address private again, but you can choose which addresses you publish, how mail to them is handled, and how easily you can replace one that's been overwhelmed.

## Why do public email addresses get so much spam?

Because they're easy to collect. Spammers run programs that crawl websites and pull out anything shaped like an email address, a practice called address harvesting.

It's been measured. In 2002, the FTC and its partners ran a "Spam Harvest", seeding undercover addresses in different places online. The [FTC reported](https://www.ftc.gov/news-events/news/press-releases/2002/11/federal-state-local-law-enforcers-tackle-deceptive-spam-internet-scams) that "Eighty-six percent of the e-mail addresses posted at newsgroups and Web pages received spam". The figures are old, but the mechanism hasn't changed.

US law treats harvesting as an aggravating factor. Under [15 U.S.C. § 7704(b)](https://www.law.cornell.edu/uscode/text/15/7704), part of the CAN-SPAM Act, sending unlawful commercial email to an address "obtained using an automated means from an Internet website" whose operator said it wouldn't share addresses counts as an aggravated violation. Dictionary attacks, which guess addresses by combining names, are covered too. That doesn't stop overseas spammers, but it shows how established the practice is.

Harvesting isn't the only route. Role addresses such as info@, sales@ and support@ are also guessable. [RFC 2142](https://www.rfc-editor.org/rfc/rfc2142.html), published in 1997, standardized names such as INFO, SALES, SUPPORT, ABUSE and POSTMASTER, so a spammer can mail info@ at any domain without visiting your website at all.

## Which addresses should you publish?

Publish role addresses. Keep personal addresses off public pages.

| Address type | Example | Publish it? | Why |
|---|---|---|---|
| General inquiries | info@, hello@, contact@ | Yes | Expected by visitors; easy to route and filter |
| Sales | sales@ | Yes | Leads come from strangers; needs a team, not one inbox |
| Support | support@, help@ | Yes, or use a ticket form | Often better handled by a helpdesk tool |
| Recruiting | careers@, jobs@ | Yes, if you take emailed applications | Attracts CVs with attachments; route carefully |
| Accounts payable | invoices@, ap@ | Only to suppliers, not on the website | A common target for [fake invoices](https://iblockspam.com/blog/fake-invoice-and-payment-emails) |
| Abuse and postmaster | abuse@, postmaster@ | Don't need to publish; just make them work | RFC 2142 expects them to exist |
| Individual staff | jane.smith@ | Avoid | Spam and targeted phishing follow the person, and the address can't be retired |

Role addresses have a practical advantage beyond spam. When someone leaves, the mail still goes to the team. And because the address belongs to the function, you can change who reads it without telling the world.

### Why personal addresses on websites are risky

A published personal address is a gift to spear phishers. It confirms the address format your company uses, which makes every colleague's address guessable, and it tells attackers who does what. The UK NCSC's [phishing guidance](https://www.ncsc.gov.uk/guidance/phishing) advises organizations to consider what visitors to the website need to know, "and what detail is unnecessary (but could be useful for attackers)". See [spear phishing vs phishing vs whaling](https://iblockspam.com/blog/spear-phishing-vs-phishing-vs-whaling) for why that matters.

## Does hiding your email address from bots work?

Partly. Obfuscation means displaying the address in a way people can read but simple scrapers can't. Common methods:

- Writing it out: `info [at] example [dot] com`
- Building the address with JavaScript when the page loads
- Encoding characters as HTML entities
- Showing the address as an image

These stop basic scrapers that search page source for the usual address pattern. They don't stop scrapers that run page scripts like a browser does, or that recognize common substitutions. They also have costs: an image or a spelled-out address can't be clicked or copied easily, and screen readers may read it awkwardly, which hurts real visitors.

The bigger limit is that the address leaks anyway. It appears in every reply you send, in your partners' address books, in mailing lists, and in any data breach involving those contacts. Treat obfuscation as a small extra, never as your spam strategy.

## Should you use a contact form instead?

For most businesses, a contact form should be the main route, with one role address as a backup. A form keeps the address itself off the page and lets you collect the information you need.

A form needs protection of its own, or it becomes a spam relay into your inbox:

1. **Add a honeypot field.** A hidden field people never see but bots fill in. Reject submissions where it's filled.
2. **Rate-limit submissions** per IP address and per session.
3. **Use a challenge** such as a CAPTCHA only if the first two aren't enough, because challenges add friction for real visitors.
4. **Validate fields on the server**, and refuse links in fields that shouldn't contain them, such as a name.
5. **Never use the visitor's address as the From address.** Send from your own domain and put the visitor in Reply-To. Our guide to [website form emails going to spam](https://iblockspam.com/blog/website-form-emails-going-to-spam) explains why.
6. **Don't send an auto-reply that repeats the message content.** Spammers can abuse those to send their own text to third parties through your form.

## Role mailbox, shared mailbox or distribution list?

A role address needs somewhere to go. The main options:

| Option | How it works | Good for | Watch out for |
|---|---|---|---|
| Shared mailbox (Microsoft 365) | One mailbox several users open alongside their own | info@, sales@, support@ handled by a small team | Max 25 users; block direct sign-in |
| Distribution list | Each message is copied to every member | Small teams who all need to see everything | Every member gets every spam message; replies aren't coordinated |
| Google Group with Collaborative Inbox | A group address with shared conversation tracking | Google Workspace teams triaging inquiries | Check posting and spam-handling settings |
| Helpdesk or ticket system | Mail becomes tickets | Support at volume | Its own filtering and auto-replies need configuring |
| Alias on one person's mailbox | Extra address on a user's mailbox | Very small businesses | Mail stops being handled when that person is away or leaves |

### Microsoft 365 shared mailboxes

[Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes) suggests shared mailboxes for "Company information addresses" and "Support email addresses". Key points:

- A shared mailbox "can store up to 50 GB of data without assigning a license to it". Users who open it need their own licensed mailbox.
- It "supports a maximum of 25 users". Beyond that, Microsoft suggests a Microsoft 365 group.
- "Always block sign-in for the shared mailbox account and keep it blocked." An unattended account with a password is a takeover risk.
- Only people inside your organization can be given access.

Once the shared mailbox exists, decide who owns it and who reviews its held mail; our [shared mailbox spam protection guide](https://iblockspam.com/blog/shared-mailbox-spam-protection) has a policy template.

### Google Workspace groups

In Google Workspace, a Google Group can receive mail at a shared address, and its [Collaborative Inbox](https://support.google.com/a/users/answer/167430) features let members assign and track conversations. Posting policies control moderation and spam handling. If a group holds back legitimate mail, Google's [troubleshooting page](https://knowledge.workspace.google.com/admin/support/troubleshooting/legitimate-email-to-a-group-marked-as-spam) explains how to relax **Spam message handling**, and notes that "messages identified as high-confidence spam are always rejected even when you relax spam controls for a group."

## How do separate aliases per channel help?

Give each public channel its own address, all delivering to the same shared mailbox. For example:

- `info@` on the website contact page
- `hello@` on printed brochures and business cards
- `events@` on trade show materials
- `careers@` on job adverts

This does two things. First, you can see where spam comes from. If `events@` is suddenly flooded, you know which list leaked. Second, you can retire one address without disturbing the others. Stop publishing it, then reject or quarantine its mail after a sensible changeover period.

Plus addressing is a lighter version for individuals. In Exchange Online it's "enabled by default", and lets a user give out `name+tag@` addresses that arrive in their normal mailbox, according to [Microsoft Learn](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/plus-addressing-in-exchange-online). It's useful for sign-ups, but anyone can remove the tag to reach the main address, so it's no substitute for separate published aliases.

Two things to avoid:

- **A catch-all.** It accepts mail for every made-up address at your domain, so every guess lands. See [why catch-all addresses attract spam](https://iblockspam.com/blog/catch-all-email-address-spam).
- **Unmonitored aliases.** An address nobody reads still collects spam, and occasionally a real customer. Delete old aliases rather than leaving them active.

## How should you filter public addresses?

Public addresses get the most spam and the most genuine mail from strangers. That combination is exactly where filters make mistakes, so the goal is to filter firmly without losing leads.

1. **Filter before the mail reaches the mailbox.** An inbound filter at the MX level stops most spam and malware before it lands in a shared mailbox that several people open. See [how spam filters work](https://iblockspam.com/blog/how-spam-filters-work).
2. **Quarantine instead of deleting.** A real sales inquiry from an unfamiliar domain can look like spam. Holding it lets someone check.
3. **Send a digest to the mailbox owner.** iBlockSpam gives every address a personal [quarantine with scheduled digest emails](https://iblockspam.com/features/quarantine-and-digests) (hourly, daily, a chosen weekday or a custom schedule), plus a domain-wide quarantine for admins. Choose a frequency that matches how fast you need to answer leads.
4. **Be strict about attachments on careers@.** CVs arrive as attachments from strangers, which is the profile attackers imitate. Quarantine risky types; see [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types).
5. **Block repeat offenders centrally** with domain-wide [allow and block lists](https://iblockspam.com/features/allow-block-lists), rather than in each user's mail client.
6. **Watch false positives.** If real mail is being held, follow [our false-positive guide](https://iblockspam.com/blog/false-positives-legitimate-email-flagged) before loosening anything.

## Checklist for public addresses

1. List every address published on your website, in print, in directories and on social profiles.
2. Replace any personal addresses on public pages with role addresses.
3. Route each role address to a shared mailbox, group or helpdesk, not to one person.
4. Block sign-in on shared mailbox accounts.
5. Put a protected contact form on the website as the main route.
6. Give each channel its own alias, and record where each is published.
7. Turn off any catch-all, and confirm abuse@ and postmaster@ work.
8. Filter role addresses with quarantine and digests, and check the digest daily for leads.
9. Review the aliases each year and retire any that are swamped or unused.

## Next steps

- Audit what your website publishes today, including old PDFs and staff bio pages.
- Check where your domain's mail is delivered with the [MX Lookup](https://iblockspam.com/tools/mx-lookup), and run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) for SPF, DKIM and DMARC.
- Move info@ and sales@ to shared mailboxes if they still land in one person's inbox.
- If spam to public addresses is overwhelming the team, read [how to stop spam for a whole domain](https://iblockspam.com/blog/stop-spam-for-whole-domain).

## Frequently asked questions

### Should I put my email address on my website?

Publish a role address such as info@ or sales@, not a personal one. Customers need a way to reach you, and some prefer email to forms. Expect the published address to be harvested and spammed, and plan for it: route it to a shared mailbox, filter it, and keep personal addresses off public pages so the spam doesn't follow individual employees.

### Does writing my email as name [at] domain [dot] com stop spam?

It stops some simple scrapers that look only for the usual address pattern, and it costs you little. It won't stop scrapers that understand common substitutions or run page scripts, and it makes the address harder for real visitors to use. The address also leaks every time you reply to someone or appear in a breach, so treat obfuscation as a minor speed bump.

### Is a contact form better than a published email address?

For most inquiries, yes. A form keeps the address itself off the page, lets you ask the right questions, and can route messages to the right team. It needs its own spam protection, such as a hidden honeypot field, rate limiting or a challenge, and it must send reliably. Many businesses offer a form and also publish one role address for people who prefer email.

### What is the difference between a role address and a shared mailbox?

A role address names a function, like sales@ or support@, rather than a person. A shared mailbox is one way to deliver it: in Microsoft 365, several users get access to the same mailbox without it needing its own license, up to 50 GB. Alternatives are a distribution list, which copies mail to each member, or a Google Group with Collaborative Inbox features.

### Can I just turn on a strict spam filter for info@?

You can filter role addresses more aggressively, but don't silently delete. Public addresses get real first-contact mail from strangers, which is exactly what aggressive filters tend to misjudge. Quarantine suspected spam and send a regular digest to whoever owns the mailbox, so they can release a genuine sales lead without trawling through the junk.

## Sources

- [FTC: Federal, State, and Local Law Enforcers Tackle Deceptive Spam and Internet Scams (Spam Harvest results, November 2002)](https://www.ftc.gov/news-events/news/press-releases/2002/11/federal-state-local-law-enforcers-tackle-deceptive-spam-internet-scams)
- [15 U.S.C. § 7704(b): CAN-SPAM aggravated violations (address harvesting and dictionary attacks)](https://www.law.cornell.edu/uscode/text/15/7704)
- [RFC 2142: Mailbox Names for Common Services, Roles and Functions](https://www.rfc-editor.org/rfc/rfc2142.html)
- [Microsoft Learn: About shared mailboxes in Microsoft 365](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes)
- [Microsoft Learn: Plus addressing in Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/plus-addressing-in-exchange-online)
- [Google Workspace Learning Center: Use a group as a Collaborative Inbox](https://support.google.com/a/users/answer/167430)
- [Google Workspace Admin Help: Legitimate email to a group marked as spam](https://knowledge.workspace.google.com/admin/support/troubleshooting/legitimate-email-to-a-group-marked-as-spam)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/protect-public-email-addresses-from-spam (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt