# Why do I get so much spam, and what actually reduces it?

URL: https://iblockspam.com/blog/why-do-i-get-so-much-spam
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Email security basics
Author: iBlockSpam Team

> Why a business inbox gets so much spam: published and old addresses, catch-alls, guessed names, no filter in front, and the steps that actually reduce it.

## Short answer

Business inboxes get a lot of spam because addresses are published, guessed, sold, leaked and kept for years, while some domains accept mail for any address. Spam then arrives with little filtering in front of it. Layered filtering, rejecting unknown recipients, separate aliases and unsubscribing only from senders you recognize cut the volume the most.

If your inbox fills with spam every morning, it's not bad luck. Business addresses are easy to find, easy to guess and rarely retired, and a lot of small business mail reaches inboxes with little filtering in front of it. This guide explains the usual causes and the changes that make the biggest difference, with links to our deeper guides on each.

## Where does all the spam come from?

Most spam reaching a business comes from a handful of sources. The more of these apply to you, the more spam you'll see.

| Cause | Why it brings spam | Fix |
| --- | --- | --- |
| Address published on a website or directory | Harvested by bots and added to lists | Publish a role address, use a contact form |
| Address used to sign up for services | Shared, sold or leaked later | Use a separate alias for sign-ups |
| Old addresses still accepting mail | Lists never forget; ex-staff addresses keep receiving | Remove or redirect old mailboxes deliberately |
| Catch-all on the domain | Every guessed address is delivered | Turn off the catch-all, reject unknown recipients |
| Common role names (info@, sales@) | Guessed at every known domain | Filter role addresses carefully, don't hide them |
| No filtering in front of the mailbox | Everything that arrives is delivered | Put layered filtering in place |
| Unsubscribing from real spam | Confirms the address is live | Report and delete instead |

### Your address is public

Anything on your website, social profiles, business listings or conference attendee lists can be collected. The FTC notes that "When you give a company your email address, it might share or sell it to third parties" ([FTC](https://consumer.ftc.gov/articles/how-get-less-spam-your-email)). Data breaches at services you signed up for add your address to more lists. Our guide to [protecting public email addresses](https://iblockspam.com/blog/protect-public-email-addresses-from-spam) covers what to publish and how.

### Your addresses can be guessed

Spammers don't need to find an address if they can guess it. Names like info@, sales@, accounts@ and firstname@ exist at most businesses. The FTC's CAN-SPAM guide treats "harvesting email addresses or generating them through a dictionary attack" as an aggravated violation, and defines a dictionary attack as sending to randomly generated addresses hoping to reach real ones ([FTC](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)). The practice is illegal and still common.

### Your domain accepts mail for anyone

A **catch-all** delivers mail for every address at your domain, including ones that don't exist. That means every guess succeeds. If your domain has one, it's often the single biggest cause of spam volume. See [catch-all email addresses and spam](https://iblockspam.com/blog/catch-all-email-address-spam) for how to find and remove it.

The opposite setting helps. Microsoft 365's Directory-Based Edge Blocking, for example, rejects mail for invalid recipients "before filtering even occurs" ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-directory-based-edge-blocking)). Rejecting unknown recipients at the edge stops spam to guessed addresses that don't exist and avoids [backscatter](https://iblockspam.com/blog/backscatter-spam-bounce-messages).

### Old addresses never die

Lists are copied and resold for years. The address of someone who left in 2019, or an alias from an old marketing campaign, can keep receiving spam long after anyone reads it. If those addresses forward to a current mailbox, you inherit all of it.

## Why does so much of it get through?

Volume is only half the story. The other half is how much of it reaches the inbox.

### Nothing is filtering in front of the mailbox

Some small businesses rely on whatever their web host's mail server does by default, which can be very little. Others use Microsoft 365 or Google Workspace with default settings that were never reviewed. Built-in filtering in the large platforms is a reasonable baseline, but it's one layer. Our explainer on [how spam filters work](https://iblockspam.com/blog/how-spam-filters-work) shows the checks a message should pass before it's delivered.

A common hidden problem: an MX record changed during a website rebuild or hosting move now points straight at the mail server, bypassing a filter you're paying for. You can check where your mail goes with the [MX Lookup](https://iblockspam.com/tools/mx-lookup) tool. If you use Microsoft 365 behind a gateway, read about [blocking direct-to-tenant bypass](https://iblockspam.com/blog/block-direct-to-tenant-bypass).

### Spam comes from real, authenticated accounts

Google now requires every sender to Gmail to "Set up SPF or DKIM email authentication", and bulk senders to also publish DMARC ([Google](https://support.google.com/a/answer/81126)). That has cleaned up a lot of legitimate bulk mail, but it doesn't stop spam sent from compromised mailboxes, free webmail accounts or newly registered domains with perfect authentication. A pass on SPF or DKIM proves who sent a message, not that it's wanted. This is why reputation, content and attachment checks still matter.

### Spammers fake other people's domains

Spam that claims to come from a bank, a courier or your own address often relies on domains that don't enforce DMARC. In our [scan of the Tranco top 1,000 domains](https://iblockspam.com/research/email-security-top-1000) in October 2026, 38.3% didn't enforce DMARC. Mail faking those domains is harder for receivers to reject outright. Protecting your own domain doesn't reduce what you receive, but it stops spammers using your name against your customers. The FTC calls this a business email imposter and asks businesses to use email authentication so receiving servers "can confirm that the email is really from you" ([FTC](https://www.ftc.gov/system/files/ftc_gov/pdf/Cybersecurity_SB_BusinessEmailImposters-508-v2.pdf)).

### Some of it is mail you signed up for

Not all "spam" is spam. Newsletters, supplier promotions and event invitations from companies you've dealt with are often legal under CAN-SPAM, which the FTC says "makes no exception for business-to-business email" but only requires a working opt-out. That mail is safe to unsubscribe from, and doing so cuts clutter fast.

## What actually reduces spam?

These steps are in rough order of impact for a typical small business.

1. **Put layered filtering in place.** Make sure every message is checked for reputation, authentication, content and attachments before delivery. Filtering at the MX level covers every mailbox on the domain at once; see [how to stop spam for a whole domain](https://iblockspam.com/blog/stop-spam-for-whole-domain).
2. **Reject unknown recipients and remove catch-alls.** This stops spam sent to guessed addresses that don't exist and reduces load on your filter.
3. **Retire old addresses on purpose.** List every mailbox, alias and forwarder. Remove the ones nobody needs, and route the rest to a monitored shared mailbox rather than forwarding to a personal inbox.
4. **Use aliases for different jobs.** Give your website, directory listings and sign-ups their own addresses. When one becomes a spam magnet, you can filter it harder or retire it without changing your main address.
5. **Unsubscribe only from senders you recognize.** For companies you signed up with, use the Unsubscribe button in Gmail or Outlook; the FTC's CAN-SPAM guide says senders "must honor a recipient's opt-out request within 10 business days". For outright spam, don't click anything. Our guide on [whether it's safe to unsubscribe from spam](https://iblockspam.com/blog/is-it-safe-to-unsubscribe-from-spam) explains why.
6. **Report spam rather than just deleting it.** The FTC suggests you "Mark it as spam or junk", which gives your mail provider a signal about similar messages. In Microsoft 365, the Report button feeds admin review; see [Microsoft 365 report message settings](https://iblockspam.com/blog/microsoft-365-report-message-user-reported-settings).
7. **Check your settings before blaming the filter.** Allow lists that are too broad let spam straight through. Our guide to [Microsoft 365 spam getting through](https://iblockspam.com/blog/microsoft-365-spam-getting-through) lists the usual culprits.

### What doesn't work well

- **Blocking individual senders.** Spammers change addresses and domains constantly, so block lists grow forever without much effect.
- **Inbox rules.** Rules act after delivery, one user at a time, and can be undone by a single change in sender name.
- **Hiding your address with tricks** such as "name [at] domain [dot] com". It may slow down simple harvesters, but it frustrates real customers too.
- **Turning filtering up as far as it goes.** You'll catch more spam and more legitimate mail. Use quarantine with regular digests instead, so held mail can be reviewed and released. See [what email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine).

## How do you know if your filtering is working?

Look at the numbers before and after a change, not just how the inbox feels.

1. Count spam reaching a few typical inboxes over one week.
2. Open the headers of a few spam messages in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and look at which servers handled them and what verdict each gave. If the message skipped your filter, the headers will show it.
3. Check the quarantine for legitimate mail held by mistake, release it, and note which senders need attention.
4. Repeat after each change.

If one address gets most of the spam, that tells you which alias to retire or filter harder. If spam reaches every mailbox evenly, look at the domain-level setup: MX records, catch-alls and the filter itself.

## Next steps

1. Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) to see your MX records and SPF, DKIM and DMARC in one place.
2. Find and remove any catch-all, and list every old mailbox and alias.
3. Move public listings and sign-ups to separate aliases.
4. Review your filtering. If you want a layer in front of your current platform, iBlockSpam filters at the MX level with a [personal quarantine and digests](https://iblockspam.com/features/quarantine-and-digests) for every user. No filter stops every unwanted message, but layers together cut most of it.

More beginner guides are in our [email basics topic](https://iblockspam.com/blog/topic/basics).

## Frequently asked questions

### Why did my spam suddenly increase?

Common causes are a new data breach or leaked contact list that includes your address, a newly published address on your website, a catch-all being switched on, or a change of filtering, such as an MX record edited during a website or hosting move. Check your MX records and any recent DNS changes first, because a bypassed filter looks exactly like a spam surge.

### Does getting lots of spam mean my email account was hacked?

Not usually. Receiving spam only means your address is known. Signs of a hacked account are different: messages in Sent you didn't write, new forwarding or inbox rules, unfamiliar sign-ins, or contacts asking about odd emails from you. If you see any of those, reset the password and review the account.

### Why do I get spam that looks like it came from my own address?

The From address in an email is easy to forge. Spammers often fake your own address in extortion scams to make it look as if they have access. If your domain publishes SPF, DKIM and DMARC at an enforcing policy, receivers, including your own mail system, can reject mail that fakes your exact domain.

### Will changing my email address stop the spam?

It helps for a while, but a new address gets found again if you publish it, use it to sign up for services, or it appears in a breach. It's usually better to keep the address, put filtering in front of it, remove catch-alls, and use separate aliases for public listings and sign-ups that you can retire.

### Do spammers pick business addresses on purpose?

Many don't pick at all. They guess common names and role addresses such as info@ or sales@ at known domains, which the FTC calls a dictionary attack when addresses are generated at random. Business domains are easy to find on websites and in public records, so their common addresses get tried constantly.

## Sources

- [FTC: How To Get Less Spam in Your Email](https://consumer.ftc.gov/articles/how-get-less-spam-your-email)
- [FTC: CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)
- [Microsoft Learn: Use Directory-Based Edge Blocking to reject messages sent to invalid recipients](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-directory-based-edge-blocking)
- [Google: Email sender guidelines](https://support.google.com/a/answer/81126)
- [FTC: Cybersecurity for Small Business: Business Email Imposters (PDF)](https://www.ftc.gov/system/files/ftc_gov/pdf/Cybersecurity_SB_BusinessEmailImposters-508-v2.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/why-do-i-get-so-much-spam (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt