# What are Spam Emails? Causes, Risks and Prevention

> What spam email is, how it works, how to stop and avoid it in your inbox, and how domain owners use SPF, DKIM, and DMARC to keep spammers from spoofing them.

Spam is unsolicited, bulk email sent to large numbers of recipients — usually to advertise, to [phish](/learning/what-is-phishing) for credentials, or to spread malware. Also called junk mail, it clogs inboxes, wastes resources, and carries real security risk. There are two sides to defending against it: keeping spam *out* of your inbox as a recipient, and stopping spammers from using *your* domain to send it. Both come down to email authentication — [SPF](/learning/what-is-spf), [DKIM](/learning/what-is-dkim), and [DMARC](/learning/what-is-dmarc) — and good filtering.

## How spam works

Spam runs on volume and deception. A typical campaign follows the same path:

- **Harvesting targets.** Spammers scrape addresses from websites, buy lists, or pull them from data breaches, often using bots to gather millions at a time.
- **Crafting the message.** The content is built to entice or alarm — fake offers, urgent account warnings, or a trusted brand impersonated through [spoofing](/learning/what-is-spoofing).
- **Sending at scale.** Messages go out through botnets, compromised accounts, or misconfigured [mail servers](/learning/what-is-an-mta) acting as open relays, frequently forging a legitimate domain in the `From:` address.
- **Evading filters.** Attackers rotate sending IPs, vary the text, and exploit domains that lack SPF or DKIM, because unauthenticated mail is easier to disguise.
- **Getting a click.** A single recipient who opens an attachment or clicks a link can hand over credentials, trigger a malware install, or start a fraudulent payment.

For example, a spam message might impersonate a bank and push the reader to a fake login page that captures their password.

## Why spam is a problem

- **Security risk.** Spam is the delivery vehicle for most phishing and malware, putting personal and company data at risk.
- **Resource drain.** High volumes load down mail servers and filters and raise bandwidth and support costs.
- **Lost productivity and trust.** Junk clutters inboxes and erodes confidence in email as a channel.
- **Reputation damage.** If spammers spoof *your* domain, your brand takes the blame — and your legitimate mail can start landing in spam folders too.

## How to stop and avoid spam in your inbox

As a recipient, you cannot stop spam being sent, but you can keep most of it away from you:

- **Report, don't just delete.** Marking messages as spam trains your provider's filter and improves accuracy for everyone.
- **Never engage.** Don't reply, click links, or use "unsubscribe" on clearly malicious mail — it confirms your address is live.
- **Guard your address.** Avoid posting it publicly; use aliases or a separate address for signups so you can cut off a leaked one.
- **Keep filters on.** Leave your provider's spam filtering enabled; it scores content, sender reputation, and authentication results automatically.
- **Verify before trusting.** When a message looks off, check the [email header](/learning/what-is-an-email-header) — a `dmarc=fail` result is a strong sign of a spoofed sender.

## How domain owners prevent their domain being used for spam

If you own a domain, publishing authentication records stops spammers from forging your name — which protects your recipients and your reputation at once:

![Authentication records that keep spoofed spam out](/images/figures/spam-prevention-records.webp)

- **SPF** lists the servers allowed to send as your domain, so forgeries from anywhere else can be rejected. Verify yours with the [SPF lookup tool](/tools/spf).
- **DKIM** signs your mail cryptographically, so tampering and impersonation are detectable.
- **DMARC** ties SPF and DKIM to your visible `From:` domain and, at `p=reject`, tells receivers to refuse mail that fails — the setting that actually blocks spoofed spam. Read your [DMARC reports](/resources-post/how-to-understand-dmarc-reports) to see who is sending as you before you enforce.
- **Harden your servers.** Require authentication so your [MTA](/learning/what-is-an-mta) can't be abused as an open relay, enforce TLS with [MTA-STS](/learning/what-is-mta-sts), and publish a [PTR record](/learning/what-is-a-ptr-record) so your sending IP resolves cleanly.

This side also keeps you compliant: since February 2024, Gmail and Yahoo require bulk senders (more than 5,000 messages a day) to authenticate with SPF, DKIM, and DMARC and to keep their spam-complaint rate under 0.3%. Check every record at once with the [Email Security Score](/tools/email-security-score).

## Frequently asked questions

### What's the difference between spam and phishing?

Spam is any unsolicited bulk mail, much of it merely annoying advertising. Phishing is a targeted subset designed to steal credentials or money by impersonating someone you trust. All phishing is unwanted, but not all spam is phishing — though the dangerous spam usually is.

### Why am I suddenly getting more spam?

Your address was likely exposed — through a data breach, a public posting, or a list sale — and is now circulating among spammers. Filtering and reporting help, and switching signups to an alias lets you abandon a compromised address without losing your main one.

### Does unsubscribing from spam actually work?

For legitimate senders subject to bulk-sender rules, yes — one-click unsubscribe is now required and must be honored within a couple of days. For clearly malicious spam, no: clicking unsubscribe only confirms your address is active, so report it as spam instead.

### Will SPF, DKIM, and DMARC stop spam reaching my own inbox?

They stop spammers from spoofing domains that publish them, which removes a large class of convincing forgeries. They do not filter every unwanted message on their own — pair authentication with your provider's spam filtering for the best coverage.

### Can spammers still fake my domain if I only have SPF?

Yes. Without DMARC at enforcement there is no alignment check tying SPF back to the visible `From:`, and no instruction to reject forgeries. SPF and DKIM are prerequisites; DMARC at `p=reject` is what closes the door.

## Related reading

- [What are DMARC, DKIM, and SPF?](/resources-post/what-are-dmarc-dkim-and-spf)
- [What is email filtering and how does it prevent spam?](/learning/what-is-email-filtering-software-services-prevent-spam)
- [What is phishing?](/learning/what-is-phishing)