# What is an email spam bot and how do you stop one?

> An email spam bot is automated software that harvests addresses and sends spam at scale. Learn how they work and how to stop one abusing your domain.

An email spam bot is automated software that harvests email addresses and sends unsolicited mail at scale, with no human typing each message. Spammers run these bots — often thousands of infected machines working together as a botnet — to scrape addresses from the web and data breaches, then blast out spam, [phishing](/learning/what-is-phishing), and malware faster and cheaper than any person could. Spam bots matter to you in two ways: they fill *your* inbox with junk, and they can forge *your* domain to send spam to everyone else, torching your sending reputation. The good news is that the second problem — the one that actually damages your business — is fixable with email authentication.

## Quick takeaways

- A spam bot is automated software that **collects addresses and sends bulk spam** without human effort, usually as part of a botnet of compromised computers.
- Bots harvest your address by **scraping websites, buying breach dumps, and guessing** common names at your domain.
- The bigger risk is a bot **spoofing your domain** to send spam as you — which burns your reputation and lands your real mail in spam.
- [DMARC](/learning/does-dmarc-stop-phishing) at an enforcement policy is what stops bots from forging your domain, backed by [SPF](/learning/what-is-spf) and [DKIM](/learning/what-is-dkim).
- Reducing spam *you receive* and stopping spam *sent as you* are two different jobs — this guide covers both.

## How does an email spam bot work?

Spam bots automate the whole spam lifecycle, which is why spam is so cheap to produce:

1. **Harvesting.** The bot builds a target list. It crawls web pages, forums, and social profiles for anything shaped like `name@domain`, buys or downloads addresses exposed in [data breaches](/learning/is-have-i-been-pwned-safe-to-use), and runs *dictionary attacks* — guessing common local parts like `info@`, `sales@`, or `john@` against a domain to see which do not bounce.
2. **Distribution.** To avoid being blocked, spammers rarely send from one machine. They use a **botnet** — a network of malware-infected computers and servers — so the spam originates from thousands of IPs at once, spreading the volume and dodging simple rate limits.
3. **Forgery.** To slip past filters and trick recipients, the bot forges the `From:` address, often impersonating a trusted brand or a domain that has no protection. This is [email spoofing](/learning/what-is-email-spoofing-and-how-can-you-prevent-it), and an unprotected domain is an easy target.

The economics are brutal: because sending costs almost nothing, a response rate of a fraction of a percent still turns a profit, so bots send in the millions.

## How do spam bots get my email address?

Your address ends up on a bot's list through a handful of predictable routes:

- **Web scraping** — a `mailto:` link or plain-text address on a website, forum post, or public directory.
- **Data breaches** — when a service you use is breached, address lists are traded and reused for years.
- **Dictionary and brute-force guessing** — bots try common mailbox names against your domain; role addresses like `admin@` and `support@` are guessed first.
- **Malware and contact-list theft** — a bot on someone else's infected machine reads their contacts, and yours is in them.

You cannot un-harvest an address, which is why the defensive focus shifts to filtering what reaches you and — more importantly — stopping bots from *using your domain*.

## Why should a spam bot spoofing my domain worry me?

Because it damages you even though the spam never touches your own network. When a bot forges your domain in the `From:` address and sends spam or phishing to the world:

- **Your domain's reputation drops.** Recipients and mailbox providers see spam "from you," complaints rise, and your domain can land on a [blocklist](/learning/why-are-my-emails-landing-in-spam-and-how-can-i-fix-it) — so your *legitimate* mail starts going to spam.
- **Your brand and customers get scammed.** Forged mail that looks like it comes from you is the engine behind [business email compromise](/learning/how-does-business-email-compromise-bec-threaten-your-business) and brand-impersonation phishing.
- **You may never see it.** The spam goes to third parties, so the first sign is often a spike in bounce-backs or a customer asking why you emailed them a fake invoice.

This is the part of the spam-bot problem that is squarely within your control — and email authentication is how you take it back.

## How do I stop a spam bot from sending as my domain?

You cannot stop a bot from *trying* to forge your address, but you can make receivers reject the forgery. Three DNS records, working together, do this:

- **SPF** lists the servers authorized to send for your domain, so a bot sending from a random botnet IP fails the check.
- **DKIM** cryptographically signs your real mail; a bot cannot reproduce the signature.
- **DMARC** ties them together and tells receivers what to do with mail that fails — and at an enforcement policy of `p=quarantine` or `p=reject`, it instructs them to junk or drop the forgery outright.

The catch is that DMARC only protects you at enforcement. A record stuck at `p=none` monitors but blocks nothing, which is exactly [why spoofed mail still passes](/learning/why-do-phishing-emails-pass-spf-and-dkim) for many domains. Check where your domain stands with the [Email Security Score](/tools/email-security-score) or the [DMARC checker](/tools/dmarc).

## Common issues with stopping spam bots

### I set up DMARC but spam is still sent as my domain

A DMARC record at `p=none` takes no action — it only reports. Bots keep forging your domain and receivers keep accepting the mail because you have not told them to reject it. Move to `p=quarantine` and then `p=reject` once your reports confirm all your legitimate senders pass, and the forgeries start getting blocked.

### I still receive spam even after protecting my own domain

Authentication stops bots forging *your* domain; it does not stop mail bots send from *their* domains. For inbound spam, lean on your mailbox provider's filtering, never reply or click unsubscribe on obvious spam (it confirms your address is live), and see [how to prevent spam email](/learning/what-is-spam-email-and-how-to-prevent-it) for practical filtering steps.

### Bots keep hitting role addresses like info@ and sales@

Dictionary attacks target predictable mailboxes, so those addresses attract the most spam. You cannot retire them if customers use them, but strong inbound filtering, rate limiting, and CAPTCHA on any web form that feeds them reduces the automated abuse. Publishing addresses as images or contact forms rather than plain `mailto:` links slows harvesting.

### My newsletter signup is being flooded with fake addresses

That is a spam bot abusing your form to inflate your list or trigger confirmation emails at others (a "list bombing" attack). Add CAPTCHA, require double opt-in confirmation, and rate-limit submissions per IP so a bot cannot submit thousands of addresses.

## Frequently asked questions

### Is an email spam bot the same as a botnet?

Not quite. A botnet is the network of infected machines; a spam bot is the software that harvests addresses and sends the spam. Spammers commonly run their spam-bot software *across* a botnet to distribute the sending and evade blocks.

### Can I find out if a bot is spoofing my domain?

Yes — that is what DMARC aggregate reports are for. Once you publish a DMARC record with a reporting address, mailbox providers send you daily summaries showing every source sending as your domain, including the unauthorized ones.

### Does unsubscribing from spam stop the bot?

No. On genuine spam, the unsubscribe link often just confirms your address is monitored, inviting more. Only use unsubscribe on legitimate mail you once opted into; report the rest as spam.

### Will DMARC stop me receiving spam?

No — DMARC protects your domain from being *forged*, which stops spam sent as you. It does not filter the spam that arrives in your inbox; that is your mailbox provider's spam filter's job.

## Where Palisade fits

Stopping a spam bot from abusing your domain means getting SPF, DKIM, and DMARC right across every service that sends as you, then moving DMARC to enforcement without breaking legitimate mail — the step most domains stall on. Palisade deploys those records, reads the DMARC reports to show you exactly which sources (including spam bots) are sending as your domain, and walks the policy safely from `p=none` to `p=reject`. See where your domain stands with the [Email Security Score](/tools/email-security-score).

## Related reading

- [What is email spoofing and how can you prevent it?](/learning/what-is-email-spoofing-and-how-can-you-prevent-it)
- [What is spam email and how to prevent it?](/learning/what-is-spam-email-and-how-to-prevent-it)
- [Does DMARC stop phishing?](/learning/does-dmarc-stop-phishing)