How to Stop Spam Emails

How to stop spam emails: the three layers that work

Spam is cut in three layers: train the filter at your mailbox, close the ways your domain accepts unknown mail, and authenticate the domain so it cannot be spoofed. Do them in that order. The first takes five minutes, the third takes an afternoon, and only the third stops mail that pretends to be you.

• Mailbox layer: report as spam, block the sender or the domain, and create a filter for the pattern. This trains the filter that other mail also passes through.
• Domain layer: no catch-all address, a spam score set on the server, and a rule for the subjects or senders that keep arriving.
• Authentication layer: SPF, DKIM and DMARC records in DNS, so a receiving server can prove whether a message really came from your domain.

No setting stops spam permanently. Any address that has been sold, scraped or leaked will keep receiving some, and the goal is a clean inbox rather than an empty one. What you can do is reduce the volume, keep legitimate mail out of the junk folder, and make sure your domain is not the one being used to send it.

Stop spam in Gmail, Outlook and Apple Mail

Every mainstream mailbox has the same three controls: report, block, and filter. Use report first, because it teaches the provider's filter about every message that comes after it.

1. Gmail: open the message, click the three-dot menu, choose Report spam. For a sender you never want again, open the message and use Block sender.
2. Outlook on the web: Settings, Mail, Junk email, then Blocked senders and domains, then Add blocked sender. A whole domain can be blocked in the same box.
3. Apple Mail: select the message and click Mark as Junk. To block permanently, open Preferences, Junk Mail, and add the sender to the blocked list.
4. Create a filter for patterns rather than senders. In Gmail: search for the phrase, then Show search options, Create filter, Delete it. In Outlook the same idea is called a rule.
5. Empty the junk folder monthly. In Gmail, Spam then Delete all spam messages now.

A blocked sender still reaches the mailbox and is moved to junk; a filter can delete it before you ever see it. For recurring junk, the filter is the stronger control.

Should you unsubscribe or block the sender?

Unsubscribe from a list you joined and block the ones you did not. The unsubscribe link is a confirmation that the address is live, so clicking it in unsolicited mail does the opposite of what you want.

• Unsubscribe: a newsletter, a store you bought from, a service you signed up for. Legitimate senders honour it, and it is legally required of them in most markets.
• Block and report: anything you never asked for, anything with a threat, a prize, an invoice you did not issue, or a sender name that looks almost right.
• Neither: do not reply, and do not load images in a suspicious message. A reply confirms the address, and a tracking pixel confirms it was opened.

If the volume is coming from many different senders rather than one list, unsubscribe will not help. That is a harvesting problem, and it is handled by the domain and filter steps below, or by retiring the address.

Stop spam on a business domain in cPanel

Three cPanel settings do most of the work on a hosted domain: turn off the catch-all, lower the SpamAssassin threshold, and add a filter for the patterns that still arrive.

1. Open cPanel, then Email, then Default Address. Set it to Discard or Fail instead of forwarding to a real mailbox. A catch-all accepts every guessed address, including the ones spammers generate in bulk.
2. Open Email, then Spam Filters, and confirm Apache SpamAssassin is enabled for the account.
3. Set the required score to 5, then lower it one step at a time if spam still lands. Below 3 you will start catching legitimate mail, so change one step and watch for a week.
4. Open Email, then Email Filters, create a filter for the recurring subject or sender, and set the action to Discard or to move the message to a Junk folder.
5. Open Email, then Email Deliverability, and run the check. It reports whether SPF and DKIM are valid for the domain, which is the next section.

You know it worked when a test message from an unknown address to a made-up mailbox bounces, spam for the week lands in Junk rather than the inbox, and Email Deliverability shows both SPF and DKIM as valid.

SPF, DKIM and DMARC stop your domain being spoofed

These three DNS records do not filter incoming spam. They stop other people sending mail that claims to be from your domain, and they tell receivers what to do when someone tries.

Start DMARC at p=none so you receive reports without losing mail, read the reports for a fortnight, then move to quarantine and finally reject. Going straight to reject on a domain with a forgotten sending tool is how a business loses its invoices.

WebJi® sets DKIM on hosted mailboxes from the client area, and the record-by-record walkthrough is in the SPF and DMARC setup guide. If mail from your domain is already being rejected elsewhere, the next stop is an email blacklist check.

How to stop contact form spam on your website

Form spam arrives through your own site, so mailbox filters never see it until it is already in the inbox. Block it at the form with three cheap controls before you consider a paid service.

• A honeypot field: a hidden input that a person never fills and a bot always does. If it arrives filled, drop the submission silently.
• Time check: reject a submission completed in under three seconds. People take longer than scripts.
• Rate limit: one submission per IP per minute is enough for a real enquiry form and ruinous for a botnet.

Add a CAPTCHA only if the three above still leak; it costs you real enquiries and accessibility. On WordPress, most form plugins include the honeypot and time check as built-in options, and a security plugin will log the blocked attempts so you can see whether the volume is falling.

Cutting marketing and SEO cold email

Cold outreach is not a leak, it is a list your address is on, sometimes several. Reduce the inflow rather than fighting each message.

• Use a second address for shopping, forums and downloads, and keep the primary one for people and accounts that matter.
• Untick pre-checked marketing boxes before submitting any form, and decline partner offers at checkout.
• Keep the business address off public pages in plain text. Use a contact form, or an image, so scrapers cannot harvest it.
• In Gmail, a filter on the unsubscribe phrase catches most bulk mail in one rule; mark those as read and archive rather than deleting, so a real sender is not lost.

Expect the volume to fall over weeks, not days. Harvested lists are sold and resold, so an address that has been public for years keeps receiving some mail no matter what you change today.

When spam means the mailbox has been compromised

Sudden spam from your own address, or contacts receiving messages you did not send, usually means the account is compromised rather than merely listed. Treat it as a security incident, not a filtering problem.

1. Change the mailbox password from a device you trust, and sign out of all other sessions.
2. Check the sent folder and the account's forwarding rules for an address you did not create. Attackers add a hidden forward to keep reading mail after a password change.
3. Turn on two-step verification for the mailbox and for the client area that manages it.
4. Scan the hosting account for malware if the site shares the domain, because a compromised form is a common entry point.
5. Check whether the sending IP is on a blocklist, and request delisting once the account is clean.

If the messages continue after the password change, email support@webji.services with the mailbox, the time the first message went out, and the forwarding rule you found. Support reads that mailbox 24/7 in Hindi and English, and the average first reply is under 60 minutes.