Three kinds of trap exist, and two of them are within your reach. A pristine trap was never used by a person. It was planted where only a scraper would find it, and it exists to catch senders who took addresses without consent. A recycled trap belonged to somebody, sat abandoned, and was switched back on by the provider to catch senders mailing stale data. A typo trap sits on a domain one letter away from a big provider, such as a misspelled Gmail domain.
Recycled traps go without ever being identified. The signal isn't in the address, it's in your own engagement history. An address that hasn't opened anything in two years is the risk, and a sunset policy removes it along with everything else that went quiet.
Typo traps are best stopped at the form. A typo suggestion catches the misspelled domain while the person is still there to fix it, so the bad address never gets stored. That works whatever the domain turns out to be.
Pristine traps have no signal at all. There's no engagement history because nobody ever engaged, and there's no protocol difference because the mailbox works. The only defense operates before the list exists.
That defense is how you collect. Double opt-in means a person typed the address and then clicked a link, and a trap can't click. Scraped, bought and appended data carries traps by construction, and no amount of later processing removes them.
If you suspect traps on your list, the fix is plain work. Sunset everything unengaged, stop mailing any segment you can't trace to a consent event, and rebuild from sources you control. Then verify what's left, so dead mailboxes and hard bounces don't add to the damage while your reputation recovers.
Tracing 60,000 contacts back to where they came from
Say your list holds 60,000 contacts from five sources. Three are easy to defend: 31,000 from your own signup form, 12,000 customers, and 6,000 webinar signups who ticked a consent box.
The other two aren't. There are 8,000 from an intent-data vendor and 3,000 copied from an online directory by a former colleague. You can't point to a moment when any of those 11,000 people asked for your mail. If pristine traps are on your list, they're here. A trap can't fill in a form, but it can sit in a directory waiting to be scraped.
Drop the 11,000. Then run a sunset rule across the remaining 49,000 and remove anyone with no opens in a year. That deals with recycled traps without ever naming one. You'll end up with a smaller list, and every address on it traces back to a person who typed it into something you own.
Typo traps, and what to ask about any trap claim
Typo traps get less attention than the other two kinds. Some operators register domains that look like common typos of big providers, and treat whatever arrives as a sign of careless collection. An address at a misspelled Gmail domain can be one of these.
You can do something about this kind at the form. A typo suggestion catches the misspelled domain while the person is still there to fix it. It doesn't detect a trap. What it does is stop a typo from being stored, which removes the risk whatever that domain turns out to be.
When a vendor claims trap detection, ask three things. Where does their list of traps come from, and how old is it? How often does the flag land on a real customer? And how would they know about a trap that has never been published anywhere? A straight answer to the last question is that they wouldn't.
Related questions
Can email verification tools detect spam traps?
Not pristine ones. A pristine trap is a working mailbox that accepts mail like any other, so there is no protocol difference to find. Recycled traps are handled by sunsetting contacts with no engagement in twelve months.
How do I remove recycled spam traps?
Sunset unengaged subscribers. Recycled traps are abandoned addresses, so removing everyone silent for twelve months or more removes them too, without needing to know which ones they were.
What happens when I hit a spam trap?
The trap operator records the hit against your sending IP and domain. Enough hits and your mail is filtered across that network, or your domain lands on a blocklist.
How did spam traps get on my list?
Usually through scraping, a bought list, an appended data file, or an old address that a provider recycled after years without use. Typos at signup add typo traps.