Honeypot
Email MarketingAlso: Spam Trap · Honeypot Email Address
Quick definition
A honeypot is an email address planted by internet service providers (ISPs) or anti-spam organisations specifically to catch senders with poor list hygiene. Nobody real reads it. If your email lands there, it signals you're emailing people who never opted in, and it can trigger blocklisting or deliverability damage.
How it varies across Australia
Honeypot hits are rare for well-managed lists but rise sharply among senders who buy lists or scrape addresses. Australian businesses running old, unpurged databases show meaningfully higher spam-trap exposure than those with active list hygiene practices.
See deliverability benchmarks across Australian industries →What it actually means
A honeypot is bait. Anti-spam organisations and ISPs seed the internet with email addresses that were never given to any real person, then wait to see who emails them. Sign up forms scraped without consent, purchased lists, old databases nobody's cleaned in years, these are the usual paths to a honeypot address ending up in your database.
There are two flavours. A pristine honeypot never existed as a real inbox, so any mail arriving there proves the sender never had permission in the first place. A recycled honeypot used to belong to a real person who abandoned it, and the ISP reactivates it purely to catch senders who never noticed the bounce and never removed it from their list.
Hitting a honeypot doesn't just cost you one email. It damages your sender reputation across the entire domain, and reputation is what determines whether the rest of your campaign lands in the inbox or the spam folder. One hit rarely blocklists you outright, but a pattern of hits tells ISPs your list hygiene is broken, and they respond by filtering everything you send afterwards.
The fix isn't complicated. Don't buy lists. Use double opt-in. Remove hard bounces immediately. Honeypots only catch senders who deserved to be caught.
A honeypot doesn't care about your intentions. It only cares that you emailed an address nobody gave you permission to use.
How it shows up
Honeypot hits show up indirectly, you'll rarely get a direct notification saying you emailed one. Instead you'll see sudden drops in inbox placement, a spike in spam complaints, or your domain appearing on a blocklist like Spamhaus. Bounce rate often looks fine because honeypot addresses accept the email silently rather than bouncing it, which is exactly why they work as traps. The first real signal is usually an unexplained deliverability drop with no obvious campaign change behind it.
The Australian context
Australia's Spam Act 2003, regulated by the Australian Communications and Media Authority (ACMA), requires consent before commercial email is sent. That consent requirement is exactly what honeypots are designed to test. An Australian business that scrapes contacts from LinkedIn or buys a local business list from an overseas broker is walking directly into spam-trap territory, because those lists are exactly where recycled and pristine honeypots concentrate.
Australian ISPs and corporate mail servers also lean heavily on global blocklists rather than running much local infrastructure, so a reputation hit from a honeypot anywhere in the world affects deliverability into Australian inboxes just as much as anywhere else. There's no local exemption for good intentions.
Where people get this wrong
Related terms
Common questions
What's the difference between a pristine and recycled honeypot?
A pristine honeypot never belonged to a real person, it exists purely as bait. A recycled honeypot used to be a real inbox that its owner abandoned, and the ISP reactivates it to catch senders who never noticed the address was dead.
Can one honeypot hit get me blocklisted?
Rarely on its own. Blocklisting usually follows a pattern of poor list hygiene rather than a single incident. But one hit is a warning sign that your list contains addresses you never should have had.
How do I avoid hitting honeypots?
Never buy or scrape lists. Use double opt-in so every address is confirmed by a real person. Remove hard bounces immediately and run regular list hygiene passes to catch dormant or invalid addresses before an ISP does.
Are honeypots the same as CAPTCHA fields on forms?
No. A honeypot in email deliverability is a trap address run by ISPs. A honeypot field on a web form is a hidden input that bots fill in but humans never see, used to catch form spam rather than protect sender reputation.
Debrief
Get the next one
No spam. No fluff. Just the next article, straight to your inbox.
Keep exploring
About New Rebellion
New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.
How we think →