How to fight Spam and Rescue your Email Account From the Bot Hordes

Global Watchdog is reader-supported, with no advertisers and no government entity to answer to. If you enjoyed this article, you can help keep it coming with a one-time donation or monthly support: Support on PatreonDonate on Ko-fi

10 min read

Last updated October 23, 2026

Last updated October 23, 2026: the toolkit was brought current (Gmail’s one-click unsubscribe rules and Manage subscriptions page, SpamSieve 3, passkeys), the dead browser advice and broken links were removed, the images were moved onto this site, and the Short Version, FAQ, Bottom Line, and Winston poll were added.

Last night I decided to do something I had not done in a very long while: I went looking through my spam. I have a very good spam filter called SpamSieve, which uses a Bayesian filter and keeps getting smarter the more you train it to tell good mail from junk. I recommend it to anyone on a Mac who uses Apple Mail and gets a lot of spam, and it is still going strong in 2026, now in version 3. Built-in spam fighters are also decent these days, just not as thorough. But make sure you actually turn them on and train them, or they are useless.

Even a great filter is not perfect. Every once in a while a junk email gets through, or a good email lands in the spam folder. And a filter only moves the flood; it does not reduce it. This article gives you practical, easy-to-follow steps to stop spam email at the source and rescue an email account that is drowning in a deluge of spam: cut the volume first, then let the filter mop up what is left.

Contents

• Know Your Enemy: Two Kinds of Spam
• Step 1: Lock the Doors First
• Step 2: Split Your Email Into Three Tiers
• Step 3: Cut the Volume at the Source
• To Bounce or Not to Bounce
• The Filter Layer
• What Has Changed Since 2014
• Frequently Asked Questions
• The Bottom Line

Professor Winston Wants to Know

Our resident watchdog is taking the temperature of the room.

How much spam lands in your main inbox on a typical day?

One tap, no account or email needed. Results are shown after you vote.

How much spam lands in your main inbox on a typical day?

Hardly any, my filters earn their keepA handful, annoying but manageableDozens, it is a daily shovel jobI gave up counting and made a spare account

Cast your voteSee results

Want to say more? The comments below are open.

Know Your Enemy: Two Kinds of Spam

You need to understand the difference between normal spam and evil spam, because the correct response to each is the opposite of the other. Normal spam is an annoying company trying to get you to shop at their website. It looks professional, it comes from a real domain, and it carries a real unsubscribe link. Evil spam, the black-hat kind, wants to give you malware or steal your credit card or bank information. It rarely has a working unsubscribe link, and when it does, the link itself may be a trap.

Learn the tells. Hover your mouse over any link before clicking: the address should match the sender’s real domain, not some free hosting account in another country. A legitimate sender that spent real money crafting its ads will host its unsubscribe page on its own servers. Black-hat mail also used to give itself away with typos and broken grammar; be warned that the modern version is polished, because the scammers now have AI proofreaders. Check domains harder than spelling. And watch for Bayes poison, blocks of nonsense text, random current-events snippets or chunks of classic literature hidden in tiny or invisible type at the bottom of the message, designed to confuse spam filters. A legitimate sender never does that.

Step 1: Lock the Doors First

Change your passwords immediately, especially on any account you have not touched in years. Hackers break into the websites you use and walk off with databases of millions of emails and passwords; the Target breach was the famous early example, and the breaches never stopped. If you reuse a password, one breached site hands them the keys to everything, including your bank.

The 2026 version of this advice is simpler than the 2014 version. Use a password manager, your Mac’s built-in Passwords app and iCloud Keychain count, and let it generate a long, unique password for every site. Turn on two-step verification everywhere it is offered, and use a passkey wherever a site supports one; passkeys are the phish-proof replacement for passwords that I was hoping for back then, and they finally exist. Make sure every important account has a recovery email you control. And once a year, check your addresses at Have I Been Pwned, which tracks the known breaches, so you know which passwords to burn first.

Step 2: Split Your Email Into Three Tiers

Assuming you do not want to abandon your accounts and start over, rescue the ones you have by splitting the flow. Create spare accounts and sort everything into three tiers:

1. Important accounts you want to read: family, friends, business associates, your bank, important bills.
2. Accounts you might need to read on occasion: orders, shipping notices, services you actually use.
3. Spam catchers you will rarely read: registrations, forums, social media, anything that demands an address before it lets you in.

Move Facebook, Amazon, and your other non-essential services to the second tier, and use the third tier for every new signup, unchecking every newsletter box as you go. If a catcher account gets flooded or even compromised, it is no big deal. Modern helpers make this even easier: Apple’s Hide My Email generates throwaway addresses that forward to you and can be switched off when they leak, and Gmail addresses accept plus tags, such as yourname+shopping, that make leaked addresses easy to trace and filter. Managing several accounts is painless in a real email client like Apple Mail or Thunderbird, which is one more reason to stop living in browser tabs.

Step 3: Cut the Volume at the Source

Here is the step that actually shrinks the flood, and it works far better now than when I first wrote this guide. For legitimate companies, unsubscribe, and do it as a daily habit: every time marketing mail you never read arrives, unsubscribe before you delete it. Within a few weeks the volume drops from a flood to a trickle, because the large majority of junk mail comes from real companies with real unsubscribe systems.

Since February 2024, Gmail and Yahoo have required bulk senders to include a true one-click unsubscribe and to honor it within about two days, and Gmail has enforced the rules with rejections since late 2025. In July 2025 Gmail added a Manage subscriptions page that lists every sender mailing you, ranked by how often, with an unsubscribe button beside each one. Ten minutes on that page does what a month of footer-link hunting used to. In Apple Mail, use the unsubscribe banner Mail shows at the top of marketing messages. Two cautions that have not changed: never type your address, a password, or any other information into an unsubscribe page, since a legitimate sender already has your address; and never use these tools on black-hat mail. For that, the only buttons are Delete and Report Spam, which trains the filters for everyone.

To Bounce or Not to Bounce

Some email clients once offered a Bounce or Redirect feature that returned a message as undeliverable. Apple removed Bounce from Mail long ago, and my advice from 2014 stands: never bounce spam. It confirms your address is live, which earns you more spam, and spammers almost never use their real return address anyway, so your bounce lands on some unsuspecting person whose account was hacked. Bouncing still has one legitimate use, against actual humans sending from real addresses: an ex, a pest, a company whose computer is smart enough to clean its list. Use it rarely, and only when you are sure where the reply will go.

The Filter Layer

Filtering is the mop, not the dam, but you still want a good mop. On a Mac, SpamSieve remains my recommendation: a Bayesian filter you train with two keystrokes, now in version 3, working inside Apple Mail on current macOS, with all processing done on your own machine so your mail goes nowhere. The free Thunderbird client includes a respectable Bayesian junk filter of its own on every platform. Gmail’s built-in filtering is strong enough that forwarding a spam-plagued ISP account through Gmail, letting Google screen it first, still works as the free fix I recommended in 2014. Whichever you choose, train it: mark the misses, rescue the false alarms, and it gets measurably smarter within weeks.

I practice what I preach on this site, by the way. My long fight with an Expedia email address change is a whole saga of its own, and it is why I keep the important tier of my mail guarded like a bank vault.

What Has Changed Since 2014

A short honesty section, because I first published this guide in 2014. Internet Explorer, which I warned you against then, was retired by Microsoft in 2022; you may stop worrying about it. The unsubscribe link, which was often a decorative lie in 2014, now has regulators and the two biggest mailbox providers behind it, so the core strategy of this guide works better than when I wrote it. Phishing, meanwhile, has become fluent and well dressed, which is why the domain check matters more than the grammar check. And email itself, the granddaddy of the cloud, is still irreplaceable: texting, Facebook, and the rest never did take its place for anything that matters. Guard it accordingly.

Frequently Asked Questions

Is it safe to click unsubscribe?

From a legitimate company, yes, and since 2024 the big providers require bulk senders to make it one click and honor it within about two days. From anything that smells like a scam, never. Use Delete or Report Spam instead, because any click tells a black-hat sender that a live person reads that inbox.

Why did my spam suddenly get worse?

Usually because your address escaped: a breach at a site you used, a friend’s compromised account, a list sold one time too many, or the address posted somewhere public where harvesters crawl. Check Have I Been Pwned, change the affected passwords, and tighten the tier system.

Should I just abandon my email address and start over?

Almost never. You are married to that address through banks, doctors, and a decade of accounts. The tier system gives you a fresh start’s benefits, a clean main inbox, without surrendering the address itself.

What is the single highest-value step?

Ten minutes on Gmail’s Manage subscriptions page, or the equivalent unsubscribe habit in your own client, aimed at the legitimate senders. They are most of the volume, and they are now required to let you leave.

So here is my question for you: how many unread marketing emails are sitting in your main inbox right now, and which sender is the worst offender? Name and shame them in the comments.