The three-layer defense

1. 01

   Layer 1: capture-time hygiene (blocks ~80 percent)

   Enforce double opt-in on every signup form. Add reCAPTCHA v3 (invisible). Reject role addresses (info@, admin@, sales@) at input. Reject disposable domains with a live API check. Reject any address whose domain has no MX record. This alone prevents most spamtrap ingestion.

2. 02

   Layer 2: verification pass (filters another ~15 percent)

   Before every campaign, verify the list. Segment catch-all addresses separately (they carry the highest trap risk). Suppress addresses on high-risk domains (recent typos of major brands, freshly registered domains). This is where KillBounce sits in the stack.

3. 03

   Layer 3: post-send engagement monitoring (catches the last few)

   Track opens and clicks per address. Addresses that have been on your list 6+ months with zero opens are dormant, and dormant addresses on B2C domains can become recycled spamtraps. Suppress or sunset them proactively.

The types of spamtraps and how to defend against each

A practical signup form config that works

// Reject at capture time. Cheaper than post-hoc cleanup.
async function validateSignupEmail(email) {
  // 1. Syntax + no MX = block immediately (free)
  if (!/^[^@]+@[^@]+\.[^@]+$/.test(email)) return { ok: false, reason: 'syntax' }
  const mx = await dns.resolveMx(email.split('@')[1])
  if (!mx || mx.length === 0) return { ok: false, reason: 'no_mx' }

  // 2. Disposable domain check (KillBounce API)
  const check = await fetch('https://api.getkillbounce.com/v1/quick-check', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + API_KEY },
    body: JSON.stringify({ email }),
  }).then(r => r.json())
  if (check.disposable) return { ok: false, reason: 'disposable' }

  // 3. Role address (never valuable for outreach)
  const localPart = email.split('@')[0].toLowerCase()
  if (['info','admin','sales','support','contact','noreply'].includes(localPart)) {
    return { ok: false, reason: 'role_address' }
  }

  // 4. Enforce double opt-in (send confirmation email)
  await sendConfirmationEmail(email)
  return { ok: true, pending: true }
}