How to Stop Spam Emails
Report the message as spam, then block the sender or domain. On a business domain, switch off the catch-all, set the spam score in cPanel, and publish SPF, DKIM and DMARC so nobody can spoof you. Filters stop what arrives; authentication stops what gets sent in your name.
For mailbox owners tired of deleting: the three layers that actually cut spam, with cPanel clicks and copy-ready DNS records.
knowledge
- Read time
- 7 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 15 November 2026.
What actually stops spam emails?
Spam is cut in three layers: train the filter at your mailbox, close the ways your domain accepts unknown mail, and authenticate the domain so it cannot be spoofed — in that order. The first takes five minutes, the third takes an afternoon, and only the third stops mail that pretends to be you.
- Mailbox layer: report as spam, block the sender or domain, filter the pattern. This trains the filter every other message passes through.
- Domain layer: no catch-all address, a spam score set on the server, a rule for the subjects that keep arriving.
- Authentication layer: SPF, DKIM and DMARC records in DNS, so a receiving server can prove whether a message really came from your domain.
No setting stops spam permanently. An address that has been sold, scraped or leaked keeps receiving some; the goal is a clean inbox, real mail out of the junk folder, and your domain not being the one sending it.
How do you stop spam in Gmail, Outlook and Apple Mail?
Use the three controls every mainstream mailbox has — report, block, filter — and report first, because it teaches the provider's filter about every message that follows.
- Gmail: open the message → three-dot menu → Report spam. For a sender you never want again, use Block sender.
- Outlook on the web: Settings → Mail → Junk email → Blocked senders and domains → Add. A whole domain can be blocked in the same box.
- Apple Mail: select the message → Mark as Junk; for permanence, add the sender under Preferences → Junk Mail.
- Filter the pattern, not the sender: in Gmail, search the phrase → Show search options → Create filter → Delete it. Outlook calls the same idea a rule.
- Empty junk monthly: in Gmail, Spam → Delete all spam messages now.
A blocked sender still reaches the mailbox and is moved to junk; a filter can delete before you ever see it. For recurring junk, the filter is the stronger control.
Should you unsubscribe or block the sender?
Unsubscribe from lists you joined; block and report the ones you did not — the unsubscribe link confirms the address is live, so clicking it in unsolicited mail does the opposite of what you want.
- Unsubscribe: newsletters, stores you bought from, services you signed up for. Legitimate senders honour it.
- Block and report: anything with a threat, a prize, an invoice you did not issue, or a sender name that looks almost right.
- Neither: never reply, and never load images in a suspicious message — a reply confirms the address, a tracking pixel confirms the open.
If the volume comes from many senders rather than one list, unsubscribing will not help. That is a harvesting problem, handled by the domain and filter steps below — or by retiring the address.
How do you stop spam on a business domain in cPanel?
Three cPanel settings do most of the work on a hosted domain: turn off the catch-all, set the SpamAssassin score, and filter what still arrives.
- Open cPanel → Email → Default Address and set it to Discard (or Fail) instead of forwarding to a real mailbox. A catch-all accepts every guessed address spammers generate in bulk.
- Open Email → Spam Filters and confirm Apache SpamAssassin is enabled for the account.
- Set the required score to 5, then lower it one step at a time if spam still lands. Below 3 you start catching legitimate mail — change one step and watch for a week.
- Open Email → Email Filters, create a filter on the recurring subject or sender, and set the action to Discard or move to Junk.
- Open Email → Email Deliverability and run the check — it reports whether SPF and DKIM are valid, which is the next section.
It worked when a test message to a made-up mailbox bounces, the week's spam lands in Junk rather than the inbox, and Email Deliverability shows SPF and DKIM valid.
What SPF, DKIM and DMARC records look like in DNS?
SPF lists the servers allowed to send for your domain, DKIM signs each message cryptographically, and DMARC tells receivers what to do when either check fails — these stop spoofing, not incoming spam.
| Record | What it proves | DNS location |
|---|---|---|
| SPF | Which servers may send mail for the domain | TXT at the domain root — one per domain, later records are ignored |
| DKIM | A signature proves the message left your server unaltered | TXT at a selector name such as default._domainkey |
| DMARC | The action when SPF/DKIM fail, plus reports to you | TXT at _dmarc, published after SPF and DKIM work |
; SPF — only the mail server and Google Workspace may send
example.com. IN TXT "v=spf1 a mx include:_spf.google.com ~all"
; DKIM — public key matching the selector (from your mail panel)
default._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
; DMARC — start at p=none, collect reports, then tighten
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"Start DMARC at p=none so you receive reports without losing mail, read them for a fortnight, then move to quarantine and finally reject. Going straight to reject on a domain with a forgotten sending tool is how a business loses its own invoices. The record-by-record walkthrough is in the SPF and DMARC setup guide; if your mail is already being refused elsewhere, run an email blacklist check next.
How do you stop contact form spam on your website?
Form spam arrives through your own site, so mailbox filters never see it — block it at the form with a honeypot, a time check and a rate limit before considering a paid service.
- Honeypot field: a hidden input a person never fills and a bot always does; if it arrives filled, drop the submission silently.
- Time check: reject submissions completed in under three seconds — people take longer than scripts.
- Rate limit: one submission per IP per minute is enough for a real enquiry form and ruinous for a botnet.
Add a CAPTCHA only if those three still leak; it costs real enquiries and accessibility. On WordPress, most form plugins ship the honeypot and time check as options — the contact form setup guide shows where.
When does spam mean the mailbox is compromised?
Sudden spam from your own address, or contacts receiving messages you did not send, means a security incident — treat it as a break-in, not a filtering problem.
- Change the mailbox password from a device you trust and sign out of all other sessions.
- Check the sent folder and the account's forwarding rules for an address you did not create — attackers add a hidden forward to keep reading mail after the password change.
- Turn on two-step verification for the mailbox and for the client area that manages it.
- Scan the hosting account for malware if the site shares the domain; a compromised form is a common entry point.
- Check whether the sending IP sits on a blocklist and request delisting once the account is clean.
If messages continue after the password change, email support@webji.services with the mailbox name, the time the first message went out, and the forwarding rule you found — support reads it 24/7 in Hindi and English, average first reply under 60 minutes.
Frequently asked questions
How do I stop spam emails permanently?
There is no permanent switch, but the volume drops sharply: report and block at the mailbox, turn off the catch-all on your domain, set the SpamAssassin score to 5, and publish SPF, DKIM and DMARC. Expect weeks of improvement rather than an instantly empty inbox.
Does DMARC stop incoming spam?
No. DMARC tells receiving servers what to do with mail that fails SPF and DKIM alignment for your domain, which stops others spoofing you. Filtering incoming junk is the job of your mailbox filter and the server-side spam score.
Should I turn off the catch-all address?
Yes, unless you genuinely need every possible address. A catch-all accepts every guessed mailbox, so spam sent to random names lands in one inbox. Create the real mailboxes you use, set the default address to discard, and let the rest bounce.
Why am I getting spam from my own email address?
Almost always spoofing, not a break-in: the sender address is forged and the message never touched your mailbox. Publish SPF, DKIM and DMARC, then check the sent folder and forwarding rules once to rule out a real compromise.
How many SPF records can a domain have?
Exactly one. Multiple SPF TXT records at the root make the whole check fail permanently (permerror), and receivers may reject everything. Merge senders into one record — v=spf1 a mx include:... — instead of publishing a second.
Last editorial update: 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.