Public business addresses
How to Stop Spam to info@, sales@ and support@ Addresses
Public role addresses need to be easy for customers to find. Unfortunately, the same visibility makes them easy for automated senders to collect or guess.
TLDR
Keep the public address when customers need it, but confirm whether the unwanted messages arrive by email or through a website form. Disable unnecessary catch-all routing, remove abandoned aliases, avoid chasing rotating sender addresses, and apply inbound filtering across the domain. Review quarantine and logs so legitimate enquiries remain recoverable.
Why Role Addresses Attract Spam
Addresses such as info@, sales@, support@, accounts@, and contact@ are both useful and predictable. They appear on websites, directories, social profiles, old documents, and data sets. A sender can also try common names at a domain without seeing them published.
Once an address has been collected, hiding it on the website does not remove existing copies. The goal should be to preserve access for real customers while improving how incoming mail is evaluated.
Confirm Where the Messages Come From
A website form notification and a direct email can look similar in the inbox, but they require different fixes. Check message headers and logs to establish whether the sender connected to your mail system or submitted a form that your website then emailed to you.
| What you find | Likely issue | Useful response |
|---|---|---|
| Direct mail to the role address | The address was published, collected, or guessed | Inbound filtering and narrow sender controls |
| Repeated website-form notifications | Automated form submissions | Form validation, rate limits, and bot protection |
| Mail to nonexistent variations | Catch-all routing accepts guessed recipients | Disable catch-all or restrict accepted addresses |
See website form spam versus public email address spam for the full diagnostic process.
What to Change First
- Keep only useful addresses and aliases. Retire old campaign addresses and routes nobody monitors.
- Review catch-all delivery. Accepting every local part gives guessed addresses a valid destination.
- Filter the domain. Protect public addresses alongside named mailboxes and aliases.
- Use logs and quarantine. Investigate what was received, held, rejected, or passed onward.
- Create narrow sender rules. Block a known unwanted sender or allow a verified legitimate sender only when evidence supports it.
What Not to Rely On
Changing info@ to another obvious address often delays rather than solves the problem. Publishing an address as an image can make contact harder for legitimate users and does not address guessed addresses. Mailbox rules that move messages based on common words can also hide real sales or support enquiries.
Blocking one sender at a time is useful for a stable nuisance but weak against rotating campaigns. When addresses keep changing, compare message patterns and logs instead of maintaining an endless list. Our guide explains what to do when spam keeps coming from different senders.
When Domain-Level Filtering Helps
If several public or staff addresses are affected, filtering one mailbox at a time creates uneven protection. An MX-based service can evaluate inbound mail before it reaches the existing provider and apply a consistent filtering layer to the protected domain.
Your addresses, shared mailboxes, and mail host remain in place. The domain’s MX records direct incoming mail through the filtering service, which forwards accepted messages to the current destination. Read how MX-based spam filtering works before changing DNS.
Where SpamVest Fits
This is where SpamVest can help. It adds inbound filtering in front of your current email provider, protecting valid addresses across the domain without replacing Microsoft 365, Google Workspace, cPanel, Zoho Mail, or another host.
Admins can review quarantine and logs, release verified messages, and manage sender allow lists and sender block lists. Each protected domain also has an Open antispam cloud link for deeper review and advanced controls. Pricing is annual per protected domain, not per mailbox or user.
Frequently Asked Questions
Why do info@ and sales@ addresses receive so much spam?
They are predictable role addresses and are often published online, so automated senders can discover or guess them without knowing an employee’s name.
Should we remove public email addresses from our website?
Not automatically. If customers rely on email, keep a clear contact route and improve filtering. Removing an address only helps with future discovery and does not erase copies already collected.
Will changing the email address stop the spam?
It may provide temporary relief, but a predictable replacement can be guessed again and changing a public address can disrupt legitimate enquiries.
Should role addresses use a catch-all mailbox?
Usually only when there is a clear business need. A catch-all can accept messages to many nonexistent or guessed addresses and substantially increase unwanted mail.
Can SpamVest protect shared and public addresses?
Yes. SpamVest filters incoming mail for the protected domain before accepted messages reach the existing email provider, covering valid public addresses, aliases, and shared inboxes on that domain.
Keep the Address Open to Customers
Protect the business domain while your public addresses and current inboxes continue to work as they do today.
Start a 30-day trialLearn about domain-level filtering