How to Block Spam Emails (And Why Blocking Isn't Enough)

To block spam emails, open the message, use the sender menu, and choose Block. In Gmail that's the three-dot menu at the top right of the open message. In Outlook it's Settings > Mail > Junk email > Blocked senders and domains. In Yahoo it's Settings > More Settings > Security and privacy > Blocked addresses. Takes about four seconds per sender.

That's the answer every guide gives you, and on its own it barely works. Blocking is per-address, and the people sending you spam rotate addresses faster than you can click. Do it anyway, but treat it as the last line of defence rather than the first.

The first line is not handing out your real address in the first place. That's what we built SecondInbox for: a free temporary inbox in one click, no registration, permanently deleted when it expires. Use it for the free trial, the forum, the store loyalty card, the download that wants an email before it gives you a PDF. If the spammer never gets your real address, there's nothing to block later.

Below is how to block spam emails properly in each major client, plus the two tools that carry more weight than blocking: reporting and domain-level filters.

Block, report, and filter are three different things

Most people use these interchangeably. They do completely different jobs, and picking the wrong one is why spam keeps landing.

Block affects one address, in your account only. Mail from [email protected] gets routed to spam from now on. Nobody else on the platform is protected, and the sender learns nothing.

Report spam feeds your provider's classifier. This is the one with teeth. Google treats any sender pushing more than 5,000 messages a day to Gmail addresses as a bulk sender, and requires them to keep their spam-complaint rate below 0.10%, never touching 0.30%. Cross that line and Gmail starts throttling or rejecting their mail across every inbox on the platform. Your one report is a rounding error. A few thousand reports is a deliverability crisis for the sender.

Filter (Gmail) or rule (Outlook) matches on a pattern instead of an address: a whole domain, a subject phrase, a header. This is the only one of the three that survives address rotation.

Rough rule: report it if it's genuine spam, filter it if the sender keeps changing addresses inside one domain, block it if it's a single persistent nuisance you don't want to report.

How to block spam emails in Gmail

Block one sender

Open the message. Click the three-dot menu at the top right of that message (not the toolbar at the top of the page) and pick Block [sender]. Everything from that address lands in Spam from then on, where Gmail deletes it automatically after 30 days.

To undo it later: Settings > See all settings > Filters and Blocked Addresses, then unblock from the list at the bottom.

Block an entire domain

This is the step most people skip, and it's worth more than fifty individual blocks. If the spam keeps arriving from [email protected], then [email protected], blocking each one is a losing race.

1. Click the filter icon in the Gmail search bar.
2. In the From field, type @shopdeals.biz (the domain, with the @, no local part).
3. Click Create filter.
4. Tick Delete it, or Skip the Inbox plus Apply the label if you'd rather keep a copy you can audit.
5. Tick Also apply filter to matching conversations to sweep what's already there.

One filter, every current and future subdomain address, gone.

Use Manage subscriptions for the mail you did sign up for

Gmail added a Manage subscriptions view in July 2025. It's in the left sidebar under More. It lists senders with how many messages each one sent you recently, sorted by volume, with an unsubscribe button on each row.

Use it for real newsletters you genuinely opted into, where unsubscribing is safe and honest. Don't use it on unsolicited spam. Clicking unsubscribe on mail you never signed up for confirms your address is live and read by a human, which is the single most valuable signal you can hand a spammer. That's the same reasoning behind never unsubscribing from newsletters you never signed up for.

How to block spam emails in Outlook

Open the message, select the three-dot menu, then Block > Block sender. Or manage the list directly at Settings > Mail > Junk email, where you'll find Blocked senders and domains. Add a bare domain like shopdeals.biz there and Outlook blocks the whole thing, which is the equivalent of the Gmail filter above but with a nicer interface.

Two Outlook specifics worth knowing:

• The list has a hard ceiling. Outlook on the web caps you at 1,024 blocked senders and 1,024 blocked domains. Worse, when the list is full, adding another entry fails silently. The UI accepts your click and nothing happens. If your blocks stopped working a while back and you've been at this for years, check whether you're at the cap.
• Sweep beats blocking for cleanup. Select a message, hit Sweep, and Outlook will delete everything from that sender including what's already sitting in your inbox, with an option to keep doing it automatically.

For anything more specific than sender or domain, build a rule under Settings > Mail > Rules. Rules can match subject text, keywords in the body, or the presence of attachments, and can run before the junk filter sees the message.

Yahoo, Apple Mail, and Proton

Yahoo Mail: Settings > More Settings > Security and privacy > Blocked addresses > Add. Yahoo blocks per address, and its list is smaller than Outlook's, so lean on filters (Settings > More Settings > Filters) for anything at volume.

Apple Mail / iCloud: open the message, tap the sender's name, then Block this Contact. On iCloud you choose what blocking does in Settings > Mail > Blocked: move to Trash, or just mark it. If you pay for iCloud+, Hide My Email gives you per-signup alias addresses, which is a different and better tool than blocking. It works like alias forwarding rather than a disposable inbox, with the tradeoffs that implies.

Proton Mail: Settings > Filters > Spam, block and allow list. Proton also offers aliases through SimpleLogin on paid plans.

Why blocking spam emails stops working

Here's the part the step-by-step guides leave out.

Real spam operations don't send from one address. They send from rotating subdomains, throwaway domains registered in batches, and compromised legitimate accounts. Blocking [email protected] does nothing about [email protected], which is already queued. You are manually blacklisting a list that regenerates itself for free.

Then there's the arithmetic. Outlook gives you 1,024 slots. A steady spam problem burns through that in a couple of years, and after that your blocks fail without telling you. Gmail doesn't publish a hard cap, but a blocked list in the hundreds is a symptom, not a solution.

Blocking also does nothing about the root cause, which is that your address is sitting on a list somewhere being resold. If you want the full mechanics of how it got there, we wrote up how spammers get your email address. Short version: breaches, scraped forms, and companies selling their signup lists. Blocking treats the symptom every single time, one address at a time, forever.

The fix blocking can't do: stop feeding new lists

You can't unblock your way out of an address that's already been sold. What you can control is whether the next signup adds you to another one.

The habit that works: keep your real address for the handful of things you'd hate to lose (bank, employer, account recovery, people who know your name), and use a disposable address for everything else. Free trials, one-off downloads, forums, store loyalty programs, the wifi portal at the airport, anything that wants your email in exchange for a PDF.

A disposable inbox is a real inbox that expires. You get an address instantly, receive the confirmation email, click the link, and walk away. When it expires, everything in it is deleted from the server. If that address ends up on a resold list two years from now, there's nothing there to reach you.

A few honest limits, because this isn't magic:

• Some sites block known disposable domains at signup. Banks and major platforms usually do. If you need the account long-term, use your real address.
• You need the inbox alive long enough to click the verification link. Ten-minute services get tight when a verification email takes twelve.
• Don't use a disposable address for anything you'll need to recover. No password reset survives an expired inbox.

Gmail's +tag trick is the free half-measure people reach for here. [email protected] does route to your inbox and does tell you who leaked you. But the tag is trivially stripped, plenty of signup forms reject the +, and the underlying address is still your real one. It's a tracking tool, not a shield.

Which brings us back to SecondInbox. One click, an inbox, no account, no personal details, and everything in it deleted from our servers when it expires. Extend the inbox if a verification email is slow, or register free if you want to keep several addresses across sessions. If most of your spam arrives via free trials and newsletter signups, switching that one habit does more in six months than every block button combined.

Report it instead when it's actually malicious

Blocking a phishing attempt is the wrong response. Report it, then block it.

• Phishing emails: forward to the Anti-Phishing Working Group at [email protected], and use your provider's Report phishing option (Gmail's three-dot menu, Outlook's Report button).
• Scams and fraud: file at reportfraud.ftc.gov. This is the current FTC channel. The old [email protected] address is retired.
• Spam texts: forward the message to 7726 (spells SPAM), which routes it to your carrier.

Reporting is the only action here that costs the sender anything.

The take

Block buttons are the least useful tool in the box, and they're the one every guide leads with. Report the spam, because that's the action with consequences for the sender. Filter by domain, because that's the action that survives rotation. Use blocking for the occasional persistent nuisance you don't want to report, and stop expecting it to scale.

Then fix the intake. Every address you hand out is a future spam problem with a delay fuse on it. Give out one you don't mind losing.