- Email & Subscriptions
Your spam has a return address
A lot of what lands in your spam folder was sent by a company you can name. A filter can hide that mail, but it can't close the account that's sending it.
Last updated November 2026.
Open your spam folder and skip the subject lines. Read the sender names instead.
Some of them will probably look familiar. There's the candle shop you bought one birthday gift from, and the meal kit you tried for a single week before you remembered you like cooking for yourself. These aren't strangers. They're companies you said yes to once, and then forgot about.
That's why we think of spam as two problems rather than one. The junk in your inbox comes in two kinds. Some of it is from strangers who bought or scraped your address, and a filter is the right answer for that. The rest has a return address: an account you opened somewhere that is still open and still sending. For that kind, a filter is just a polite way of not looking.
Filters hide the mail. They don't stop it.
The standard advice for stopping spam is to mark it as spam, block the sender, set up a rule or use an alias. Each of those steps changes where an email lands. None of them changes whether it gets sent.
That gap exists because of how American email law works. Under the CAN-SPAM Act, a company doesn't need to ask before it emails you. The FTC's own compliance guide tells businesses they don't need members' consent to send them marketing email. What the law requires is an exit: a working opt-out in every marketing message, honored within 10 business days. The default, in other words, is that the email keeps coming until you say stop.
So is reporting spam pointless? Not entirely. It trains your filter, and some inboxes send an unsubscribe along with the report. But when the sender is a store you once bought from, hitting "report" mostly means agreeing not to see it. The store keeps sending, and it keeps your account along with everything you gave it at checkout.
Your spam comes in two piles
The fastest way to see the difference is to sort. Give yourself ten minutes with your inbox and spam folder open, and put every unwanted email into one of two piles.
The first pile is what we call return-address mail. It comes from a brand you recognize, even faintly, and it behaves like a real business. There's a working unsubscribe link and a postal address in the footer, because US law requires both in marketing email. It often knows your first name or what you bought. Somewhere behind it, there's an account with your details in it.
The second pile is stranger mail. The sender name doesn't match the address it came from, and the unsubscribe link is missing or looks wrong. It usually wants you to act fast on a prize or an invoice you don't recognize. No one you've ever dealt with sent it. If you can't tell which pile an email belongs in, treat it as stranger mail and don't click anything. Our post on whether it's safe to click unsubscribe covers how to check a link before you trust it.
Here's the uncomfortable part. Return-address mail is the pile you technically signed up for, which makes it tempting to decide the spam is your own fault. We don't buy that. Checkout pages and discount popups are built to get your address out of you, and very few of them make leaving as easy as joining. But it does mean return-address mail is the pile you can actually do something about.
Accounts leave a paper trail
A company had to get your address from somewhere, and for return-address mail, the evidence is usually sitting in your own inbox. What you're looking for is the first email that sender ever sent you.
Copy the sender's domain, the part after the @, and search for it. In Gmail, from:brandname.com pulls up everything from that domain, and Google's list of search operators shows how to narrow it further. Then scroll to the oldest result. Usually it's a welcome email or an order confirmation, and it tells you the date and the reason you handed your address over. We find there's something clarifying about reading it. The company that now emails you every few days started with a single receipt for a single purchase.
Sometimes the oldest email is from a brand you've never heard of. When that happens, read the footer. Plenty of retailers sit inside larger parent companies, and the footer often names the parent, which may turn out to own a brand you did shop with. The account you actually need to deal with is the one you opened.
And sometimes there's no first email at all. That usually means you were added to a list rather than signing up for one, through a partner company or a list someone bought. A company's privacy policy will say whether it shares data with "affiliates" or "partners," so those are the words to search for. You can't close an account you never opened, but you can unsubscribe, and depending on where you live, you may have the right to tell the original company to stop sharing your details.
Either way, once you know which company holds the account, you have a return address. A spam filter will never give you that.
A sudden flood means something changed
If your inbox went from quiet to overwhelming in a few weeks, it's worth asking what happened, because the answer tells you which pile the new mail belongs in.
The most common cause, especially in November, is that you signed up for something. A checkout or a discount popup asked for your email, and now you're on a list. That's return-address mail, and the fix is the account. The second common cause is a breach at a company you used. Leaked addresses get copied into junk-mail lists, which feeds the stranger pile. You can check for that with Yorba's free Breach Beacon or with Have I Been Pwned, and our post on checking whether your email is on the dark web covers what to do with the result.
Two other causes are less obvious. Your address might be posted somewhere public, like an old forum profile or a résumé on a job site, where bots can scrape it. The FTC's CAN-SPAM guide lists harvesting addresses as an aggravated violation that can carry criminal penalties, which tells you it happens often enough to legislate against. Or a company that has your data changed hands. When a business is sold or shut down, its customer list can go with it, and you start hearing from a name you don't recognize at an address you only ever gave the old one.
What strikes us about this list is how little of it starts with a stranger. Even a breach begins with a company you trusted with your address.
Unsubscribing closes a list. Deleting closes the account.
Once you have a return address, you have two real options, and they do very different amounts of work.
Unsubscribing is quick, and it's legally binding for the sender. US law gives a company up to 10 business days to honor it, so if you want a quieter inbox by Black Friday on November 27, unsubscribe this week rather than that week. But an unsubscribe only takes you off one list. The account stays open, and your address stays on file alongside whatever else you handed over at checkout.
Closing the account goes to the source. With no account, there's no list to put you back on, and nothing left to leak if that company is breached later. Look in the account settings for "delete account" or "close account." If it isn't there, the company's privacy page or help center usually explains how to request deletion. Our guide to what actually happens when you delete an online account explains why deactivating and deleting aren't the same thing.
Should you delete everything, then? We don't think so. Our rule is simpler: if you'd be happy never to buy from a company again, close the account. If you might shop there again, unsubscribe and keep it, knowing it's still out there.
Give every new signup its own address
The easiest return address to trace is one you set up on purpose. Gmail lets you add a plus sign and a word after your username, so an address like you+shoename@gmail.com still lands in your normal inbox (Zapier explains how). If junk later shows up at that address, you know exactly who shared it. The catch is that anyone can strip the tag off and reach your real address. Apple's Hide My Email, part of an iCloud+ subscription, goes further. It creates a random address for each site that forwards to your inbox, and when one starts attracting junk, you deactivate it and it stops forwarding.
This matters most over the next few weeks, when the stores you visit will keep offering a discount for your email. The spam you get in December is being signed up for this week. We'd give each of those popups its own address, or skip them entirely.
We built Yorba for the first pile
Tracing every sender by hand works, but it's slow, and we built Yorba to do it for you. When you connect your inbox, it reads the signup and receipt emails described above and turns them into a list of the accounts you've opened with that address, including the ones you forgot. From there you can unsubscribe in bulk or close the accounts you don't want. On Premium, our Personal Deletion Agents take on the stubborn deletions for you.
To be straight about the limits: Yorba won't stop stranger mail. Mail from strangers who bought or scraped your address has no account behind it to close, so that's still a job for your spam filter. And if all you want is fewer newsletters, a dedicated unsubscribe tool may be faster. Where we help most is return-address mail, because that's the pile where an account is doing the sending.
Frequently asked questions
What is the fastest way to stop spam emails? Sort your spam into mail from companies you've dealt with and mail from strangers. Close the accounts behind the first group and let your filter handle the second. Filtering everything hides the mail without stopping it.
Does marking an email as spam stop it? It teaches your inbox to hide that sender. On its own, it doesn't remove you from the company's list or close your account, so the company can keep sending.
Is it safe to unsubscribe from spam? From a company you recognize, usually yes, and it's the legal way to make them stop. From a sender you've never dealt with, don't click anything. Mark it as spam instead.
How long does it take for an unsubscribe to work? Under US law, a company has up to 10 business days to honor an opt-out request. Many process it faster, but plan for the full window.
How do I find out who gave away my email address? Search your inbox for the sender's domain and read the oldest email from them. It's usually a signup or receipt. For future signups, a unique alias for each site shows you exactly who shared it.
Can I stop spam completely? No. Strangers who bought or scraped your address can always try. What you can do is close the accounts that generate most of the mail you recognize, which leaves your filter far less to deal with.
Will deleting my old accounts reduce spam? Yes, for mail that comes from those accounts. A closed account can't keep emailing you or sharing your address. It won't affect junk from senders you never dealt with.
