Email: Can You Still Make Money with Spam Today?

Five to ten years ago, sending spam emails seemed about as easy as boiling dumplings. Write a story about a Nigerian inheritance, add a link, upload an AliExpress contact list, set up automated sending — and traffic starts flowing while revenue goes up.

By 2026, things have become much more complicated: running a spam campaign now looks more like a multi-stage operation behind enemy lines. Still, this traffic source is more alive than dead.

We analyzed open sources to see how much the mechanics have changed and how much more complicated working with email lists has become.

The End of the Golden Age of Email Spam

The challenges with this traffic source started a long time ago. But since 2024, Google, Outlook, and Yahoo have introduced mandatory authentication requirements for bulk senders.

Anti-spam systems now evaluate much more than keywords or links inside an email. Their algorithms assess the sender themselves: who they are, where the message is coming from, how the sender has interacted with the recipient, and their previous email activity.

Let’s start with the basics: how anti-spam systems evaluate sender data.

Domain Reputation

The more often emails from a particular domain end up in Spam, the worse that domain’s reputation becomes. If users repeatedly report messages, Google or another email provider may flag the domain as suspicious. After that, its algorithms can start automatically sending messages from that domain to Spam.

Google considers a complaint rate above 0.3% critical for bulk senders. Since November 2025, its security systems have been rejecting messages from domains considered suspicious.

“Don’t be afraid of unsubscribes. When someone unsubscribes, that’s good. If you send emails to 10,000 people and 1,000 never open them, Gmail thinks: ‘Why are you emailing people who aren’t interested?’ — and marks you as spam.” — Jonathan Bouchard,   Performance Marketing Champions.

IP Reputation and Device Fingerprinting

Email providers can analyze the digital fingerprint of a device sending 5,000 emails per day. As a result, affiliates need more tools and effort to spoof or conceal:

• IP address and location;
• device data: model, operating system, installed software;
• cookies;
• browser data;
• user behavior, etc.

Since 2024, stricter sender authentication has also become an important factor. Anti-spam systems check whether emails are actually being sent by an authorized sender for a particular domain.

Three main mechanisms are used:

SPF (Sender Policy Framework) — determines whether a sender is authorized to send emails on behalf of a particular domain.

DKIM (DomainKeys Identified Mail) — checks whether the email was altered during delivery.

DMARC (Domain-based Message Authentication, Reporting and Conformance) — evaluates email sent from a domain using the previous two mechanisms.

A study published on arXiv Labs found that, due to configuration weaknesses, 34.7% of the 12 million domains analyzed allowed emails to be sent from more than 1 million IP addresses. But since 2025, stronger domain authentication has made mass mailing more difficult.

Recipient Behavior Analysis

Algorithms analyze not only the sender’s technical parameters but also recipient behavior. Security systems track how many people:

• opened the email;
• deleted it immediately;
• clicked a link;
• marked it as spam.

In other words, users themselves help train intelligent algorithms to identify unwanted emails.

Updated AI Filters for Trigger Words

Ten years ago, anti-spam filters were largely triggered by specific keywords.

Today, they are far more sophisticated. Systems can identify the context and meaning of a message even when none of the standard trigger words are used. the context and meaning of the message—even if you didn’t use any standard keywords at all.

For example, back in November 2023, Google implemented RETVec (Resilient & Efficient Text Vectorizer) (original article in Russian), a modern text classification system:

1. Exact spelling is no longer particularly important. The algorithm converts text into numerical vectors that represent meaning. To the system, “earnings” and “e@rn1ngs” mean the same thing. Replacing Latin characters with visually similar Cyrillic ones no longer helps either.
2. The algorithm analyzes all elements of an email. In the past, senders could use white text or a zero-size font to confuse security systems. Those tricks no longer work.

With RETVec, it became possible to detect 38% more spam compared to standard benchmarks. Similar systems are used by OutLook as well.

Email Lists: A Mixed Picture for Spam Campaigns

By 2026, email lists generally fall into two categories: breached lists and first-party lists.

If you go to the darknet and buy a list for 50 USDT, in 99.9% of cases it has already been recycled to death. Those addresses may have received hundreds of emails promoting everything from betting and weight-loss supplements to products claiming to cure diabetes completely.

The Zerobounce study states that over 22% of addresses in old lists are invalid. People whose contact details were obtained through a breach are also unlikely to be happy about receiving an email offering free spins or a discounted miracle anti-aging cream. Those messages are likely to go straight to Spam.

“Deliverability issues are often invisible until they become catastrophic, because unlike search rankings, there’s no obvious ‘page five’ moment — you just quietly stop reaching 35% of your database.” — Florin Armasu, CEO Data Innovation.

Buying contacts through “official” data providers is not a silver bullet either:

• one contact can cost anywhere from $0.03 to $5;
• selecting relevant contacts based on multiple parameters is a slow and repetitive process;

Filtering contacts using dozens of criteria still does not guarantee that recipients will respond to your emails.

First-party email lists are the goldmine. Affiliates, business owners, and webmasters build these lists themselves.

They contain contacts from people who willingly provided their email addresses and subscribed to communications from a dating app, casino, or crypto platform. Someone who has already agreed to receive emails from a casino may also be interested in an offer from another gambling site.

How to Build Your Own Email List for Spam Campaigns

One option is to build your own email list using a lead magnet.

1. Create a lead magnet. Instead of simply saying “Subscribe for updates,” offer something more specific, such as “Get the Top 5 Slots of the Month” or “Get an Exclusive Promo Code for 50% Off an Anti-Aging Program.”
2. Create a landing page. Keep it simple: the offer, a clear explanation of the benefit, and a form where users can leave their email address.
3. Then follow the standard affiliate funnel: pre-lander → offer.

Traffic can come from almost any source, from SEO to teaser ads. Even if a user does not register at the casino or buy the anti-aging product, their email address still remains in your list.

You can then continue engaging the user through follow-up email sequences. The main goal at the initial stage is to attract their attention and clearly show the value of the offer so that they are willing to leave their email address.mail stays in your database. You can then follow up with email sequences. The main thing is to hook them at the start, show the real value of the offer, so they agree to leave their email address.

How Affiliates Work with Email Spam in 2026

You have built your own email list. Now the real work begins. Without the technical setup behind it, an email campaign is pointless.

The Barracuda 2026 Email Threats Report found that one in three emails worldwide is spam or phishing. The researchers analyzed 3.1 billion emails.

Authentication with SPF, DKIM, and DMARC

Each element needs to be configured as accurately as possible. If SPF, DKIM, or DMARC is not set up correctly, delivery will suffer.

In June 2026, a method for bypassing SPF checks and other Outlook mechanisms was discovered. Spammers configure an external spam filter, Mailgun or Barracuda, spoof the domain, and send emails directly to the server. The messages then reach the Inbox without warnings. According to a study by InfoGuard, these checks can be bypassed in more than 20% of cases, allowing messages to be delivered successfully.

Once SPF, DKIM, and DMARC are configured, BIMI (Brand Indicators for Message Identification) can also be used. This standard allows a brand logo to appear next to an email, which can increase user trust.

Managing IP Reputation

Even with perfectly configured sender authentication, a spam campaign can fail before it really begins. IP reputation and domain warming also need attention.

Avoid creating sender accounts with obviously suspicious names.

Imagine receiving two emails: one from Michael Freeman and another from “Sp1der-M4n.” The second immediately looks suspicious, making the recipient far more likely to mark it as spam.

Public sources rarely describe the nuances of domain warming in detail. However, we found the following strategy.

Use residential proxies only, and do not start by sending 500 emails on the first day of using a domain. First, check the domain’s age. If it is less than 30 days old, warming up is a must:

1. Week one. Send 15–20 emails from one domain. Personalize the emails, engage the recipient, and show clear value. Do not use links, images, or attachments. Spread the emails across different times instead of sending them all at once.
2. Weeks two to four. Increase email volume by 20–30% per week.
3. After four weeks. You can move to a larger sending volume of 60–80 emails per domain. Naturally, this requires multiple sending domains.

Secondary Sending Domains (Satellite Domains)

Secondary or satellite sending domains are technical assets used for cold outreach. They provide a backup and help reduce both the load and the risks associated with the main business domain.

With a large email list, several dozen secondary domains can be used to distribute sending volume, with 30–50 emails sent from each one.

The key is to warm these domains up as well.

The reputation of one domain may suddenly drop because of a technical issue or stricter filtering. But if you have backup domains, you can switch sending traffic to the remaining ones without pausing the entire campaign.

Using Trusted SaaS Platforms

In the 2010s, automating spam campaigns often meant buying or renting virtual servers and installing specialized software. IP addresses had to be configured manually.

Today, mass email campaigns are difficult to run without automated services. Mailchimp, SendPulse, and UniSender (original article in Russian) can be used for black-hat campaigns by disguising aggressive creatives and copy as legitimate marketing. For example, instead of directly pushing users to place a bet or make a deposit, the email can focus on a new slot or a bonus. All three services have restrictions on email campaigns in certain controversial niches. Still, in our experience, these restrictions can be bypassed in dating.

In 2026, another method involves using trusted SaaS platforms.

Instead of setting up your own servers, you can use established platforms such as Google AppSheet, Atlassian Jira, and others.

For example, at the end of 2025, spammers used trial Jira accounts and built-in automation features to send thousands of emails inviting users to casinos or crypto platforms. The emails promised bonuses, free spins, and attractive passive-income opportunities.

In other words, if the emails are written carefully — focusing not directly on slots but on the possibility of additional income — the method can work.

Choosing the Right Creatives and Copy

Shock content and bold promises of winning a million no longer work. Users want value. Players want bonuses with clear wagering requirements. Those looking to lose weight want an additional fat burner or a new easy-to-follow diet.

The key is personalization and an individual approach. McKinsey experts found that companies that personalized their emails generated 10% more profit.

“Contrary to popular belief, the secret to high engagement is not clever emails, but a human approach.

The sender is a person. We sell to people, not companies. I sign with my name, not ‘CPV Lab.’ This creates the feeling of a personal conversation,” — Jonathan Bouchard, Performance Marketing Champions.

Choose non-aggressive copy. Don’t pressure the user — let them read the information calmly and make their own choice. Always include an “Unsubscribe” button. This is a requirement from Gmail and other email services. But it also benefits you: users are less likely to feel that they are being manipulated.

Verticals Where Email Still Works

In 2026, there are still several affiliate marketing verticals where email campaigns remain profitable:

1. Gambling and betting. Keywords such as “free spins” and “bonus” are not popular with anti-spam filters, but email can still be worth using. The audience is already willing to spend money on gambling, and email campaigns can generate first-time deposits. For example, from November 24 to 30, 2025, one team generated 422 FTDs (original article in Russian) totaling $20,213.65.
2. Crypto and finance. Just as in gambling, LTV matters in crypto. Users no longer respond to messages like “Get a million on top of your salary in 30 days,” but they may respond to “Pay a small fee and receive Bitcoin in your wallet.” Emails may include links to telegra.ph or Google Forms to bypass algorithms and increase trust.
3. Adult, dating, and SOI/DOI offers. People will always want to connect, so they continue to provide and confirm their email addresses to gain access to new connections.
4. Nutra. To place an order at a discount, users need to provide a phone number and/or email address for contact. Pre-landers may also promise an additional guide on weight loss, anti-aging, or stabilizing blood sugar levels.
5. E-commerce — white-hat approaches. This is not spam but a legitimate email marketing tool based on audience segmentation and analysis.

Conclusion

In 2026, email spam campaigns are still more alive than dead. But email marketing requires deep technical expertise: authentication, reputation management, server and domain setup, and much more.

Spam campaigns still work well in nutra, gambling, crypto, and dating. But without your own list of active email addresses and properly configured technical processes, there is little point trying to work with any of these verticals.in setup, and much more. Spam still works well in nutra, gambling, crypto, and dating. But without your own database of active addresses and proper technical setup, there’s nothing to do in any vertical.