Recruiter mail is scraped from places you published your address deliberately — professional profiles, CVs on job boards, conference lists, public code repositories. That makes filtering a symptom treatment: you wanted to be findable, and you succeeded. The fix is controlling which address is findable, so you stay reachable to the roles you want and can cut the rest off in one action.
Where they actually get it
- CVs uploaded to job boards. Many boards sell or license their database to recruiters — that's the business model, and it's usually in the terms you accepted.
- Professional network profiles, plus the sourcing tools that scrape them at scale.
- Public code repositories. Commit metadata contains an email address. Technical recruiters mine this systematically, and most engineers have no idea it's there.
- Conference attendee and speaker lists.
- Company "team" pages and press releases naming you.
- Guessed from a pattern. If your employer uses firstname.lastname@, your work address is derivable from your name and employer alone.
Notice how many of those are things you did on purpose. That's what makes recruiter mail different from ordinary spam — you opted into visibility, just not into this volume.
The address-level fix
Use a dedicated address for anything career-facing, and never your primary:
- One address for job boards —
jobs@yourdomain.com. This is the one that gets sold. - A separate one for your public profile, if you list an address there at all.
- A separate one again for git commits. Most platforms offer a no-reply address for exactly this; use it, or configure a dedicated alias.
- When you're not job hunting, disable the board address. Re-enable when you are. That's a control no filter can give you.
The last point is the real win. Recruiter interest is seasonal for most people — you want it during a search and not otherwise. An address you can switch on and off matches that reality; a filter that permanently blocks recruiters doesn't.
Cleaning up what's already out
- Remove your address from public profiles where it isn't essential. Recruiters can use the platform's own messaging.
- Fix git. Check what address your commits carry, and switch to a no-reply or alias. Historical commits keep the old one, but you stop adding to it.
- Check job board privacy settings. Many have a "make my CV searchable" toggle that's on by default and is the actual source.
- Unsubscribe from agencies you recognise. Legitimate ones comply, and once you've opted out they may not pass your address on. When it works
Filtering, as a stopgap
Worth doing alongside, not instead. Rules matching common phrasing — "exciting opportunity", "came across your profile", "reaching out regarding a role" — will catch a lot. Route to a folder rather than deleting, so a genuinely good approach isn't lost.
The limitation is the usual one: it sorts messages after they arrive and does nothing about how many agencies hold your details. Why filters can't finish
The trade-off to be honest about
Unlike most spam, a fraction of recruiter mail is genuinely valuable — the right role at the right moment. Blanket-blocking is a real cost, not a free win.
That's the argument for an address you control rather than a filter you fight: it's a switch you flip when your situation changes, instead of a permanent decision made when you were annoyed.
More: protecting your address generally · a unique address per service