Most of the spam in your inbox is mail you agreed to. That is the pile you can actually stop.

An editor asked for the version of this called delete all your spam in ten minutes, for ever. This is the other one.

It takes ninety minutes to four hours the first time, and about ten minutes a month after that for as long as you use the address. The long end is not the work. It is the twenty minutes you spend finding out that your provider keeps filtering rules in two places, that only one of them is the one the help page describes, and that the other one is the one that runs.

What this achieves, and the three things it does not

It removes senders rather than messages. Deleting mail is what most people mean by dealing with spam, and it is the one activity with no compounding effect at all: the sender is unaffected and writes again on Thursday.

Three boundaries, near the top, so a reader who needs something else can stop here.

None of this reduces the volume sent to you. It reduces the volume that reaches your attention, which is a different problem with the same symptom, and the difference surfaces the day somebody asks you for a complete mailbox.

It does nothing about targeted fraud. A message written by someone who knows your name, your finance director's name and your invoice cycle arrives once, addressed to you alone, from a domain that passes every authentication check there is. No rule you write today sees it.

And it does not stay done. Lists are resold, companies re-register you when they buy each other, and a mail migration resets your rules to the defaults without mentioning it. Anything sold to you as permanent is being sold to you.

What you need before you start

Your own mail settings, which for a work address may mean an administrator — and finding out who that is is the prerequisite people otherwise discover halfway through step three, at five o'clock. Remote image loading turned off. A number, which is step one.

No menu paths follow. Labels differ by provider, by version and by whether your organisation has customised the client, and an article printing an exact route for a product it has not opened this week is printing fiction.Look for the words instead: rule, filter, block, junk, unsubscribe. Every mail system has all five somewhere, usually two clicks from where you first look.

The steps

1. Count what arrives, before you change anything. Ten minutes. Take a week that is already in the mailbox and count what you would call spam. Write the number down. You need the before, because everything below is judged by a number and nobody remembers their own honestly.

2. Sort that week into three piles. Twenty to thirty minutes. Consented: you gave them the address — a supplier's newsletter, a conference, a shop. Sold: real companies writing to an address they bought or scraped, which is most sales outreach. Criminal: messages pretending to be someone, usually a bank you do not use or a parcel you did not order.

This sort is the procedure. Everything after it is mechanical. It comes second, rather than being skipped by someone in a hurry, because the correct action differs for each pile and two of the three do damage when applied to the wrong one.

3. Unsubscribe from the consented pile, and only that one. Forty to ninety minutes the first time. Where your client shows its own unsubscribe control at the top of the message, use that rather than the link in the footer: it speaks to the sender's machine through a header, so nothing renders and nothing is confirmed about you. Where there is no such control, the footer link is fine for this pile, because these senders are traceable businesses with a reason to honour it.

Expect twenty to forty senders in a mailbox that has never had this done, about a minute each, and longer for the ones that answer with a preference centre offering nine mailing streams and no button that turns off all nine. Some will sign you up again the next time you buy something. That is the system working as designed, not the step failing.

4. Report the criminal pile. Never unsubscribe from it. Seconds each, indefinitely. Use the report or junk control rather than delete, because the report trains the classifier that files your mail and deleting teaches it nothing. The unsubscribe link in a fraudulent message does the opposite of what it says: it confirms a live reader at a live address, which is the most valuable thing you own from the sender's point of view.

5. File the sold pile with rules that move, not rules that delete. Thirty to forty-five minutes. Write the rule against the sending domain rather than the subject line, because the subject changes weekly and the domain is what they paid for. Send matches to a folder.

A rule that deletes hides its own mistakes. A rule that moves puts them somewhere you can go and look.

Then look in that folder once a week for a fortnight. You will find one legitimate sender in it, and you would rather find them there than not at all.

6. Give every new relationship its own address. Fifteen minutes, or a fortnight. Aliases, plus-addressing, or a catch-all on a domain you control — whichever your provider supports. This does nothing for today's volume, which is why it is last and why most people never do it. It is also the only step that compounds: when an address starts receiving mail from strangers, you know which counterparty leaked it, and you retire one address instead of negotiating with a list. The fortnight is if your mail is run by someone else and this becomes a request rather than a setting.

How to tell it worked

Recount the same week-length sample three weeks later, not three days. Senders act on unsubscribe requests at their own pace and the slow ones use all of it.

Judge the three piles separately, because a single total hides the only movement worth reading. The consented pile should fall sharply; if it has not roughly halved, you missed senders rather than steps, and the fix is another pass at step three. The sold pile falls less, and unevenly. The criminal pile does not move, and should not — nothing you did was aimed at it. If it drops, your provider's filter changed, not your mailbox.

How to get back

Reverse in the order you would expect to regret things.

The rules first, because they are the only step that can lose you mail: delete the rule, then check the folder it was filling, because turning a rule off does not re-file what it already moved. Spam reports next — marking a message not spam reverses one, but the classifier weighs several messages against each other, so expect two or three corrections before a sender comes back reliably.

The unsubscribes you cannot undo from your side at all. That record now lives with the sender, and getting back on the list means going to their site and asking. Which is a fair description of what you just spent an afternoon escaping.

Put forty minutes in the calendar for March

The count creeps, because a company you bought from in November sold its customer file in January, and because the conference you attend every year treats each registration as fresh consent.

Book two repeats of step three a year, forty minutes each, and the creep stays a chore. Skip them and it is a project again in about eighteen months. The other version of this article — the ten-minute one — is not quite a lie. It works, and it works for roughly a month, which is long enough for nobody to connect the disappointment to the advice.