Spam Statistics 2026: Daily Volume, Sources and Costs

Spam statistics for 2026 show junk email is still close to half of all mail. Kaspersky measured spam at 44.99% of global email traffic in 2025, down from 47.27% in 2024. Applied to Statista's estimate of about 376 billion emails a day, that is roughly 170 billion spam emails every day (our calculation). Russia, China and the United States sent the most spam in Kaspersky's data. In the US, email was the most reported fraud contact method in 2024, tied to USD 502 million in losses. Below are the verified numbers and what they mean for security teams.

Spam statistics at a glance

Every figure below was checked against the publisher's own report or page on 5 November 2026. Spam numbers come from different vantage points (a security vendor's mail traffic, a mailbox provider, a government complaint database), so read the "What it measures" column before comparing two rows.

Primary sources for each row are linked in the sections below and listed under Sources and References.

How many spam emails are sent per day?

No organization counts every spam email sent on the internet. The best available answer combines two published estimates: the share of email that is spam and the total number of emails sent each day.

Statista's daily email volume page puts 2025 at about 376 billion emails sent and received a day, a figure that secondary sites attribute to the Radicati Group. Kaspersky's Spam and phishing in 2025 report puts the yearly average spam share at 44.99%. Multiplying the two gives about 169 billion, which we round to roughly 170 billion spam emails a day. Treat it as an order of magnitude, not a count: Kaspersky measures the traffic its products see, and Statista's figure counts messages sent and received.

You will often see "51.8% of emails are spam" and "195 billion spam emails a day" quoted for 2025. Kaspersky's report shows that 51.80% was the December 2025 monthly share, not the annual average. Applying one peak month to the whole year inflates the daily estimate by about 26 billion messages.

Mailbox providers publish their own filtering totals, which show the scale from the receiving side. Google said in October 2023 that Gmail blocks nearly 15 billion unwanted emails every day. Microsoft's Digital Defense Report 2025 says it screens about 5 billion emails a day for malware and phishing. Both figures cover one provider's users, so they are not shares of global spam.

What share of email is spam?

Spam has hovered between about 45% and 49% of global email in Kaspersky's measurements since 2022. The long-run trend is down: Statista's spam share series, which uses the same Kaspersky data, notes that the share "has decreased significantly" since 2011.

Three details matter for 2025:

• The fourth quarter was the busiest. Spam averaged 49.26% of email in Q4 2025, with November at 52.87% and December at 51.80%. Kaspersky notes this broke the pattern of earlier years. The rest of the year averaged about 43.50%.
• Less spam, more malware. The share fell 2.28 points, but blocked malicious attachments rose about 15% (our calculation from 125.5 million to 144.7 million).
• Phishing link blocks fell. Kaspersky blocked 554,002,207 attempts to follow phishing links in 2025, down from 893,216,170 in 2024. The phishing story is covered in our phishing statistics.

Kaspersky's 2024 report describes the 2024 rise as 1.27 points, while its 2023 report gives 45.60%, which implies 1.67 points. This page uses the annual values each report publishes, not the stated changes.

Where does spam come from?

Country rankings depend on who is measuring. Kaspersky ranks the countries that sent the most spam in the traffic it saw in 2025:

Russia's share fell from 36.18% in 2024, while China and the US each rose by about 2 points. Kaspersky also reports a separate "Runet" figure: spam was 43.27% of email in the Russian web segment in 2025.

Cisco Talos shows a different picture. Its live spam sender table, read on 5 November 2026, ranked the United States first with a last-day volume score of 8.0, followed by the Netherlands (7.1), Germany (6.9), France (6.9) and Russia (6.8). Talos uses a base-10 log scale where 10 equals all of the world's email, so a one-point gap is a tenfold difference: the US score implies roughly eight times the Netherlands' spam volume that day.

Why the two disagree:

• Different sensors. Kaspersky's ranking reflects mail its products process, with a large user base in Russia and the CIS. Talos sees traffic through Cisco's email security customers, many of them in North America and Europe.
• Different time frames. Kaspersky averages a full year. Talos shows a single day.
• Sending location is not attacker location. Spam often goes out through compromised servers, cloud hosts and legitimate bulk-mail platforms, so a country ranking says where infrastructure sits, not where operators live.

Kaspersky also lists where malicious attachments were blocked, which shows who is targeted rather than who sends: China (13.74%), Russia (11.18%), Mexico (8.18%), Spain (7.70%) and Türkiye (5.19%) led in 2025.

Types of spam in 2025

Most spam is still unwanted marketing, but the share that carries scams or malware is what security teams care about. Kaspersky's 2025 report and Microsoft's Digital Defense Report 2025 describe these main types:

A few numbers stand out. Kaspersky blocked more than 80,000 "brand partner" scam emails in December 2025 alone, a scheme it first detected that year. The most common malware family in email attachments was Makoob (4.88% of detections), followed by Badun (4.13%), Taskun (3.68%) and the Agensla stealer (3.16%). Microsoft's report says email bombing evolved in 2025 from a smokescreen into a first stage of attacks, often followed by vishing or Teams impersonation of IT support.

The "abuse of trusted services" row matters most for defenders. Kaspersky notes that Google Forms messages "appear authentic to most spam filters" because they come from Google's own servers. Authentication proves who sent a message, not whether its content is safe.

Spam versus phishing: where the overlap starts

Spam is unsolicited bulk email. Phishing is a deceptive message designed to steal credentials or money, and it often travels inside spam campaigns. This page counts spam volume and types; our phishing statistics cover phishing volumes, click rates and losses, and our business email compromise statistics cover targeted payment fraud.

The overlap shows up in tactics. Kaspersky saw QR codes moved from email bodies into PDF attachments to dodge filters, a technique explained in our guide to QR code phishing (quishing). Stealer malware delivered as attachments feeds the credential market described in our analysis of infostealer malware and credential theft. Spam is not only an email problem either: fake account sign-ups and form spam are covered in our bot attack statistics.

The cost of spam

Spam's cost lands mostly on recipients and the companies that filter it, not on spammers.

The academic estimate is old but still the most cited peer-reviewed figure. In "The Economics of Spam", Justin Rao and David Reiley estimated that spam imposes almost USD 20 billion a year on American firms and consumers, while spammers earn about USD 200 million worldwide. They noted the cost would be much higher without private spending on anti-spam technology.

The FTC data shows how spam turns into direct losses. In the Consumer Sentinel Network Data Book 2024, email was the contact method in 25% of fraud reports that named one, more than any other channel. Only 11% of those reports involved a loss, the lowest rate of any contact method, but the total still reached USD 502 million. Spam is a high-volume, low-yield channel: most messages fail, and the few that land are enough.

For legitimate senders, the cost is regulatory. The FTC's CAN-SPAM Act compliance guide says each separate violating email can carry a penalty of up to USD 53,088. The law covers business-to-business email too, and opt-out requests must be honored within 10 business days.

SPF, DKIM and DMARC explained

Most spam filtering relies on content and reputation, but three DNS-based standards decide whether a message can prove it comes from the domain it claims. They matter most against spoofed spam, where a criminal sends as your domain.

DMARC is the piece that ties authentication to the address people actually see. A domain owner publishes one of three policies: p=none (monitor only), p=quarantine (send failing mail to spam) or p=reject (refuse it). Aggregate reports show every server sending mail as the domain, which is how teams find forgotten marketing tools and spoofing.

The DMARC standard itself changed this year. In May 2026 the IETF published RFC 9989, which replaces RFC 7489, moves DMARC to the Standards Track and drops little-used tags such as pct. The SPF specification, RFC 7208, and the DKIM specification, RFC 6376, are unchanged.

Adoption among legitimate mail is high but not complete. Cloudflare Radar's email security data for the 12 months to 5 November 2026 showed 88.8% of messages passing DMARC, 5.2% failing and 6% with no DMARC policy. SPF failed for 15.4% of messages, often because of forwarding or unlisted senders.

The Google and Yahoo bulk sender rules

In October 2023, Google announced that from February 2024 anyone sending more than 5,000 messages a day to Gmail addresses would have to authenticate their mail, offer one-click unsubscribe and keep reported spam below a set threshold. Yahoo adopted the same requirements, and Microsoft followed for Outlook.com in 2025.

The details come from Google's announcement and its Email sender guidelines, the Yahoo Sender Hub and Microsoft's Outlook requirements for high-volume senders. Google's sender FAQ also says that once a domain is classified as a bulk sender, the status is permanent.

Did the rules work? Google said in 2023 that an earlier requirement for some authentication on all mail to Gmail cut unauthenticated messages its users received by 75%. In October 2024, Gmail's security product lead told Forbes that the bulk sender rules brought a 65% reduction in unauthenticated messages to Gmail users and 265 billion fewer unauthenticated messages in 2024. Those are Google's figures for Gmail only. Authentication removes spoofed mail from the easy path; it does not stop spam from authenticated domains or hijacked accounts.

What the numbers mean for security teams

The statistics point to a short list of controls. This is DeepStrike's method guidance, mapped to the evidence above:

1. Inventory every service that sends as your domain. Marketing, billing, HR and support tools often send mail you do not know about. Output: a sender list that matches your SPF record and DKIM keys.
2. Move DMARC from p=none to enforcement. Publish p=none with reporting, fix the legitimate senders the reports reveal, then step to quarantine and reject. Output: spoofed mail using your exact domain is refused by receivers that honor DMARC.
3. Watch for lookalike domains. DMARC does not cover domains that only resemble yours. Output: monitoring and takedown for registered lookalikes.
4. Treat content from trusted platforms as untrusted. Spam sent through Google Forms, Groups or OpenAI invites passes authentication. Output: link and attachment analysis that does not skip "authenticated" mail.
5. Harden attachment handling. Malicious attachment detections rose about 15% in Kaspersky's 2025 data. Output: sandboxing of archives and documents, blocking of script files and password-protected archives where business allows.
6. Prepare the help desk for email bombing. Microsoft describes inbox floods followed by fake IT support calls. Output: a verification procedure before any remote access session.
7. Test the human layer. Filters stop most spam; the messages that land target people and processes. A social engineering penetration test checks, with written authorization, whether staff and help desks follow the procedures above.

DeepStrike's case study on how invoice emails were used to reach GitHub and Slack shows how email trust assumptions inside applications can be abused, which is another reason not to treat authenticated mail as safe content.

How we compiled these spam statistics

We used the newest edition of each source and checked every figure on the publisher's page on 5 November 2026.

Derived figures are labeled "our calculation." We did not add up figures from different sources except in the daily volume estimate, where the method is shown. Kaspersky phishing figures appear only to mark the overlap with phishing; full phishing data lives on our phishing statistics page.

Frequently asked questions

How many spam emails are sent per day?

About 170 billion a day in 2025, by our calculation. That applies Kaspersky's 2025 average spam share of 44.99% to Statista's estimate of about 376 billion emails sent and received daily. At the Q4 2025 share of 49.26%, the figure rises to about 185 billion. The often-quoted 195 billion uses December's 51.80% share for the whole year.

What percentage of email is spam?

Kaspersky measured spam at 44.99% of global email traffic in 2025, down from 47.27% in 2024 and 45.60% in 2023. The monthly share peaked at 52.87% in November 2025.

Which country sends the most spam?

In Kaspersky's 2025 data, Russia sent 32.50% of spam, followed by China (19.10%) and the United States (10.57%). Cisco Talos's live sender data, read on 5 November 2026, ranked the United States first. The rankings differ because each company measures different traffic over different periods.

Is spam increasing or decreasing?

Spam's share of email is broadly flat to down: Kaspersky's figure moved between 44.99% and 48.63% from 2022 to 2025, and Statista notes a long decline since 2011. Total email volume keeps growing, so the absolute number of spam messages can rise even when the share falls. Malicious attachments rose about 15% in 2025.

What does spam cost?

The most cited academic estimate puts spam's cost to American firms and consumers at almost USD 20 billion a year (Rao and Reiley, 2012). The FTC recorded USD 502 million in US consumer fraud losses in 2024 where email was the first contact.

What are the Gmail and Yahoo bulk sender requirements?

Since February 2024, senders of 5,000 or more messages a day to Gmail or Yahoo must authenticate with SPF and DKIM, publish a DMARC policy of at least p=none with alignment, support one-click unsubscribe honored within two days, and keep spam complaints below 0.3%. Gmail increased enforcement, including rejections, from November 2025.

Do SPF, DKIM and DMARC stop spam?

They stop spoofing of your exact domain when DMARC is set to quarantine or reject. They do not stop spam from lookalike domains, compromised accounts or trusted platforms such as Google Forms, which pass authentication. Content filtering and user reporting are still needed.

Next steps

Spam volume is stable at close to half of all email, but the share carrying malware and the tricks that bypass authentication are growing. Filters handle the bulk; the remaining risk sits in your domain configuration, your attachment controls and the people who answer suspicious emails and calls.

If you want to know how your team and help desk respond when a spam-led lure gets through, DeepStrike's penetration testing services include manual social engineering testing with fix recommendations for every finding.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• Kaspersky (Securelist), Spam and phishing in 2025 (11 February 2026): https://securelist.com/spam-and-phishing-report-2025/118785/
• Kaspersky (Securelist), Spam and phishing in 2024 (19 February 2025): https://securelist.com/spam-and-phishing-report-2024/115536/
• Kaspersky (Securelist), Spam and phishing in 2023 (7 March 2024): https://securelist.com/spam-phishing-report-2023/112015/
• Statista, Global spam volume as percentage of total email traffic (March 2024): https://www.statista.com/statistics/420400/spam-email-traffic-share-annual/
• Statista, Number of sent and received emails per day worldwide (updated September 2025): https://www.statista.com/statistics/456500/daily-number-of-e-mails-worldwide/
• Cisco Talos, Email & Spam Data (read 5 November 2026): https://talosintelligence.com/reputation_center/email_rep
• Google, "New Gmail protections for a safer, less spammy inbox" (3 October 2023): https://blog.google/products/gmail/gmail-security-authentication-spam-protection/
• Google, Email sender guidelines: https://support.google.com/a/answer/81126
• Google, Email sender guidelines FAQ: https://support.google.com/a/answer/14229414
• Yahoo, Sender Hub best practices: https://senders.yahooinc.com/best-practices/
• Microsoft, "Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders" (2 April 2025): https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730
• Microsoft, Digital Defense Report 2025 (October 2025): https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report-2025/
• Forbes, "Google Confirms New Gmail Security Boost For 2.5 Billion Users" (8 October 2024): https://www.forbes.com/sites/daveywinder/2024/10/08/google-confirms-new-gmail-security--boost-for-25-billion-users/
• Cloudflare Radar, Email Security (read 5 November 2026): https://radar.cloudflare.com/security/email
• IETF, RFC 9989, Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (May 2026): https://www.rfc-editor.org/rfc/rfc9989.html
• IETF, RFC 7208, Sender Policy Framework (SPF): https://www.rfc-editor.org/rfc/rfc7208
• IETF, RFC 6376, DomainKeys Identified Mail (DKIM) Signatures: https://www.rfc-editor.org/rfc/rfc6376
• Federal Trade Commission, Consumer Sentinel Network Data Book 2024 (March 2025): https://www.ftc.gov/system/files/ftc_gov/pdf/csn-annual-data-book-2024.pdf
• Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
• Justin M. Rao and David H. Reiley, "The Economics of Spam," Journal of Economic Perspectives 26(3), 2012: https://www.aeaweb.org/articles?id=10.1257/jep.26.3.87