The present disclosure relates to mitigating email spam attacks. A gateway is configured to receive mail from one or more mail systems. If mail is intended for delivery to an invalid address, the gateway can generate status messages for delivery to the mail systems or determine if a threshold for delivery attempts to the invalid address has been met. If the threshold has been met, the gateway can request creation of a honeypot email address, and future mail intended for delivery to the invalid address are delivered to a mailbox associated with the honeypot email address. Various actions can be taken with respect to the mail delivered to the honeypot email address including analysis, blacklisting of senders, and/or other actions.