In forceHygieneIn force 1 Jan 2023

Signup forms need anti-automation controls

How do signup bombs and bot list injections wreck deliverability?

In one sentence

Bots will stuff your form with junk and — CAPTCHA, rate limits, and protect the list.

Plain English

Automated signups dump fake or trap addresses onto your file. You then mail them and take the reputation hit. Use bot resistance (CAPTCHA or equivalent), rate limits, and preferably for cold acquisition. “Fewer form fields” is not a reason to skip this.

Why it matters. Deliverability crises often start on the form, not in the campaign builder.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

This one needs you

No platform does this for you. One concrete move, then you are done.

Some -hosted forms ship CAPTCHA and bot signals. Custom site forms, Shopify apps and partner embeds often do not.

Your part: Inventory every path that can create a profile, and verify controls on each path—not only the main footer form.

What to do first

List every form, quiz, popup and API that can create an email profile. For each, note CAPTCHA/bot protection, , and who owns the spike alert. Empty cells get fixed first.

You can skip this if: You have no public signup path and only manually load confirmed addresses (rare).

Who this applies to

Anyone with a public email signup, quiz, lead magnet or partner embed.

Checklist

01Prefer on high-risk or forms.
02Rate-limit submissions and alert on spikes that do not match campaigns.
03Do not treat an experimental or expired header proposal as protection.
04Verify partner and agency embeds; they are common unprotected paths.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

M3AAWG documents automated form abuse that injects spam-trap and third-party addresses into legitimate lists, then blames the brand when mail goes out. Recommended controls include CAPTCHA or equivalent anti-automation, , rate limits and monitoring abnormal signup spikes. An expired experimental IETF header is not a substitute for protecting the form. Spamhaus has documented source IPs listed after such abuse.

What happens if you do not

No single "bot form" fine. Outcomes are trap hits, blocklist listings and review. The public record is operational (Spamhaus, M3AAWG), not a regulator tariff.

Sources

M3AAWG, Sender Best Common Practices
No publisher dateRead primary source
M3AAWG, Spamtrap Best Common Practices
No publisher dateRead primary source

History of this page

2 Aug 2026Added from M3AAWG BCPs.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.