Subscription Bombing: Protect Your Sign-Up Forms From Abuse

Short answer: Subscription bombing, also called list bombing, is an attack in which criminals sign one victim’s email address up to thousands of forms at once, so the victim’s inbox is flooded. If your form is one of them, you send unwanted messages to a stranger, and that can lead to complaints and a damaged reputation. Double opt-in, bot protection, rate limits and monitoring stop most of it.

What subscription bombing is

In a typical attack, a script takes one email address and submits it to a very large number of sign-up forms, contact forms and newsletter boxes across the internet. Each site sends back a confirmation message, a welcome email or a download link. Within minutes, the victim receives hundreds or thousands of messages from companies they have never heard of.

The aim is often to bury something important. A criminal who has taken over a bank or shop account may want the real warning messages, such as a password change or a payment alert, to be lost in the noise. In other cases the goal is simple harassment, or to make a mailbox unusable.

The victim is not the only one affected. Every site that takes part, without knowing it, sends mail to someone who never asked for it. Your form is the weapon, and your domain’s reputation pays part of the price.

Why it matters to you as a site owner

When a stranger receives an unwanted confirmation message, a few of them will mark it as spam. Others may report it to their provider or to a blocklist. Mailbox providers watch the share of messages that are reported, and a high rate harms your sender reputation. Our article on how to reduce spam complaints explains the numbers providers care about.

There are other costs too. A sudden wave of sends can push you over the limits of your email service, as described in why email gets throttled, so genuine customers wait for their messages. Fake addresses create bounces, which hurt further, and a polluted list is harder to use for real marketing. Finally, some of the addresses in the wave may be spam traps, which are particularly bad for your standing; see what spam traps are.

How to recognise an attack

Signs of subscription bombing include:

A sudden jump in new subscribers, often many times your normal daily number.
Sign-ups arriving every few seconds, from many different addresses in a short time.
Strange addresses with random letters, or addresses from a mix of unrelated domains.
A rise in bounces and complaints a day or two after the spike.
Reports from people saying that they never signed up.
Sign-ups with empty or nonsense names, or with text in fields that are normally left blank.

Look at the sign-up times in your form tool or email service. A natural pattern follows the working day and your campaigns. An attack looks like a vertical line on a chart.

Use double opt-in with care

Double opt-in means that a person who signs up is not added to your list until they click a link in a confirmation email. It is the best defence against fake and malicious sign-ups, because an address that is not confirmed never becomes a subscriber. We compare the two methods in double opt-in versus single opt-in.

There is one catch: the confirmation email itself is what a bomber wants you to send. So double opt-in must be combined with limits:

Send only one confirmation message per address in a given period, for example one per day.
Do not send a second email when the same address is entered again; show the same neutral message on the screen either way.
Make the confirmation email short and clear, with your company name and the page where the person signed up, so recipients know why they got it.
Delete unconfirmed entries after a few days, and never send marketing to them.

Block bots before they reach the form

Most attacks are automatic, so a barrier that stops scripts will stop most of them. Combine several light measures instead of relying on one heavy one:

A challenge that is easy for people. Use a bot-detection service or a simple invisible test. Choose one that does not make real visitors solve difficult puzzles, or you will lose genuine sign-ups.
A honeypot field. Add a hidden field that real people do not see and bots usually fill in. Reject any submission where it contains something.
A minimum time. A form submitted within one second of loading was not filled in by a person.
Server-side checks. Validate the address format on the server, not only in the browser, and check that the domain can receive mail.
Disposable domains. Block sign-ups from known temporary mail services if they are not useful to your business.

The same ideas protect contact forms, and our guide to stopping contact form spam without losing leads goes deeper into the trade-offs.

Limit how often the form can be used

Rate limiting is the technical backbone of the defence. Set limits at several levels:

Per visitor address. For example, a handful of submissions per hour from one IP address. Because attackers use many addresses, this alone is not enough, but it stops simple scripts.
Per email address. The same recipient should not receive more than one message from your form in a short period, whoever submits it.
Overall. A ceiling on the total number of confirmation emails per hour. If it is reached, queue the rest and alert yourself instead of sending everything.

Many firewalls and content delivery services can apply these rules before a request reaches your server. They also help against the wider problem of aggressive automated traffic, which we describe in bad bots and aggressive crawlers.

What to do when an attack is under way

Pause confirmation sending or switch on a stricter bot challenge for a while.
Look at the pattern in the sign-up log: the shared addresses, user agents or timing. Block them at the firewall if they are clear.
Do not email the whole new batch. Keep the unconfirmed entries out of every campaign.
Remove the fake entries once the wave is over, using the approach in email list hygiene.
Watch your reputation for the next days: complaint rates, bounces and blocklist status.
Answer people who write to you politely, confirm that you have removed the address, and explain that your form was misused.

Protect the other forms too

Attackers do not only use newsletter boxes. Any form that sends an automatic email to the address typed in can be abused: contact forms with an automatic reply, account registration, password reset, download requests, quote forms and event bookings. Review each of them and ask whether it sends mail to an address that has not been confirmed.

For contact forms, a good rule is to send the automatic reply only after the message passes your spam checks. For password resets, show the same neutral screen whether or not the address exists, and limit how often a reset can be requested. For registration, require confirmation before sending anything else.

It is also wise to review the email service you use. Some services let you set a cap on how many messages one recipient can get in an hour. A cap like that protects your reputation even when a bot finds a gap in your form.

What Site AI Audit can and cannot tell you

Site AI Audit checks the email setup of your domain from the outside: SPF and its lookup limit, DKIM signatures, the DMARC policy and MX records. It does not see your forms or your sign-up logs, so it cannot detect an attack in progress. What it shows is whether your domain is set up so that a sudden wave of sending does not also lead to spoofing and rejection. You can run a free check of your domain or look at the pricing page if you want regular re-checks.

The bottom line

Subscription bombing turns an ordinary sign-up form into a tool for harassing a stranger, and your domain’s reputation is at risk. Use double opt-in with strict limits on repeat messages, add light bot protection, apply rate limits and watch for sudden spikes. If an attack happens, pause, investigate, clean the list and monitor your reputation.

FAQ

Is subscription bombing the same as spam?

Not exactly. The messages are real confirmation or welcome emails sent by legitimate sites, but triggered by a false request. The effect on the victim is like spam, and your site is an unwitting sender.

Does double opt-in stop list bombing completely?

It stops fake addresses from joining your list, but the confirmation email is still sent once. Limit repeat sends per address and combine double opt-in with bot protection and rate limits.

Should I use a CAPTCHA on every form?

Not necessarily. A visible puzzle can reduce genuine sign-ups. Start with a honeypot, a minimum submission time and rate limits, and add a stronger challenge only when you see abuse.

Can an attack harm my email deliverability?

Yes. Complaints, bounces and traps linked to the wave can lower your sender reputation, and a large burst can trigger sending limits. Acting quickly and keeping fake addresses out of campaigns limits the damage.

What should I do if someone says they never signed up?

Remove the address at once, reply politely, and check your logs for the sign-up. If many people write the same, you are probably being used in an attack, so tighten your form protection.