My App Is Sending Spam Emails I Didn't Create
Users are telling you they're getting weird emails from your app — promotional messages, phishing attempts, or password reset links they didn't request. You didn't set up any of these emails, and you have no idea how they're being sent.
This usually means someone has gained access to your email sending service (like SendGrid, Mailgun, or your SMTP credentials) and is using your account to blast out spam. Your domain and reputation are being destroyed with every email sent.
The damage goes beyond annoying your users. Email providers like Gmail and Outlook may permanently blacklist your domain, meaning even your legitimate emails will go to spam forever if you don't act quickly.
Error Messages You Might See
Common Causes
- Email API key stolen — Your SendGrid, Mailgun, or other email service API key is exposed in your code or has been stolen
- Contact form exploited — Your app's contact form or email feature has no rate limiting, so bots are using it to send thousands of messages
- Open email relay — Your email server is configured to let anyone send emails through it without authentication
- Compromised server — Someone gained access to your server and installed their own email-sending scripts
- Spoofed sender address — Someone is sending emails that look like they're from your domain (you can't fully prevent this without proper DNS records)
How to Fix It
- Revoke your email API key immediately — Go to your email service dashboard and delete/rotate the current API key to stop all sending
- Check your email service logs — Look at SendGrid, Mailgun, or your email provider to see how many emails were sent and to whom
- Add rate limiting to forms — Limit how many emails any single user or IP address can trigger per hour
- Set up SPF, DKIM, and DMARC records — These DNS records help prove that only you can send emails from your domain
- Add CAPTCHA to public forms — Prevent bots from abusing any form that triggers email sending
- Check for malicious code on your server — Have a developer scan your server for unauthorized scripts or files
Real developers can help you.
Nam Tran
10 years as fullstack developer
BurnHavoc
Been around fixing other peoples code for 20 years.
Omar Faruk
As a Product Engineer at Klasio, I contributed to end-to-end product development, focusing on scalability, performance, and user experience.
My work spanned building and refining core features, developing dynamic website templates, integrating secure and reliable payment gateways, and optimizing the overall system architecture.
I played a key role in creating a scalable and maintainable platform to support educators and learners globally.
I'm enthusiastic about embracing new challenges and making meaningful contributions.
Kingsley Omage
Fullstack software engineer passionate about AI Agents, blockchain, LLMs.
zipking
I am a technologist and product builder dedicated to creating high-impact solutions at the intersection of AI and specialized markets. Currently, I am focused on PropScan (EstateGuard), an AI-driven SaaS platform tailored for the Japanese real estate industry, and exploring the potential of Archify.
As an INFJ-T, I approach development with a "systems-thinking" mindset—balancing technical precision with a deep understanding of user needs. I particularly enjoy the challenge of architecting Vertical AI SaaS and optimizing Small Language Models (SLMs) to solve specific, real-world business problems. Whether I'm in a CTO-level leadership role or hands-on with the code, I thrive on building tools that turn complex data into actionable value.
Matthew Butler
Systems Development Engineer @ Amazon Web Services
Pratik
SWE with 15+ years of experience building and maintaining web apps and extensive BE infrastructure
Luca Liberati
I work on monoliths and microservices, backends and frontends, manage K8s clusters and love to design apps architecture
Richard McSorley
Full-Stack Software Engineer with 8+ years building high-performance applications for enterprise clients. Shipped production systems at Walmart (4,000+ stores), Cigna (20M+ users), and Arkansas Blue Cross. 5 patents in retail/supply chain tech. Currently focused on AI integrations, automation tools, and TypeScript-first architectures.
prajwalfullstack
Hi Im a full stack developer, a vibe coded MVP to Market ready product, I'm here to help
Describe what's wrong in plain English. No technical knowledge needed.
Get HelpFrequently Asked Questions
How do I know if my domain has been blacklisted?
Use free tools like MXToolbox.com or mail-tester.com to check if your domain or IP is on any email blacklists. If it is, you'll need to clean up the issue and then request removal from each blacklist.
Can I stop people from sending emails that look like they're from my domain?
You can make it much harder by setting up SPF, DKIM, and DMARC records in your domain's DNS settings. These tell email providers which servers are authorized to send email on your behalf.