My App Is Sending Spam Emails I Didn't Create
Users are telling you they're getting weird emails from your app — promotional messages, phishing attempts, or password reset links they didn't request. You didn't set up any of these emails, and you have no idea how they're being sent.
This usually means someone has gained access to your email sending service (like SendGrid, Mailgun, or your SMTP credentials) and is using your account to blast out spam. Your domain and reputation are being destroyed with every email sent.
The damage goes beyond annoying your users. Email providers like Gmail and Outlook may permanently blacklist your domain, meaning even your legitimate emails will go to spam forever if you don't act quickly.
Error Messages You Might See
Common Causes
- Email API key stolen — Your SendGrid, Mailgun, or other email service API key is exposed in your code or has been stolen
- Contact form exploited — Your app's contact form or email feature has no rate limiting, so bots are using it to send thousands of messages
- Open email relay — Your email server is configured to let anyone send emails through it without authentication
- Compromised server — Someone gained access to your server and installed their own email-sending scripts
- Spoofed sender address — Someone is sending emails that look like they're from your domain (you can't fully prevent this without proper DNS records)
How to Fix It
- Revoke your email API key immediately — Go to your email service dashboard and delete/rotate the current API key to stop all sending
- Check your email service logs — Look at SendGrid, Mailgun, or your email provider to see how many emails were sent and to whom
- Add rate limiting to forms — Limit how many emails any single user or IP address can trigger per hour
- Set up SPF, DKIM, and DMARC records — These DNS records help prove that only you can send emails from your domain
- Add CAPTCHA to public forms — Prevent bots from abusing any form that triggers email sending
- Check for malicious code on your server — Have a developer scan your server for unauthorized scripts or files
Real developers can help you.
legrab
I'll fill this later
Omar Faruk
As a Product Engineer at Klasio, I contributed to end-to-end product development, focusing on scalability, performance, and user experience.
My work spanned building and refining core features, developing dynamic website templates, integrating secure and reliable payment gateways, and optimizing the overall system architecture.
I played a key role in creating a scalable and maintainable platform to support educators and learners globally.
I'm enthusiastic about embracing new challenges and making meaningful contributions.
Krishna Sai Kuncha
Experienced Professional Full stack Developer with 8+ years of experience across react, python, js, ts, golang and react-native. Developed inhouse websearch tooling for AI before websearch was solved : )
Antriksh Narang
5 years+ Experienced Dev (Specially in Web Development), can help in python, javascript, react, next.js and full stack web dev technologies.
MFox
Full-stack professional senior engineer (15+years). Extensive experience in software development, qa, and IP networking.
Franck Plazanet
I am a Strategic Engineering Leader with over 8 years of experience building high-availability enterprise systems and scaling high-performing technical teams. My focus is on bridging the gap between complex technology and business growth.
Core Expertise:
🚀 Leadership: Managing and coaching teams of 15+ engineers, fostering a culture of accountability and continuous improvement.
🏗️ Architecture: Enterprise Core Systems, Multi-system Integration (ERP/API/ETL), and Core Database Structure.
☁️ Cloud & Scale: AWS Expert; architected systems handling 10B+ monthly requests and managing 100k+ SKUs.
📈 Business Impact: Aligning tech strategy with P&L goals to drive $70k+ in monthly recurring revenue.
I thrive on "out-of-the-box" thinking to solve complex technical bottlenecks and am always looking for ways to use automation to improve business productivity.
Matthew Butler
Systems Development Engineer @ Amazon Web Services
Richard McSorley
Full-Stack Software Engineer with 8+ years building high-performance applications for enterprise clients. Shipped production systems at Walmart (4,000+ stores), Cigna (20M+ users), and Arkansas Blue Cross. 5 patents in retail/supply chain tech. Currently focused on AI integrations, automation tools, and TypeScript-first architectures.
BurnHavoc
Been around fixing other peoples code for 20 years.
Stanislav Prigodich
15+ years building iOS and web apps at startups and enterprise companies. I want to use that experience to help builders ship real products - when something breaks, I'm here to fix it.
Describe what's wrong in plain English. No technical knowledge needed.
Get HelpFrequently Asked Questions
How do I know if my domain has been blacklisted?
Use free tools like MXToolbox.com or mail-tester.com to check if your domain or IP is on any email blacklists. If it is, you'll need to clean up the issue and then request removal from each blacklist.
Can I stop people from sending emails that look like they're from my domain?
You can make it much harder by setting up SPF, DKIM, and DMARC records in your domain's DNS settings. These tell email providers which servers are authorized to send email on your behalf.