Common Issues
security
My App Is Sending Spam Emails I Didn't Create
Users are telling you they're getting weird emails from your app — promotional messages, phishing attempts, or password reset links they didn't request. You didn't set up any of these emails, and you have no idea how they're being sent.
This usually means someone has gained access to your email sending service (like SendGrid, Mailgun, or your SMTP credentials) and is using your account to blast out spam. Your domain and reputation are being destroyed with every email sent.
The damage goes beyond annoying your users. Email providers like Gmail and Outlook may permanently blacklist your domain, meaning even your legitimate emails will go to spam forever if you don't act quickly.
Error Messages You Might See
Bounce notification: message rejected
Email delivery failed: blacklisted
Your sending has been suspended
SPF check failed
Users reporting phishing from your domain
Common Causes
- Email API key stolen — Your SendGrid, Mailgun, or other email service API key is exposed in your code or has been stolen
- Contact form exploited — Your app's contact form or email feature has no rate limiting, so bots are using it to send thousands of messages
- Open email relay — Your email server is configured to let anyone send emails through it without authentication
- Compromised server — Someone gained access to your server and installed their own email-sending scripts
- Spoofed sender address — Someone is sending emails that look like they're from your domain (you can't fully prevent this without proper DNS records)
How to Fix It
- Revoke your email API key immediately — Go to your email service dashboard and delete/rotate the current API key to stop all sending
- Check your email service logs — Look at SendGrid, Mailgun, or your email provider to see how many emails were sent and to whom
- Add rate limiting to forms — Limit how many emails any single user or IP address can trigger per hour
- Set up SPF, DKIM, and DMARC records — These DNS records help prove that only you can send emails from your domain
- Add CAPTCHA to public forms — Prevent bots from abusing any form that triggers email sending
- Check for malicious code on your server — Have a developer scan your server for unauthorized scripts or files
Real developers can help you.
Kingsley Omage
Fullstack software engineer passionate about AI Agents, blockchain, LLMs.
Sage Fulcher
Hey I'm Sage! Im a Boston area software engineer who grew up in South Florida. Ive worked at a ton of cool places like a telehealth kidney care startup that took part in a billion dollar merger (Cricket health/Interwell health), a boutique design agency where I got to work on a ton of exciting startups including a photography education app, a collegiate Esports league and more (Philosophie), a data analytics as a service startup in Cambridge (MA) as well as at Phillips and MIT Lincoln Lab where I designed and developed novel network security visualizations and analytics. I've been writing code and furiously devoted to using computers to make people’s lives easier for about 17 years. My degree is in making computers make pretty lights and sounds. Outside of work I love hip hop, the Celtics, professional wrestling, magic the gathering, photography, drumming, and guitars (both making and playing them)
Milan Surelia
Milan Surelia is a Mobile App Developer with 5+ years of experience crafting scalable, cross-platform apps at 7Span and Meticha. At 7Span, he engineers feature-rich Flutter apps with smooth performance and modern UI. As the Co-Founder of Meticha, he builds open-source tools and developer-focused products that solve real-world problems.
Expertise:
💡 Developing cross-platform apps using Flutter, Dart, and Jetpack Compose for Android, iOS, and Web.
🖋️ Sharing insights through technical writing, blogging, and open-source contributions.
🤝 Collaborating closely with designers, PMs, and developers to build seamless mobile experiences.
Notable Achievements:
🎯 Revamped the Vepaar app into Vepaar Store & CRM with a 2x performance boost and smoother UX.
🚀 Launched Compose101 — a Jetpack Compose starter kit to speed up Android development.
🌟 Open source contributions on Github & StackOverflow for Flutter & Dart
🎖️ Worked on improving app performance and user experience with smart solutions.
Milan is always happy to connect, work on new ideas, and explore the latest in technology.
Rudra Bhikadiya
I build and fix web apps across Next.js, Node.js, and DBs.
Comfortable jumping into messy code, broken APIs, and mysterious bugs.
If your project works in theory but not in reality, I help close that gap.
Daniel Vázquez
Software Engineer with over 10 years of experience on Startups, Government, big tech industry & consulting.
legrab
I'll fill this later
MFox
Full-stack professional senior engineer (15+years). Extensive experience in software development, qa, and IP networking.
Antriksh Narang
5 years+ Experienced Dev (Specially in Web Development), can help in python, javascript, react, next.js and full stack web dev technologies.
zipking
I am a technologist and product builder dedicated to creating high-impact solutions at the intersection of AI and specialized markets. Currently, I am focused on PropScan (EstateGuard), an AI-driven SaaS platform tailored for the Japanese real estate industry, and exploring the potential of Archify.
As an INFJ-T, I approach development with a "systems-thinking" mindset—balancing technical precision with a deep understanding of user needs. I particularly enjoy the challenge of architecting Vertical AI SaaS and optimizing Small Language Models (SLMs) to solve specific, real-world business problems. Whether I'm in a CTO-level leadership role or hands-on with the code, I thrive on building tools that turn complex data into actionable value.
Costea Adrian
Embedded Engineer specilizing in perception systems. Latest project was a adas camera calibration system.
Describe what's wrong in plain English. No technical knowledge needed.
Get HelpFrequently Asked Questions
How do I know if my domain has been blacklisted?
Use free tools like MXToolbox.com or mail-tester.com to check if your domain or IP is on any email blacklists. If it is, you'll need to clean up the issue and then request removal from each blacklist.
Can I stop people from sending emails that look like they're from my domain?
You can make it much harder by setting up SPF, DKIM, and DMARC records in your domain's DNS settings. These tell email providers which servers are authorized to send email on your behalf.