My App Is Sending Spam Emails I Didn't Create
Users are telling you they're getting weird emails from your app — promotional messages, phishing attempts, or password reset links they didn't request. You didn't set up any of these emails, and you have no idea how they're being sent.
This usually means someone has gained access to your email sending service (like SendGrid, Mailgun, or your SMTP credentials) and is using your account to blast out spam. Your domain and reputation are being destroyed with every email sent.
The damage goes beyond annoying your users. Email providers like Gmail and Outlook may permanently blacklist your domain, meaning even your legitimate emails will go to spam forever if you don't act quickly.
Error Messages You Might See
Common Causes
- Email API key stolen — Your SendGrid, Mailgun, or other email service API key is exposed in your code or has been stolen
- Contact form exploited — Your app's contact form or email feature has no rate limiting, so bots are using it to send thousands of messages
- Open email relay — Your email server is configured to let anyone send emails through it without authentication
- Compromised server — Someone gained access to your server and installed their own email-sending scripts
- Spoofed sender address — Someone is sending emails that look like they're from your domain (you can't fully prevent this without proper DNS records)
How to Fix It
- Revoke your email API key immediately — Go to your email service dashboard and delete/rotate the current API key to stop all sending
- Check your email service logs — Look at SendGrid, Mailgun, or your email provider to see how many emails were sent and to whom
- Add rate limiting to forms — Limit how many emails any single user or IP address can trigger per hour
- Set up SPF, DKIM, and DMARC records — These DNS records help prove that only you can send emails from your domain
- Add CAPTCHA to public forms — Prevent bots from abusing any form that triggers email sending
- Check for malicious code on your server — Have a developer scan your server for unauthorized scripts or files
Real developers can help you.
legrab
I'll fill this later
Prakash Prajapati
I’m a Senior Python Developer specializing in building secure, scalable, and highly available systems. I work primarily with Python, Django, FastAPI, Docker, PostgreSQL, and modern AI tooling such as PydanticAI, focusing on clean architecture, strong design principles, and reliable DevOps practices. I enjoy solving complex engineering problems and designing systems that are maintainable, resilient, and built to scale.
Luca Liberati
I work on monoliths and microservices, backends and frontends, manage K8s clusters and love to design apps architecture
zipking
I am a technologist and product builder dedicated to creating high-impact solutions at the intersection of AI and specialized markets. Currently, I am focused on PropScan (EstateGuard), an AI-driven SaaS platform tailored for the Japanese real estate industry, and exploring the potential of Archify.
As an INFJ-T, I approach development with a "systems-thinking" mindset—balancing technical precision with a deep understanding of user needs. I particularly enjoy the challenge of architecting Vertical AI SaaS and optimizing Small Language Models (SLMs) to solve specific, real-world business problems. Whether I'm in a CTO-level leadership role or hands-on with the code, I thrive on building tools that turn complex data into actionable value.
hanson1014
Full-stack developer experienced in fixing and deploying AI-generated apps from Lovable, Bolt.new, Cursor, and Replit. I specialize in debugging Supabase integration issues (auth flows, RLS policies, database connections), fixing broken deployments, resolving routing/blank screen problems, and cleaning up messy React/Vite codebases. I also build production apps with the Claude API and have shipped a Mac desktop dev tool (Nexterm from scratch. Based in Hong Kong, fast turnaround.
Victor Denisov
Developer
Antriksh Narang
5 years+ Experienced Dev (Specially in Web Development), can help in python, javascript, react, next.js and full stack web dev technologies.
Anthony Akpan
Developer with 8 years of experience building softwares fro startups
rayush33
JavaScript (React.js, React Native, Node.js) Developer with demonstrated industry experience of 4+ years, actively looking for opportunities to hone my skills as well as help small-scale business owners with solutions to technical problems
Matt Butler
Software Engineer @ AWS
Describe what's wrong in plain English. No technical knowledge needed.
Get HelpFrequently Asked Questions
How do I know if my domain has been blacklisted?
Use free tools like MXToolbox.com or mail-tester.com to check if your domain or IP is on any email blacklists. If it is, you'll need to clean up the issue and then request removal from each blacklist.
Can I stop people from sending emails that look like they're from my domain?
You can make it much harder by setting up SPF, DKIM, and DMARC records in your domain's DNS settings. These tell email providers which servers are authorized to send email on your behalf.