Fake newsletter sign-ups: what to do, in what order

What happens when programs sign up?

A newsletter sign-up form accepts an address from anyone, and nothing proves that the person who types it is its owner. A program can therefore enter addresses in bulk, including that of the same person in many forms at once. Three consequences:

• strangers receive a message from your site that they did not ask for;
• your list contains addresses that belong to no reader, or that do not exist;
• your subscriber statistics are skewed, and your messages risk being classed as unwanted by mail providers, which also affects your real readers.

See: Glossary: automated abuse

Step 1: confirm the address before any mailing

Double opt-in (confirming an address before subscribing it) means adding an address to the list only once its owner has clicked a link received at that address. The form sends a single confirmation message; until the link is opened, the address is not subscribed.

• Keep the message short, with no advertising, and with the name of your site: a stranger must understand why they receive it.
• Give the link a limited lifetime, and send nothing else to an unconfirmed address.

This is the measure that keeps your list clean. It does not remove the confirmation message sent to a stranger, hence the next steps.

Step 2: limit the confirmation requests

Do not send a confirmation again to an address at every request. Set a delay before sending a new one to the same address, and limit the number of requests per source over a period. Set these values on your own data and do not ban: one address can hide many people, in an office or on a mobile carrier.

Step 3: answer the same way for every address

Whether the address is already subscribed, new or invalid, show the same message: “If this address is valid, you will receive a confirmation message.” A different message depending on the case tells whoever types an address whether that person is subscribed with you.

Step 4: refuse automated submissions before writing

Check the submission before sending the confirmation message, not after: sending an e-mail is the action that costs and that bothers a third party. A trap field (honeypot), described in the glossary, stops the programs that fill in every field. A bot check looks at the submission itself.

See: Glossary: honeypot · Glossary: anti-spam · Bot detection: telling a bot from a human

Where Antisy fits in

Antisy’s site lists the newsletter among the low-stakes forms, covered by the simple call. A tag in the page loads the script; at submission, it puts a short token in the hidden field antisy-token; your server sends this token to Antisy with its secret and reads the answer, allow or deny. There are only these two results, and the answer never gives the reason. Your server sends the confirmation message only on allow; on deny, it refuses without saying why.

What the check does not do. It does not verify that the address entered belongs to the person: that is the role of the confirmation, in step 1. It does not recognise a person who types someone else’s address by hand. It does not erase addresses already subscribed: it acts at submission. No bot check is perfect, and Antisy announces no detection rate; it adds to the previous steps, it does not replace them.

See: Use case: stopping contact form spam · Documentation: quick start · Documentation: verifying a token · Documentation: when the API does not answer

Where does Antisy stand?

Access is by waiting list. The API and the dashboard have been in service since 27 October 2026, hosted at Infomaniak in Geneva; no customer is in production yet. The pilot started on 9 November 2026 on our own forms.

See: The pilot · Join the waiting list

And the list you already have?

Spot the addresses that were never confirmed and those that bounced your mailings, and remove those you do not need.

Frequently asked questions