# List Bombing: What It Is and How to Protect Your Email Signup Forms > List bombing turns your signup form into a weapon against someone else's inbox, and your sender reputation pays for it. What it looks like, how to protect the form, and what to do mid-attack. Published: 2023-02-17 ยท Updated: 2026-09-02 Canonical: https://alterable.com/blog/list-bombing-what-it-is-and-how-to-protect-your-email-marketing-campaigns/ --- In August 2016, more than a hundred government email addresses across several countries stopped working over a single weekend. Nobody had breached them. Someone had signed them up to thousands of newsletters, at a rate Spamhaus later put at [over a thousand subscriptions a minute](https://www.spamhaus.org/resource-hub/threat-intelligence/subscription-bombing-coi-captcha-and-the-next-generation-of-mail-bombs/), and the welcome emails did the rest. Brian Krebs, who was hit in the same wave, [wrote it up](https://krebsonsecurity.com/2016/08/massive-email-bombs-target-gov-addresses/) while his own inbox was receiving a new confirmation message every few seconds. That is list bombing, and here's the part that matters if you send email: the victim wasn't the only casualty. Spamhaus listed the email service providers whose forms had been abused, which meant every legitimate sender on those platforms had their mail blocked too. The attackers didn't need to touch your list to hurt you. They just needed your signup form to be open. ## What list bombing actually is List bombing, also called subscription bombing, is when a bot submits a target's email address to hundreds or thousands of signup forms at once. The target's inbox fills with welcome emails, confirmation requests and new-account notices until it's unusable. Half the signups in the 2016 attack were WordPress account registrations, so the flood looked like legitimate mail, which is what made it effective. The older explanation of list bombing, the one I used to give, was that attackers flood *your* list with fake addresses to overload your server. That's backwards. You are not the target. You're the weapon. Your form, your ESP and your sending domain get used to attack somebody else, and the damage to you is a side effect. It's a side effect that hurts in three ways: - **Your list fills with addresses that never wanted you.** Gibberish signups, real people who'll mark you as spam, and spam traps, because the bots don't check who owns the address. - **Your reputation takes the hit.** Bounces from invalid addresses, complaints from the victims, and a welcome series firing thousands of times in an hour, all from your domain. - **Your ESP can be listed.** Spamhaus did exactly that in 2016. When it happens, your mail stops along with everyone else's on the platform, whether or not your form was the one abused. ## How to tell it's happening to you The signature is a signup spike that doesn't match anything you did. A few things to look for: - Hundreds of signups in minutes from a form that normally gets a dozen a day - Names that are random strings, or the same name on every entry - The same handful of addresses appearing repeatedly, often with plus-tags or slight variations - Signups from countries you don't sell to, arriving faster than a human could type - A welcome automation whose bounce rate jumped overnight I've seen a client discover an attack only because their welcome email's open rate collapsed. Nobody was opening because nobody had asked for it. If your signup metrics live somewhere you look every day, you'll catch it early. If they don't, you'll find out from your ESP. ## Protecting the form Spamhaus's recommendation after 2016 was blunt: [CAPTCHA plus confirmed opt-in](https://www.spamhaus.org/resource-hub/threat-intelligence/subscription-bombing-coi-captcha-and-the-next-generation-of-mail-bombs/), both, on every form. A decade on, that's still the answer, with a few additions. 1. **Put a CAPTCHA on every public form.** [reCAPTCHA v3](https://cloud.google.com/security/products/recaptcha) scores traffic invisibly. [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/) does the same without the Google dependency. Either stops the bulk of bots before the form submits. This is the single change that matters most, and it's the one most forms still don't have. 2. **Use double opt-in.** Nobody gets on the list until they click a confirmation link. This keeps the junk addresses out of your list, which protects your reputation with every send after the attack. It does not, on its own, stop the attack: Spamhaus documented one company whose nine targeted addresses received 81,000 confirmation emails in two weeks. Confirmation mail is still mail. That's why CAPTCHA comes first. 3. **Add a honeypot field.** A hidden input that humans never see and bots fill in. Any submission with a value there is discarded. Cheap, invisible to real subscribers, and surprisingly effective against the lazier bots. 4. **Rate-limit submissions.** No form needs to accept fifty signups a minute from one IP address. Cap it at the form or at the edge. 5. **Validate at the point of entry.** Reject malformed addresses, disposable domains and role addresses before they reach your ESP. An [email validation service](/blog/email-list-validation-protect-your-sender-reputation/) at signup time is cheaper than cleaning up afterwards. 6. **Hold the welcome email until confirmation.** If your welcome series fires on signup rather than on confirmation, an attack turns your best automation into the attack itself. Move the trigger. 7. **Set an alert on signup velocity.** Whatever your normal rate is, a threshold at ten times that, watched by a person, turns a two-week attack into a two-hour one. ## What to do during an attack If it's happening right now, in this order: 1. **Take the form down or put a CAPTCHA in front of it.** Stop the intake first. Everything else can wait ten minutes. 2. **Pause the welcome automation.** Every send to a bombed address is a bounce or a complaint with your name on it. 3. **Quarantine the signups from the attack window.** Tag them, segment them out, and do not mail them. Most are junk; the rest are victims who don't want to hear from you. 4. **Check whether you're listed.** Look your sending domain and IP up on Spamhaus and the major blocklists. If you are, your ESP needs to know before you send anything else. 5. **Tell your ESP.** They've seen this before and may already be seeing it across other accounts. They can also help you find the entry point. ## Afterwards Once the form is protected, deal with the list. Remove the quarantined addresses rather than keeping them "just in case", since the case never comes. Run the rest of the list through a [cleaning pass](/blog/email-list-cleaning-path-to-better-engagement-and-deliverability/) if the attack ran for more than a day, because some junk will have arrived before you noticed. Then watch your [sender reputation](/blog/improving-your-email-sender-reputation-a-practical-guide/) for a couple of weeks and send a little more carefully than usual while it settles. And check the rest of your forms. The one that got hit is rarely the only one that was open. A [deliverability test](/free-email-deliverability-test/) before your next big send is a cheap way to confirm the damage was contained. List bombing isn't sophisticated, and neither is the defence. A CAPTCHA and confirmed opt-in on every form, a welcome series that waits for the click, and someone watching the signup count. Ten years after Spamhaus wrote it down, most of the forms it would have protected still don't have it.