Comment by relix | Hacker News Reader

Comment by relix | Hacker News Reader

Parent Full thread

I receive a lot of fake user signups on the web tool I publish for free. These users (bots?) sign up using fake email addresses, but putting a captcha does not help much. I send a confirmation email to these users to make sure they exist, but if the email address does not exist, sending that confirmation email hits my account's deliverability (spam) score as it generates a bounce which my email sender provider does not appreciate.

For example, I've received multiple warnings from Intercom that I need to improve deliverability of my email, or they will ban my account. Ironically one of the suggestions is to use confirmation emails - but that's exactly where the problem is for me.

A tool like this helps me to weed out a ton of these undeliverable email addresses to avoid sending emails that will hit my spam score.

> checking for a bounce

So in my case, generating that bounce is exactly what I need to avoid in order to make sure my account remains in good standing.

I think what this is telling you is that users don’t value giving you their email address for your free tools. They know why you want their email address, and they don’t want that, but they do want your tools. Maybe it’s time to charge money for those tools or change models? Maybe not give access until the email address is confirmed? Worth considering I guess. Idk the details. I do this all the time. Ads and malpractice have made giving out your email address risky business. If a user can give you a fake email and get what they want without giving you anything (subject to your ads or whatever you’re using their email for) that’s the logical thing for them to do.

Not judging or anything though I know my tone might seem that way.

Is it that risky? Talking, at least, as a somewhat knowledgeable person, which is the target of such web tools.

I usually have no problem using my email address to sign up for things. And yes, I do know that emails will come.

Sometimes they are actually useful and I keep them. Often, I don't care and I just unsubscribe. I some not-so-common cases, it is spam, in which case I mark it as such and I am never bothered by it again.

Sure, it's a bit of extra work. But I would not classify it as risky business.

I was thinking risky in terms of cost/benefit.

The cost for me to give a fake email is very close to 0, and the risk of getting spam emails or who knows what is much higher in comparison so why bother giving anyone my real email address? I mean I do give it out from time to time (you can easily find it if you want) I’m just speaking generally.

Issues I've had is after x years or some leak a ton of mail start pouring in.

You seem to be assuming “a lot of fake user signups” == “few real user signups.” OP only said the first. For all we know they also get plenty of real ones.

Weird. Same exact 5-word opening I was typing. I didn't see your post until I posted mine.

Great minds think alike? Heh

You seem to be assuming there's no reason these tools need a login system at all. Assuming they do and they're storing some kind of state or data for the user, how do you handle forgotten passwords if the user can't receive an email? A second free tier for people who can't be bothered to add a recovery email is too much work for a tool that's free anyway.

To the parent: Just send a validation email during the onboarding process. Don't create the account until they validate. And DO rate limit the number of these sent to any given address and the number of signup attempts by IP / fingerprint. Captchas are also good, but just for slowing fakes down.

> Just send a validation email during the onboarding process. Don't create the account until they validate.

This is literally the same thing the person you're replying to suggested.

If you dont state clearly why you even need the emails, fake one is the way to go.

If a tool like this works for you, what stops you from sending validation emails yourself?

I'm not the OP, but the answer is typically

1) Time, and..

2) Deliverability

Home grown email systems require monitoring (e.g. deliverability rates, IP reputation monitoring) and maintenance of the system itself which can be a time sink.

The reality is without using SES, Sendgrid, or a similar 3rd party provider, avoiding people's spam folder is very tricky.

Reply on news.ycombinator.com