👨‍💻 SaaS makers: 6 reasons why you should verify the user's email & how to prevent automated sign-ups from bots

🌸 Hi there,

I was going to launch newsletter on PH. But I had no support group. So I scratched my own itch and started making a small community of ≈100 members that will support each other on Product Hunt and Hacker News only. I guarantee there will be no SPAM.

Please join this Telegram group and get the much-needed support for your project launches. Thank You. 👇
https://t.me/joinchat/MzzVEBk6Ri5YpdjC7esKhQ

P.S I will revoke the invite link as soon as the community grows to ≈100 members.
🌸

---

5 important email deliverability checks by @utsav

Check 1 - Authentication

• Properly configure SPF(Sender Policy Framework), DKIM(DomainKeys Identified Mail), DMARC(Domain-based Message Authentication, Reporting, and Conformance)
• Avoid having multiple SPF records

Check 2 - Content

• Try to avoid spam words
• Personalization (Merge tag)

Check 3 - Engagement

• The Email delivery rate should be at least 95%
• Email Bounce rate should be less than 5%
• Complaint rate should be 0-0.05% (abuse, mark as spam, block sender)
• Connection rejection/message rejected bounce emails should be as low as possible (these increases chances of being blacklisted)
• Engagement level (email open) should be 50% (not reliable)
• Sending relevant emails to relevant users, never cross-subscribe (better to use opt-in, feedback loop setup)
• Providing users an option to opt-out (unsubscribe option)
• Verify your email list before sending it out.
• Avoid sending emails to unresponsive users (possibility of spam traps)
• Respect opt-out requests

Check 4 - Reputation

• Accurate WHOIS information
• Domain blacklist
• Sending IPs blacklist
• Domains used in the email should not be blacklisted
• Domain should be purchased from well-known DNS providers (use well-known TLD domains)
• Domain should be at least six months older
• The domain expiry date should always be a year older than the current date
• Whitelisting IP or Domain (certification / paid services)
• Well-known ESPs have their IPs already whitelisted

Check 5 - Infrastructure

• Feedback loops
• Have your email account warm up properly before making
  it productive (plan for it)
• Respect the sending limits of your ESP
• Avoid spike in sending
• Follow the bulk sending guidelines of ESP (if any)
• Behavioral filtering (a mostly manual process)

---

Do you make users verify their email? If so, why? by @primer

(1) I've had a few cases now where people signed up with the emails of others. They didn't get further than sending the activation e-mail, but if they did, you had a fake email in your systems and newsletter. A lot of overhead to get those out again.

(2) Mistyping emails is so much more common than you might think. If you're unlucky, someone mistypes their email, pays, and then locks themselves out -- more work for you.

(3) Due to privacy concerns, it's often necessary for the European Union to use a double opt-in procedure. The reason is to make sure that the user really gave his consent. Especially when you already enter some kind of contract. Even trials can be already a contract-based relationship.

(4) It raises the bar for spammers. Requiring a verified email address stops a lot of automated spam crawlers.

(5) If you don't then sensitive information or spam can be sent to someone else's email.

(6) Users can "sign up" with unlimited fake email addresses if you have a free trial (and don't require a social media login).

---

Preventing automated sign-ups from bots to your app by @robertcooper

1. Auth0 prevent this kind of stuff

2. If you are in B2B, then limit users to work emails only. if 5 users from the same domain sign up for a free account we will start a conversation with the most senior person on the domain to sign up for an enterprise account.

3. A lo-fi hack that works: Include an extra field in the signup, with display: none as the CSS. Call it "email". If the email field is filled in, you know it's a bot and can deal with it appropriately.

4. Use Google's CAPTCHA "I'm not a robot" service

5. Chris has an authentication log that tracks some basic information like IP and elements of the user agent string. He implemented the authentication log primarily to be able to send alerts to users when their account is signed into from a new device/location for user security. However, since this authentication log includes registration events, he uses that to block multiple registrations from the same IP/device.
   It's by no means a perfect solution, but it's a good enough solution that required very little effort to at least limit casual registration spam.

6. You can use something like this (Github link) to reject signups from throw-away email addresses (assuming you validate emails for your signups).

But also, don't spend time-solving problems you don't have yet. Build something spammers want to flood with bot accounts first, then solve the spam problem.

---

1. Trends #0021 --- Gamification (Gold) by @dru_riley

---

2. Indoor plants: A $1.7b industry. Here's how I'd start a d2c business around it by @simonblogs

---

P.S I will not share all these newsletter issues here. Subscribe now, so you never miss any of these highly curated newsletters.