Spam Protection & Email Validation

LaunchList runs a multi-layer spam defense on every submission, so the queue you launch with is real humans:

• IP reputation — checks each IP against fraud blacklists and known VPN/proxy ranges.
• Browser fingerprinting — flags duplicate device signatures across emails.
• Domain validation — rejects MX-less, catch-all-only, and disposable domains.
• Behavioral scoring — looks at signup velocity, time-on-page, and referrer headers.
• Per-IP rate limiting — caps signups per IP per window.
• reCAPTCHA — optional v3 invisible challenge.
• Email verification — optional double-opt-in.

For deeper guidance, read Tips: avoid spam signups.

Copy link to this answer

Email validation checks that an address is real and deliverable before it lands on your waitlist. It runs syntax checks, DNS/MX lookups, disposable-domain matching, and (on the paid add-on) live SMTP verification.

You probably need it if any of these are true:

• You are running paid acquisition — every garbage email costs you ad budget.
• You'll send a launch broadcast — even 5% bad emails will tank your sender reputation.
• Your waitlist is referral-driven — fake signups game the leaderboard.

Step-by-step: Email validation docs.

Copy link to this answer

Yes. LaunchList maintains a regularly-updated blocklist covering 10minutemail, Mailinator, GuerrillaMail, Tempail, EmailOnDeck, ThrowAwayMail, and 5,000+ other disposable / throwaway domains. Any signup attempt from those domains is rejected at the form, before the user ever lands on the thank-you page.

This runs by default — there is no toggle to flip. If you spot a domain that should be on the blocklist, ping support and we'll add it.

Copy link to this answer

Yes. LaunchList supports Google reCAPTCHA v3 — the invisible version that scores each submission silently without making the user solve a puzzle. Turn it on under Waitlist → Settings → Spam protection and add your reCAPTCHA site key.

reCAPTCHA is most valuable as a fallback layer: in normal traffic the IP, fingerprint, and domain checks catch most abuse, but during a press hit or Product Hunt feature reCAPTCHA stops scripted floods that would otherwise slip through.

Copy link to this answer

Bots are blocked by default through a combination of:

• Honeypot fields the widget injects automatically — invisible to humans, irresistible to scrapers.
• JavaScript challenge — the form requires the LaunchList widget to be running, which headless scripts often skip.
• Per-IP rate limiting that caps signups per second per IP.
• Browser fingerprinting that detects automation signatures (Selenium, Puppeteer, headless Chrome).

Layer in reCAPTCHA and email verification for the cleanest list. The combination has been load-tested through real Product Hunt #1 launches and press features.

Copy link to this answer

A residual percentage of spam is normal — no system is perfect. If the rate feels high, check:

1. Is email verification turned on? Force double-opt-in for the cleanest cohort.
2. Is reCAPTCHA enabled?
3. Are you blocking specific domain patterns that show up repeatedly? You can ban a regex from the dashboard.
4. Are signups coming from a single IP range? Submit it via support — we'll blocklist it network-wide.

Bulk-clean an existing list by exporting to CSV, running it through an external email-validation pass, then deleting the bounce-prone rows from the dashboard. Full guide: Avoid spam signups.

Copy link to this answer

Yes. Under Waitlist → Settings → Spam protection → Domain rules, you can:

• Allowlist specific domains (e.g. only accept @yourcompany.com for an internal beta).
• Blocklist specific domains or patterns (e.g. block all @*.ru or your noisiest competitor).

Allowlists are useful for invite-only B2B betas. Blocklists are useful for cutting off a specific abuser pattern. Domain rules apply to every signup channel — embedded widget, hosted page, and API submissions.

Copy link to this answer