👨‍💻 SaaS makers: 6 reasons why you should verify the user's email & how to prevent automated sign-ups from bots

Check 1 - Authentication

• Properly configure SPF(Sender Policy Framework), DKIM(DomainKeys Identified Mail), DMARC(Domain-based Message Authentication, Reporting, and Conformance)
• Avoid having multiple SPF records

Check 2 - Content

• Try to avoid spam words
• Personalization (Merge tag)

Check 3 - Engagement

• The Email delivery rate should be at least 95%
• Email Bounce rate should be less than 5%
• Complaint rate should be 0-0.05% (abuse, mark as spam, block sender)
• Connection rejection/message rejected bounce emails should be as low as possible (these increases chances of being blacklisted)
• Engagement level (email open) should be 50% (not reliable)
• Sending relevant emails to relevant users, never cross-subscribe (better to use opt-in, feedback loop setup)
• Providing users an option to opt-out (unsubscribe option)
• Verify your email list before sending it out.
• Avoid sending emails to unresponsive users (possibility of spam traps)
• Respect opt-out requests

Check 4 - Reputation

• Accurate WHOIS information
• Domain blacklist
• Sending IPs blacklist
• Domains used in the email should not be blacklisted
• Domain should be purchased from well-known DNS providers (use well-known TLD domains)
• Domain should be at least six months older
• The domain expiry date should always be a year older than the current date
• Whitelisting IP or Domain (certification / paid services)
• Well-known ESPs have their IPs already whitelisted

Check 5 - Infrastructure

• Feedback loops
• Have your email account warm up properly before making
  it productive (plan for it)
• Respect the sending limits of your ESP
• Avoid spike in sending
• Follow the bulk sending guidelines of ESP (if any)
• Behavioral filtering (a mostly manual process)

(1) I've had a few cases now where people signed up with the emails of others. They didn't get further than sending the activation e-mail, but if they did, you had a fake email in your systems and newsletter. A lot of overhead to get those out again.

(2) Mistyping emails is soo much more common than you might think. If you're unlucky, someone mistypes their email, pays, and then locks themselves out – more work for you.

(3) Due to privacy concerns, it‘s often necessary for the European Union to use a double opt-in procedure. The reason is to make sure that the user really gave his consent. Especially when you already enter some kind of contract. Even trials can be already a contract-based relationship.

(4) It raises the bar for spammers. Requiring a verified email address stops a lot of automated spam crawlers.

(5) If you don't then sensitive information or spam can be sent to someone else's email. 

(6) Users can "sign up" with unlimited fake email addresses if you have a free trial (and don't require a social media login).

Use Outgrow’s simple, no-code tools to acquire qualified leads. Use it to increase lead conversions by using calculators, quizzes, chatbots, giveaways, polls, product recommendations, and gathering feedback by using forms/surveys.

1. Auth0 prevent this kind of stuff

2. If you are in B2B, then limit users to work emails only. if 5 users from the same domain sign up for a free account we will start a conversation with the most senior person on the domain to sign up for an enterprise account.

3. A lo-fi hack that works: Include an extra field in the signup, with display: none as the CSS. Call it "email". If the email field is filled in, you know it's a bot and can deal with it appropriately.

4. Use Google's CAPTCHA "I'm not a robot" service

5. Chris has an authentication log that tracks some basic information like IP and elements of the user agent string. He implemented the authentication log primarily to be able to send alerts to users when their account is signed into from a new device/location for user security. However, since this authentication log includes registration events, he uses that to block multiple registrations from the same IP/device.

It's by no means a perfect solution, but it's a good enough solution that required very little effort to at least limit casual registration spam.

6. You can use something like this (Github link) to reject signups from throw-away email addresses (assuming you validate emails for your signups).

But also, don't spend time-solving problems you don't have yet. Build something spammers want to flood with bot accounts first, then solve the spam problem.

2020-07-29 / 19 quick tips learned from a lot of A/B testing & how to do smooth transaction when a big company wants to buy your app

2020-07-31 / (Gold) Make you cold outreach more effective with pre-targeting & Increase retention by upselling users to an annual plan a few months after signup

2020-08-03 / 10 places to host your static sites & Increase your conversion rate with an explainer video

Is this newsletter full of worth-reading & worth-sharing content?

1. I won't lie. Curating a newsletter takes time, hard work and multiple coffee shots. If you're feeling generous please show some love by a tweet
2. Buy me a coke so I can keep this newsletter 100% Free (Recommended)
3. Forward this email to a friend. Anyone new can subscribe here :)
4. Send me your favorite shower thoughts/gifs so I can feature them here

Sent with ❤️ using Mailer Lite