I'm thinking through a mischief denial-of-service scenario that seems too easy to employ.
Your web-site validates email addresses for new users on sign-up.
- A rogue party (a competitor) performs sign-ups using honeypot email addresses.
- Your server sends its confirmation emails to the honeypot addresses.
- Your server gets marked as a spammer, then none of your emails go though. (Denial of service.)
How do you counter this?
If a list of honeypot emails is available, the spammers would use it.
Is there a way even to detect this? Do gmail or vendors in this realm have ways you can check your domain, or appeal?
Others asking about being mis-identified as spammers are asking about bulk sending, not relevant. (There's a reference to
openspf.org "Sender Policy Framework" but that site's dead.)