Anomaly detection

Anomaly detection protects you from the most common abuse pattern: a bot finds your form and sends thousands of emails in minutes, burning your credits and hurting your sender reputation.

How it works

Frontmail keeps a rolling baseline of your organization’s normal public-key traffic, per minute. When one minute’s traffic rises far above the baseline – more than 8× the usual volume and at least 30 requests – Frontmail:

1. slows down public-key sends for the organization to one request every two seconds (requests over that rate get 429 rate_limited with a Retry-After header, and use no credits),
2. keeps the slowdown for 10 minutes after the last unusual minute, then lifts it automatically.

Only public-key requests that passed the template lookup and the CAPTCHA check are counted, so a flood of invalid requests can’t trigger the slowdown for your real visitors. Private-key traffic is not counted and not slowed down – your backend keeps working. The SDKs retry 429 responses automatically, so real visitors usually only notice a short delay.

New organizations have no history yet, so detection starts only after about 30 minutes of traffic data, and it never triggers below 30 requests per minute.

What to do after a spike

• Check History – are the messages real?
• If not: make sure Turnstile is required on the template, your allowed websites are set, and consider adding the offending values to the block list. Rotate the public key if needed.
• If the traffic is legitimate (for example a planned campaign), send large volumes from your server with a private key or batch sends – they are not affected. Warn us about very large planned campaigns at support@frontmail.dev.