Agent WranglersEmail security Required
Never let visitors pick who gets your mail
Forms that send email must never let a visitor choose the recipient or write the message others receive. Limit how much mail any one address can trigger.
How to do it
Send contact form mail only to your own fixed address. For mail to the address a visitor typed, such as a confirmation, use a fixed text with no visitor content. Cap the number of messages per recipient and per client each day, such as 3 per recipient. Otherwise your domain becomes a free spam relay, and its reputation suffers. Reject line breaks in every value that reaches a header, as header injection explains.
How to check
Submit a form 10 times in a row with the same outside address and a custom message. At most the daily cap arrives, and none contains the custom text.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/fixed-recipients.