---
title: "Never let visitors pick who gets your mail · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/email-security/fixed-recipients
updated: 2026-10-20
licence: "All rights reserved"
---

# Never let visitors pick who gets your mail

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Email security](https://agentwranglers.se/playbook/email/email-security)
- Rule: Forms that send email must never let a visitor choose the recipient or write the message others receive. Limit how much mail any one address can trigger.
- How: Send contact form mail only to your own fixed address. For mail to the address a visitor typed, such as a confirmation, use a fixed text with no visitor content. Cap the number of messages per recipient and per client each day, such as 3 per recipient. Otherwise your domain becomes a free spam relay, and its reputation suffers. Reject line breaks in every value that reaches a header, as [header injection](https://agentwranglers.se/playbook/adversarial-testing/injection/header-injection) explains.
- Check: Submit a form 10 times in a row with the same outside address and a custom message. At most the daily cap arrives, and none contains the custom text.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/fixed-recipients`.

- Next: [Send only links people can trust](https://agentwranglers.se/playbook/email/email-security/safe-links)
- [Email security](https://agentwranglers.se/playbook/email/email-security)