Email suppression list — JomForm Docs

What the suppression list is

The suppression list is the set of addresses JomForm refuses to send email to. Before any message is handed to the mail provider the recipient is checked against this list; if the address is on it, the message is skipped and the skip is recorded instead of being sent.

This protects everyone on the platform, because all JomForm email — buyer receipts, merchant notifications, verification links and password resets — leaves through one sending identity. A high bounce rate on that identity makes the provider slow or pause ALL of its mail, so a handful of dead addresses can silence receipts for unrelated merchants. Skipping them keeps the identity healthy.

The list is managed by the platform owner (super-admin) on the admin page, and it is also available to a connected AI agent.

What gets added automatically

The mail provider reports every permanent bounce, complaint and delivery back to JomForm, and those reports are what feed the list. A hard bounce means the mailbox does not exist; a complaint means the recipient marked the message as spam. Both are added immediately, because sending again can only produce the same result and further damage the sending identity.

A bounce the provider considers temporary is NOT added on the first event — a mailbox can be full or a server briefly unavailable, and the provider already retried before reporting it. An address is only added once the same address has produced several temporary bounces within a week, which is what distinguishes a struggling server from a dead mailbox.

Addresses are stored lower-cased, so an address is recognised whether it arrives as [email protected] or [email protected], and an address can only appear on the list once.

What the reason codes mean

hard_bounce — the mailbox rejected the message in a way that will not change: the address does not exist, or the recipient's server has permanently refused it. Also used for an address that produced repeated temporary bounces within a week.

complaint — the recipient marked a JomForm message as spam. The provider treats this as the strongest possible signal and counts it against the sending identity more heavily than a bounce.

manual — added by the platform owner rather than reported by the provider. This is how an address that should never be mailed is blocked without waiting for a bounce, for example a request made outside the platform.

The note beside a reason carries the detail: the provider's own sub-type for a bounce, the tally for a repeated temporary bounce, or whatever the platform owner typed when adding the address by hand.

Removing an address

A suppression can be wrong: a mailbox that was full for a week, a customer who changed their mind about a complaint, or an address that was mistyped when added manually. Removing an address takes it off the list, and email to it resumes from that point — nothing needs to be re-registered or re-sent.

Removing an address is a deliberate, confirmed action on the admin page: it is the one way to make JomForm start mailing an address the provider has told us is bad, so it is recorded in the audit log like every other admin action.

Related protections

Two further layers guard the sending identity. A verification circuit breaker pauses verification email when the bounce ratio over the last hour crosses a threshold, so an attack that registers many fake addresses cannot burn the identity before anyone notices; it resets by itself after a quiet hour. An MX pre-check rejects a registration outright when the address's domain does not accept mail at all, before anything is sent.

Buyer receipts are not gated by the breaker — a paying customer's receipt must not be delayed by an unrelated bounce storm — but they ARE checked against the suppression list, for the same reason everything else is.