Glossary

The vocabulary of handling form submissions

Every definition here is written from how this system behaves rather than from a dictionary. Where there is a number attached to a term, a threshold or a header name or a default, it is written down.

• Form backendA form backend is a hosted service that receives submissions from an HTML form, stores them, checks them for spam and delivers them somewhere useful such as an inbox, a chat channel or a webhook. It replaces the small server you would otherwise write and maintain yourself.
• Form endpointA form endpoint is the URL you put in a form's action attribute. Each endpoint belongs to one form, and the key inside it identifies that form so submissions land in the right place.
• Honeypot fieldA honeypot field is an input that is hidden from people but visible to automated scripts reading the HTML. A human never sees it and leaves it empty, so any submission that fills it in was almost certainly a bot.
• Spam scoreA spam score is a single number, usually between 0 and 1, that combines several independent signals about a submission into one verdict. A threshold turns that number into a decision: deliver it, hold it for review, or reject it outright.
• QuarantineQuarantine means a submission the filter thinks is spam is stored but not delivered. It stays visible in a separate view where you can review it and release it if the filter was wrong.
• Webhook signatureA webhook signature is a hash sent alongside a webhook payload, computed from the payload and a shared secret. The receiver recomputes it and compares. If the two match, the payload came from someone holding the secret and has not been altered in transit.
• SPFSPF, or Sender Policy Framework, is a DNS record that lists which servers are allowed to send email for your domain. A receiving mail server checks the sending server's address against that list and uses the result to decide whether the message is plausible.
• DKIMDKIM, or DomainKeys Identified Mail, adds a cryptographic signature to an outgoing message using a private key, with the matching public key published in your DNS. The receiving server verifies the signature to confirm the message really came from your domain and was not modified along the way.
• DMARCDMARC is a DNS record that does two things: it requires SPF or DKIM to match the domain in the visible From address, and it tells receiving servers what to do when that check fails. It also asks them to report failures back to you.
• Reply-ToReply-To is an email header that tells the recipient's mail client where a reply should be addressed, independently of the From address that identifies the sender.
• multipart/form-datamultipart/form-data is the encoding a browser uses to send a form that includes files. Each field becomes its own part with its own headers, separated by a boundary string, which lets binary file content travel alongside ordinary text fields.
• CORS preflightA CORS preflight is an OPTIONS request a browser sends before certain cross-origin requests, asking the destination whether the real request is allowed. Only if the response permits the method and headers does the browser send the actual request.
• Idempotency keyAn idempotency key is a unique token attached to a request so the server can recognise a repeat. If the same key arrives twice, the server returns the original result instead of performing the action again.
• Rate limitingRate limiting caps how many requests one client may make in a given window. Past the cap, further requests are refused, usually with HTTP 429, until the window rolls over.
• Disposable email addressA disposable email address is a temporary inbox, often valid for minutes, used to receive a confirmation message without handing over a real address. Dozens of services hand them out instantly and for free.
• Routing ruleA routing rule is a condition evaluated against a submission's contents that decides which destinations receive it. Submissions matching the rule go one way, everything else goes another.
• Fan-outFan-out is delivering a single input to several destinations at once. One form submission becomes an email, a Slack message and a webhook call, each dispatched and retried on its own.