Skip to content

Form builder

Typeform spam: change who the email step notifies

Workflow → the email step → recipients

Older accounts still see this as Create → Follow-ups. Responses stay in Results either way.

Replace whatever is in that field with the address Humainbox generates for you. Nothing else changes: no plugin, no snippet, no DNS record, and nothing on your site to republish. If you want to stop, put your old address back in that field.

One row changes. Everything else on that screen stays exactly as it is. The address in the picture is a placeholder — yours is generated when you open a workspace, and this one is deliberately not a working address.

Why it is getting through

What Typeform already stops — and where it stops

Typeform is usually the form somebody built for a specific reason — a brief, an application, a quote request — which makes the generated version of it unusually convincing. It answers every question, in order, at length, and it is selling you something.

Typeform's spam prevention is built on reCAPTCHA Enterprise and the advanced mode does not challenge anybody: suspected spam is quietly routed to a Spam folder in Results, kept out of the API and webhooks, and kept out of your response limit. That last part is genuinely well designed. It is still a judgement about the sender.

What Typeform keeps either way

In Results, whatever the notification does, and stored responses count toward your plan's monthly limit. Responses their own filter marks as spam do not.

Which is why the first week runs in dry run. Nothing is held, every message is delivered exactly as it is today, and at the end of it you read what we would have stopped.

We check the message itself

A captcha asks whether the sender is a machine. We ask whether the writing could only have been sent to you.

Nothing is deleted

Held mail stays readable in the panel for your whole retention window, and one click sends it on.

If we break, your mail still arrives

If anything breaks on our side, mail goes through. You get the noise back for an afternoon; you never lose an enquiry.

Questions

Typeform, specifically

The ones that come up about this builder rather than about us. If yours is not here, ask it — a person answers.

Will held messages still count against my Typeform response limit?

Yes. Typeform counts a response when it is submitted, long before any email leaves, so nothing we do changes that number — only Typeform's own spam filter takes responses out of the count. What changes is what reaches a person.

Where is the notification setting now?

In the Workflow panel, as a step: the email that notifies you or your team when somebody submits. Older accounts still see the same thing as a Follow-up under the gear icon. Either way the recipient is a field on that step.

Will responses still be in Results?

Yes, all of them, exactly as now. Results is Typeform's record of the submission and the notification email is a separate thing that happens afterwards.

Does this replace Typeform's own spam prevention?

No, and leave it on. It takes out a category we would otherwise have to hold, and it does something we cannot: it keeps those responses out of your billed limit. We handle what is left, which is the well-written ones.

Not sure what is already running on your contact page? Paste it into the free check and we will name the builder, the CAPTCHA and what your DNS says. No account, nothing stored.

Cannot find it on your Typeform?

Menus move between versions, themes hide panels, and an agency may have built something on top of the standard one. Send us the address of your contact page and we will look at the install you have rather than the one this page was written about. A person reads it, and replies within a day.

And if the person who can change that field is not you, Humainbox writes to them instead — the field, the address, and nothing else to read.

Checked against Typeform’s own documentation

Menu path last verified . If it has moved since, tell us and we will fix it.

Using something else?

If a form can send its notification to an address you choose, it works, whether or not it is on this list.

We would like to count visits with Google Analytics, which sets two cookies. Decline and nothing is loaded and nothing is sent. What these are.