Internal Form Submissions Marked as Spam

[lexnicole]

We’ve excluded our internal traffic by IP address, but all of our internal form submissions are currently being flagged as spam. Internal users need to be able to submit forms without us manually releasing them. Is there a way to allowlist internal email addresses for form submissions? Our domain is already included in the site domains list.

[RubenBurdin · Accepted solution]

Hi @lexnicole , I’ve run into this before.

The key thing is that HubSpot’s spam filter for forms doesn’t only look at IP exclusions, it also evaluates email domains, submission behavior, and sometimes even past form activity.

Excluding your office IP keeps page views out of analytics, but it doesn’t bypass the spam filter for form submissions. That’s why even your team’s own addresses can still get flagged.

There isn’t a direct “allowlist” setting for email addresses inside form tools today. The closest native workaround is to create a hidden field on the form and use a workflow that checks whether the email domain matches your company domain, then automatically unenrolls those submissions from the spam review queue. HubSpot explains how the spam system works here:

(https://knowledge.hubspot.com/forms/manage-form-spam-submissions )

You can also adjust form options so certain values skip CAPTCHA checks, though it still won’t fully override the spam flag if HubSpot decides it looks suspicious.

(https://knowledge.hubspot.com/forms/prevent-spam-form-submissions )

If this happens a lot, quick clarifier: are your internal users filling these forms only for testing, or do you also have legitimate workflows that require them to submit regularly?

That helps decide whether the better path is to filter them out of automation altogether or to try preserving their submissions while suppressing the spam flag. Where native settings stop, we’ve seen teams rely on a sync layer to distinguish “real” internal submissions versus external spam. If consistency between HubSpot and your ops systems is the gap, Stacksync keeps them mirrored in real time so you don’t need to worry about manual release of flagged entries later.

Hope this helps.

[lexnicole]

Thank you for your reply, Ruben! We have legitimate workflows that require them to submit regularly - downloading our resources and signing up for our email lists. I am kind of our HubSpot point person as a small part of my larger job. I just don't want to have to remember to check the spam submissions and release them all the time.

[Jaycee_Lewis]

Hey, @lexnicole 👋 Thanks for your question. I looked through past posts for solutions but didn't see a great fit. Let's invite some of our community experts to the conversation — hey @GiantFocal @Ben_M @RubenBurdin .have you had to work around or with similar issues? Thank you! — Jaycee