From 30% Bounces to 62% Opens: Unwinding a 30,000-Profile List-Bombing Attack

Our client is the owner of an independent book publisher who runs a direct-to-reader business on Shopify and Klaviyo. He sends two newsletters a month to a devoted core of readers who are also the main source of his book sales. He came to us after roughly 18 months of worsening email problems he had tried, and failed, to fix on his own.

By the time we met, his email program was collapsing. Gmail, mail.com, and his own outbound relay were all bouncing his messages, and the reader-facing bounce rate had climbed to about 30%. He had tried to clean the list himself by sending a 2,700-contact list in six batches of roughly 300 every four days. Bounces spiked, so he stopped. When he then excluded everyone who had bounced in the previous 60 days, his active list dropped from around 800 to around 300. Those 800 readers were his fan base and the engine of his revenue, so watching two-thirds of them fall off as unreachable was the real emergency.

Two problems were invisible to him. Neither of his domains had DMARC reporting turned on, so no one could see what was actually sending mail under his name. And his marketing and personal email shared a single domain, which let reputation damage on one stream bleed straight into the other.

We treated "Gmail is bouncing me" as a symptom, not a diagnosis. The bounce samples turned out to be 550 blocks happening at his own relay, before any recipient ever saw the message. That pointed the investigation inward, toward his own sending environment, rather than at the receiving mailbox providers.

We ran a full audit across DNS and authentication for both domains and the entire Klaviyo account, and switched on DMARC aggregate reporting so we finally had visibility into the traffic. What surfaced was the true root cause: a list-bombing attack. Roughly 30,000 fake profiles had flooded in through the store integration, 79% of them in a single month, carrying the classic bot signature of no source, no consent, no IP address, and templated names spread evenly across the major free providers. Those fake contacts were silently triggering the abandoned-cart automation, and that one flow was bouncing at 48.7%. It was the hidden drain incinerating his domain reputation, and it was inflating his Klaviyo bill at the same time. We reframed the work from "clean the list" to "stop the leak, then rebuild trust," locked the automation down so it suppressed the bot cohort instead of mailing it, reviewed the rest of his flow logic, and delivered a prioritized roadmap he could partly execute himself with our DNS instructions.