why would an email confirmation be enough? playing whack-a-mole all day with different domains is unreasonable. whitelist only of domains is awful, and botters have tons of popular email accounts.

Plus if your app will send email to any address someone submits without even rate limitations, your domain reputation can take a hit for sending to fake addresses.

Familiar with email aliases (ie [email protected])? Easy to have infinite addresses and yet a single mailbox with automations upon receiving the confirmations.

> If it's account registrations, shouldn't an email confirmation be enough?

This won't stop someone with enough sophistication.

Not every service will be targeted by sophisticated bots. What kind of service are we talking about? Is it even social? Is it even a service or just a public website?

OP did not provide a threat model or any description of the service really.

Talking about this "in general" is awful and leads to stupid bullshit like endless CloudFlare captchas on literally STATIC blogs.

E-mail confirmations are easy to circumvent.