One possible option I have seen is to reverse the flow. Give people a code and have them email you that code to a dedicated MX end-point using a dedicated inbound-only email domain that only processes codes, discards attachments, discarding anything else beyond a string+16 digit code and does not send bounces also block outbound connections from this thing. Invalidate and prune the code after an hour or less to keep the clutter out of Redis or your DB in the event of bot-flooding-signups. Format the code in a way that cell phone users can easily copy/paste into email or perhaps use javascript for that.
Comments
One possible option I have seen is to reverse the flow. Give people a code and have them email you that code to a dedicated MX end-point using a dedicated inbound-only email domain that only processes codes, discards attachments, discarding anything else beyond a string+16 digit code and does not send bounces also block outbound connections from this thing. Invalidate and prune the code after an hour or less to keep the clutter out of Redis or your DB in the event of bot-flooding-signups. Format the code in a way that cell phone users can easily copy/paste into email or perhaps use javascript for that.