Just my opinion, but I'm not sure that the antispam should be built into the protocol itself. There's nothing there that say the receiver MUST NOT perform addit

Just my opinion, but I'm not sure that the antispam should be built into the protocol itself. There's nothing there that say the receiver MUST NOT perform additional checks on the sender. Furthermore section 4.1 says that the receiver MAY moderate webmentions before publishing, so I guess that's the place where the receiver checks the source with some antispam list. EDIT: I researched a bit more, and noticed that there's an extension to Webmentions, called Vouch[0], which may be a bit complicated to bootstrap, and seems like a web-of-trust-ish mechanism to approve of webmentions. [0] https://indieweb.org/Vouch https://indieweb.org/Vouch