How to stop fake signups in Next.js

// app/layout.tsx
import Script from 'next/script';

export default function RootLayout({ children }: { children: React.ReactNode }) {
  return (
    <html lang="en">
      <body>
        {children}
        <Script
          src="https://usevetto.com/v.js"
          data-site={process.env.NEXT_PUBLIC_VETTO_SITE_KEY}
          strategy="afterInteractive"
        />
      </body>
    </html>
  );
}

// app/actions.ts
'use server';
import { vettoDecision } from '@/lib/vetto';

export async function signup(_prev: unknown, formData: FormData) {
  const email = String(formData.get('email') ?? '').trim();
  // Added by the script on submit: a signed verdict on Pro, empty on Free.
  const token = String(formData.get('vetto_token') ?? '') || null;

  const decision = await vettoDecision(email, token);
  if (!decision.ok) return { status: 'error', message: decision.message };

  // Create the user here.
  return { status: 'ok', email };
}

// lib/vetto.ts (Free version: keyless domain lookup, fails open)
import 'server-only';

const DEAD = new Set(['nxdomain', 'no_mx_a', 'null_mx', 'no_mail']);

export async function vettoDecision(email: string, _token: string | null) {
  const domain = email.split('@').pop()?.toLowerCase();
  if (!domain) return { ok: true } as const;
  try {
    const res = await fetch('https://usevetto.com/v1/audit', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ domains: [domain] }),
      signal: AbortSignal.timeout(2500),
      cache: 'no-store',
    });
    const r = (await res.json()).results?.[domain];
    if (r?.disposable) return { ok: false, message: 'Please use a permanent email address.' } as const;
    if (r && DEAD.has(r.status)) return { ok: false, message: 'This email domain cannot receive mail.' } as const;
  } catch {}
  return { ok: true } as const;
}