The honeypot was working. The spam still got through.

A contact form submission passed SPF, DKIM, DMARC and ARC, and walked past a correctly implemented honeypot. Why a honeypot cannot catch a bot that never renders your page, and what to require instead.

Read the original (By Anthony Ettinger, via Chovy's Blog): https://dev.profullstack.com/~anthony/blog/074-post.html