Instagram DM Automation Rules in 2026 (What Meta Allows)

Yes. Instagram DM automation is allowed when it runs on Meta’s official Messaging API and you reply to people who already contacted you: a comment, a story reply, or an inbox message. Rank the stack that stays inside those rules: DM Automation first (this site: free $0 forever for 100 DMs/month on 1 account, Starter $19/month or $15/month billed annually for 2,000 DMs, Pro $49/month or $39/month billed annually for 3 accounts and 15,000 DMs), InstantDM second (Legend Pro $9.99/month billed yearly, unlimited DMs up to 800/hour, free forever 500 DM automations/month), ManyChat third (Essential $17/month or $14 billed yearly). Then LinkDM, ReplyRush, Chatfuel, Respond.io, SetSmart. Password bots that cold-message strangers are not this feature.

• Allowed: official API, Instagram login, people who already contacted you.
• Not allowed: password forms, scraped follower lists, DMs to people who never wrote.
• DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever.

This page is Meta’s rules for Instagram DM automation in 2026: consent, official API vs password bots, a short 24-hour window summary, Business/Creator, and what actually gets accounts restricted. The short safety one-pager is Is Instagram DM automation safe?. Window math lives at Instagram 24-hour messaging window in 2026. Caps live at Instagram DM limits in 2026. If a warning already showed up, use “We suspect automated behavior” on Instagram.

Prices below come from each vendor’s public pricing page, checked 30 October 2026 IST, except ManyChat’s public table which we quote from Featurebase’s write-up of ManyChat’s 2 March 2026 plans (Manychat Pricing 2026) and link to ManyChat pricing. manychat.com/pricing returned 403 from this host on 30 October 2026.

How we ranked rule-safe Instagram DM tools

We ranked on official API login, consent-only sends, 24-hour follow-up handling, no password, and the cost of staying inside the rules.

Five criteria, same weight for every product:

1. Official API login - Instagram’s own screen, not a vendor form that stores your password.
2. Consent-only sends - The tool can only talk to people who commented, replied to a story, or messaged you. If the sales page promises “DM all new followers,” it fails this gate.
3. 24-hour follow-up handling - Promotional follow-ups sit inside Meta’s customer care window, or they error. The tool should not pretend a 3-day drip is legal just because the dashboard lets you type it.
4. No password - A password form is not the Instagram API. If the connect step asks for your Instagram password, stop.
5. Cost of staying inside the rules - What a 2,000-comment spike costs when you stay on the API. Flat DM buckets, contact meters, and AI-message meters are not the same invoice.

Last updated: 30 October 2026.

We sell DM Automation. Other tool prices are taken from those vendors’ public pages or a dated public quote of those pages. Meta’s rules live in the Instagram messaging docs. Instagram’s Community Guidelines still apply to the public post. Comment-to-DM does not make a banned caption legal.

Instagram DM automation rules comparison table (verified 30 October 2026)

This table scores eight tools on official API, password login, and consent-only sends, verified 30 October 2026.

Tool	Paid start	Official API	Password login	Consent-only	Rules fit
DM Automation	$19/mo Starter ($15/mo yearly)	Yes	No	Yes	Fastest first legal send on this site
InstantDM	$9.99/mo Legend Pro (yearly)	Yes	No	Yes	Flat DMs when a clip spikes
ManyChat	$17/mo Essential ($14 yr)	Yes	No	Yes	Instagram plus WhatsApp, contact meter
LinkDM	$19/mo Pro	Yes	No	Yes	Published DM caps; comment auto-reply is Pro
ReplyRush	$10/mo Lite	Yes	No	Yes	Lowest paid start for comment-to-DM
Chatfuel	US$18/mo yearly Business	Yes	No	Yes	FAQ after the first legal DM
Respond.io	$79/mo Starter	Yes	No	Yes	Team inbox, not a keyword
SetSmart	$25/mo Light	Yes	No	Yes	AI setter thread, wrong meter for one URL

DM Automation: DM Automation pricing, October 2026. InstantDM: instantdm.com/pricing. LinkDM: linkdm.com/pricing. ReplyRush: replyrush.com/pricing. Chatfuel: chatfuel.com/pricing. Respond.io: respond.io/pricing. SetSmart: setsmart.io/pricing. ManyChat Essential $17/month billed monthly, $14 billed yearly, 250 active contacts; Pro $39/$29, 2,500 contacts (Featurebase, quoting ManyChat’s public 2 March 2026 table). Source: ManyChat pricing.

Password tools are not in this table. They fail the API gate. A password form is not the Instagram API.

1. DM Automation - Official API at $19 Starter

DM Automation is this site’s official-API product: Instagram login, consent-only replies, no password form. Free forever: 1 Instagram account, 100 automated DMs a month, comment-to-DM, story replies, keyword triggers, welcome message, iOS and Android. Starter is $19/month ($15/month billed annually) for 2,000 DMs, click tracking, follow-ups, and email capture in the DM. Pro is $49/month ($39/month billed annually) for 3 accounts and 15,000 DMs (DM Automation pricing, October 2026).

DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever. That sentence is the bill, not a loophole. You still need a Business or Creator account. You still only message people who already contacted you. The free 100 DMs will not cover a Reel that pulls 2,000 comments. Upgrade before you print LINK on a noisy clip, or the extra people sit in a queue you already spent.

Where it fits: first legal automation today, one account, one keyword, one URL. Connect through Instagram login. Pick the post. Set the keyword. Write the public comment reply if you want one, and the private DM. Test from a second account. If the DM arrives, the rule-safe path is live.

Where it does not: 100 DMs on free during a spike, a shared agency inbox with 12 seats, or a cold blast to new followers. Cold follower DMs are not a feature we ship, because they are not a feature the API ships. See Auto DM new followers on Instagram in 2026 for why that product category exists and why it is not allowed.

The tool can send a Stripe Payment Link or a PayPal URL. Stripe or PayPal still process the card. We do not process the payment in the inbox.

2. InstantDM - Official API at $9.99 Legend Pro

InstantDM is number two on this site, and it also connects through Instagram login, not a password form. Legend Pro is $9.99/month billed yearly with unlimited DMs (up to 800 an hour), Instagram plus Facebook, and story, Live, and next-post triggers. Trendsetter is $24.99/month billed yearly for the flow editor, Meta Ads, API, and webhooks. Trendsetter Pro is $49.99/month billed yearly. Free forever is 500 DM automations a month with no card. Paid plans also offer a 7-day free trial. Multi Starter is $160/year for 3 accounts (instantdm.com/pricing, October 2026).

For rules, the job this slot does well is the same job as DM Automation: keyword on a Reel, URL in the DM, only people who already commented or replied. The difference is the bill after a spike. Unlimited DMs on a flat $9.99 yearly-billed plan means 2,000 LINK comments do not fill a monthly bucket. You still respect Meta’s throughput. Unlimited in the vendor plan is not unlimited in Instagram’s hourly private-reply ceiling. That ceiling is a limits-page number, not a rules cheat code. See Instagram DM limits in 2026.

It can send a payment link when the offer is a Stripe or PayPal URL. That is still one URL. InstantDM sends payment links. Stripe or PayPal process payments. Do not treat the inbox as a checkout.

Where it fits: you already know comment-to-DM works, and you want a flat bill when a clip spikes. Where it does not: stacking it on the same Instagram account as another official messaging app. Pick one. The two-tools page is Two Instagram DM tools on the same account in 2026.

3. ManyChat - Official API, billed on contacts

ManyChat is number three, and it uses the official Instagram Messaging API with Instagram login. Pro is $39/month billed monthly ($29 billed yearly) with 2,500 active contacts, broadcasts, and AI conversations on the 2 March 2026 plan set (Featurebase, quoting ManyChat’s public table). Free is 25 active contacts per month. Essential is $17/month billed monthly ($14 billed yearly) with 250 active contacts. Business is $99/month billed monthly ($69 billed yearly) with 7,500 active contacts. Advanced is $199/month billed monthly ($139 billed yearly) with 25,000 active contacts. AI is included on Pro and above. Extra contacts are billed on top. See ManyChat pricing. manychat.com/pricing returned 403 from this host on 30 October 2026, so those numbers are the Featurebase quote of ManyChat’s 2 March 2026 table.

Creators buy ManyChat when WhatsApp is already how you send reminders, or when a flowchart has to ask a question before it ships a URL. That canvas is real. It is also why first-time setup takes longer than a guided comment-to-DM form.

The rules trap is not the API. ManyChat is on the API. The trap is thinking a contact meter is a consent meter. A spike of 2,000 new people can move you up a tier even if each person got one legal DM. Flat Instagram DM buckets meter messages. ManyChat meters people. If you do not need WhatsApp, you are paying for a suite you will not open.

Where it wins: WhatsApp plus Instagram, still consent-only. Where it loses: LINK → one URL, and you wanted the cheapest legal send. ManyChat does not process the card. It can send the same Stripe or PayPal URL everyone else sends.

4. LinkDM - Official API at $19 Pro

LinkDM is an official-API tool that sends links in DMs to people who already engaged. Free is $0 for 1,000 DMs/month on 1 account. Story auto-reply is on Free. Comment auto-reply is Pro. Pro is $19/month for 25,000 DMs on 3 accounts. Platinum+ is $99/month for 300,000 DMs on 10 accounts (LinkDM pricing, October 2026).

Published caps help during a launch week. 1,000 DMs is enough to learn if a keyword converts on stories. Free will not fire comment auto-reply. That is a product gate, not a Meta gate. Meta still allows comment-to-DM on the API. LinkDM just puts that trigger on Pro.

Where it fits: one offer per post, high comment volume, invoice in DMs not contacts, Instagram login. Where it does not: WhatsApp, a shared inbox, or a password extension “so we can also DM new followers.” Do not buy Platinum+ because a recap “might go viral.” Three accounts on Pro is the useful cap: main, clip account, and a shop account. Do not run all three plus another vendor on the same login.

LinkDM is built around sending links. That matches comment-to-DM more tightly than a full CRM inbox. It still cannot legally cold-message a follower list. If a sales page somewhere else promises that, it is not this API.

5. ReplyRush - Official API at $10 Lite

ReplyRush is an official-API Instagram tool with a low paid start, not a password bot. Free is 1,500 DMs/month. Lite is $10/month for 7,500 DMs with comment auto-reply. Boost is $25/month. Max is $100/month (ReplyRush pricing, October 2026). Comment auto-reply is not on the free plan.

For a new creator, $10 Lite is the cheapest paid Instagram bucket that still covers a decent recap week. 7,500 DMs is more than DM Automation Starter’s 2,000, at a lower sticker. Starter still wins if you want click tracking and email capture inside the DM on this site’s product.

Use ReplyRush when the only job is comment-to-DM and you want the lowest paid start. If your whole plan is “comment LINK,” skip Free and start on Lite, or start on DM Automation free where comment-to-DM is included at 100 DMs. Either path stays inside the rules if you connect with Instagram login and only reply to people who already wrote.

Where it does not: a growth-hacker promise of DMing everyone who followed last night. That is a different product class. If ReplyRush (or anyone) ever asked for your Instagram password, you would leave. A password form is not the Instagram API.

6. Chatfuel - Official API from US$18/month yearly

Chatfuel is an official-API chatbot, not a cold-DM extension. Chatfuel Business is US$18/month billed yearly (US$216/year) with US$20 of AI credits per month. Every plan starts with a free trial, no card (Chatfuel pricing, October 2026).

Chatfuel is the pick when the first legal DM cannot be a single URL. Someone comments PRICE, then asks if the $49 month includes a live call, then asks if the PDF is extra. An AI agent that answers from your published page helps. Inventing a perk you do not list does not. The live offer page is the spec. The bot should send the URL and answer questions you actually published.

Do not use Chatfuel to open threads with people who never contacted you. The API will not give you that, and wrapping an AI around a blocked send does not make it allowed. Where it fits: FAQ after a comment or story reply. Where it does not: you only needed one URL, or you wanted a setter that hunts strangers.

Chatfuel does not process the card. Stripe or PayPal still do, if you paste those links.

7. Respond.io - Official API at $79 Starter

Respond.io is an official-API team inbox, not a keyword growth bot. Starter is $79/month with a 7-day trial (Respond.io pricing, October 2026). Growth is $159/month. Advanced is $279/month.

Where it fits: a small studio that already lives in a shared inbox and wants Instagram next to WhatsApp and web chat. Humans send the URL. Automation is not the point. Consent still is. Agents should not paste the same pitch into threads that never opened.

Where it does not: LINK on a recap Reel. You would be paying a $79 inbox to do a $19 keyword job. Rank stays ManyChat at number three. Respond.io is later on the list because some teams already bought it and want to know if it is “against the rules.” It is not, if it uses Instagram login and stays in existing threads. It is a bad buy if your only job is comment-to-DM.

Agency seats belong here more than on a $10 Lite plan. Still do not share the Instagram password in a Slack channel. Use the vendor’s official connect and Instagram’s own permissions. That is the agency version of the same rule.

8. SetSmart - Official API at $25 Light

SetSmart is an official-API AI setter, not a follower-blast tool. Light is $25/month for 250 AI messages, with no free trial. Pro is $97/month for 1,000 AI messages, with a 7-day trial (SetSmart pricing, October 2026).

Where it fits: a coach who wants an AI thread that collects budget, goal, and a booking URL for a paid consult, after the person already commented or messaged. That consult is still one conversation with a person who opted in by writing first.

Where it does not: LINK on a recap Reel. You would be paying AI messages to send one URL. 250 AI messages on Light does not survive a 2,000-comment spike. SetSmart stays on this site’s tracking list. It is not ranked above ManyChat. If the Reel is a $200 workshop, send the event page on WORKSHOP. Keep the AI thread for people who already asked.

An AI that sounds human is still software. Do not write “sorry I was in a meeting” at 3am from a bot. Meta’s messaging rules include not misrepresenting the sender. Friendly automated copy is fine. A fake human apology is not.

What does Meta actually permit?

Meta permits Instagram DM automation on the official Messaging API when you reply to people who already contacted you. Instagram DM automation is allowed when it runs on Meta’s official Messaging API and you reply to people who already contacted you. That is the whole legal product. Comment-to-DM, story-reply DMs, and a welcome message after they DM you first are the three jobs that match.

The public sources we use on this page are Meta’s Instagram messaging docs and Instagram’s Community Guidelines. Docs move. Read the live page before you promise a client a tag, a window, or an event type. Do not take a Twitter thread as policy.

What that permit looks like in practice:

1. You connect a Business or Creator account through Instagram login. Personal accounts cannot connect to the Messaging API.
2. Someone does a thing Instagram counts as contact. They comment. They reply to a story. They send you a DM. Likes, follows, and profile visits are not that list.
3. Your tool sends a private reply through the API. You can include a URL. You can ask a question. You can collect an email in the thread if they type it.
4. You stay inside the 24-hour customer care window for promotional follow-ups. The first reply after a comment is usually seconds later, so the window rarely binds on the first send. The second send at day three is where people get surprised.
5. You do not scrape, spoof, or store other people’s Instagram passwords. You also do not collect your own password in a vendor form.

Meta does not permit bulk DMs to people who never wrote. There is no “message all followers” method in the official API. Any tool offering one is not using the API, even if the landing page says “Instagram automation.” That is the line this page exists to draw.

The public Reel still has to follow Community Guidelines. Comment-to-DM does not launder a banned caption. If the post would get taken down as a standalone, the DM tool will not save it.

If you wanted the one-screen version of “is this safe,” that is Is Instagram DM automation safe?. The rules below are what is allowed, what is not, and which tools stay on the allowed side.

Is an Instagram DM bot against the rules?

An Instagram DM bot is against the rules when it uses a password or messages people who never contacted you, and it is allowed when it is an official-API bot that only replies. The word “bot” covers both. That is why people argue in comment sections.

Allowed bot. Software behind Instagram login. You approve permissions on Meta’s screen. It replies when someone comments a keyword, replies to a story, or DMs you first. That is Instagram DM bot: what is safe in 2026. Native auto-reply questions live at Does Instagram have auto reply in 2026?.

Against-the-rules bot. A form that asks for your Instagram username and password, a Chrome extension that stays logged in as you, a phone farm, a “warm up” sequence to people who only liked a Reel, a scraped lead list. Instagram’s terms do not allow automated access without express permission, and they do not allow collecting other people’s passwords. That is the unsafe bot.

People search “Instagram DM bot” for four jobs that are not the same:

1. Comment-to-DM. Someone comments LINK, PRICE, or JOIN. They get a private URL. Allowed on the official API. See Comment-to-DM automation.
2. Story reply bot. Someone replies YES to a story. They get the same URL in DMs. Allowed on the official API.
3. Welcome message. Someone DMs you first. A saved opener fires. Allowed on the official API.
4. Cold outreach. Message people who never contacted you. Not in the official API. Any vendor selling it is not using the API.

If the job is 4, there is no rule-safe bot. Stop shopping. If the job is 1, 2, or 3, the ranked list above is the shopping list.

The bot does not process payments. It can send a Stripe Payment Link, a PayPal.me, or a Gumroad URL. Stripe or PayPal still process the card. Calling a DM bot a checkout is how people buy the wrong category.

What is the 24-hour window?

The 24-hour window is Meta’s customer care period after a person last messaged you, during which you may send a wider set of replies, including promotional follow-ups, on the official API. Miss the window and the follow-up sits or errors. This is not your tool being broken. This is the window.

This page is a summary. The dedicated explainer is Instagram 24-hour messaging window in 2026. Do not treat this section as the math page.

What starts the window: they send an inbox message. Some flows treat a comment or a story reply as the open. Check live Messaging API docs for the exact event list. Each new inbound message from them restarts the clock.

What you can send after 24 hours: human replies in the Instagram inbox still work in the normal app. Automated promotional DMs through the API generally do not, unless you use an approved message tag, which is not a cheat code for launches. Plan launches so the follow-up fires inside the window. Set a follow-up at 2 hours, not at 3 days.

Follow-up outside 24 hours

A follow-up outside 24 hours is the most common “my automation stopped working” ticket that is actually a rules ticket. You wrote a drip: hour 0 the link, hour 4 a nudge, day 3 “last chance.” Day 3 is outside the window for promotional API sends. The dashboard may still show the step as scheduled. Instagram will not deliver it the way you hoped.

Fix: put the paid nudge inside the window. If they did not tap, a human can still open the thread in the Instagram app and type. That is a person, not the API pretending to be a 72-hour marketer.

Do not bolt on a password extension to “force” the day-3 send. That is how a legal comment-to-DM setup becomes an unsafe bot overnight.

Human replies after the window are still allowed in the app. Automated promotional follow-ups are the part that dies. If your vendor has a “message tags” feature, read Meta’s current tag list before you use it for a launch. Tags are for specific use cases, not a general blast.

Can I DM people who never contacted me?

No. You cannot use the official Instagram Messaging API to DM people who never contacted you. Follows, likes, profile visits, and being in a target audience are not contact. Comment, story reply, or an inbound DM are contact.

This is the rule people try to bargain with. “But they followed me, that is interest.” Instagram does not treat a follow as permission to automate a pitch in their inbox. “But I bought a list of usernames in my niche.” That list is not consent. “But my old Chrome tool did it in 2022.” That is the category that produces restrictions.

If a vendor demo shows a CSV of usernames and a Send button, close the tab. That product cannot be the official API, because the API has no method for that job. A password form is not the Instagram API.

Comment-to-DM vs a cold follower blast

Comment-to-DM is allowed: they typed a word on your post, you send one private reply. A cold follower blast is not allowed: they followed, you send a pitch they did not ask for. The two get marketed with the same screenshots. They are not the same rule.

Comment-to-DM conversion is high because the person already raised a hand. Cold follower DMs get ignored, marked, and reported. Reports are how accounts get restricted even when the copy is polite.

New-follower auto-DMs are a search people type every week. The honest page is Auto DM new followers on Instagram in 2026. The short version for this rules page: do not buy that feature. Put LINK on the Reel instead. People who want the URL will comment. People who only followed will not get a surprise pitch.

Story reply is closer to comment-to-DM than to a follower blast. They typed in the sticker or the reply field. That is contact. A view on the story with no reply is not contact. Do not treat viewers as a list.

Click-to-DM ads are a different job: they tapped your ad and opened the thread. That is inbound. Do not mix that playbook into a scraped follower CSV.

Do I need a Business or Creator account?

Yes. You need a Business or Creator account to connect Instagram DM automation on the official Messaging API. Personal accounts cannot grant the messaging permissions the API needs. Convert first, then connect the tool through Instagram login.

Creator vs Business is a positioning choice for the public profile, not a loophole. Either can connect. Personal cannot. If the connect screen fails, check the account type before you blame the vendor.

A Business or Creator account does not mean every DM is allowed. It means you may use the API at all. Consent, the 24-hour window, and Community Guidelines still apply. Switching to Business is not a license to blast followers.

Professional accounts also make it easier to see connected apps and remove extras. That matters when an old chatbot is still attached and a new one “does not send.”

Agency access without a password

Agencies should connect through the official tool login and Instagram permissions, never by collecting the client’s Instagram password in a shared doc. A password form is not the Instagram API, and it is also not how you run a client account. If the client types their password into your Notion, you have created the same failure mode as a shady Chrome extension, even if your intent was “we will connect ManyChat later.”

Use Instagram login on the vendor site. Use Meta Business access where the vendor supports it. Keep one official messaging app per Instagram account. When the contract ends, disconnect the app in Instagram’s connected integrations, do not just delete the vendor row in your spreadsheet.

Do not run the client’s personal account “until they convert.” Convert first. Then connect. A personal login plus a password-based helper is the fastest way to a restriction during onboarding, which is an ugly first invoice.

If you need a specialist tool, disconnect the previous official messaging app first. Stan AutoDM and similar in-platform auto-DMs are the same class of decision: one app. Details at Two Instagram DM tools on the same account in 2026.

What gets accounts restricted?

Accounts get restricted when you use password tools, message people who never contacted you, spray identical copy, mix bought engagement with API tools, or stack two messaging apps until Instagram treats the pattern as automated abuse. Official-API comment-to-DM, by itself, is not the usual cause.

In rough order of how often we see the mess:

1. Unsolicited bulk DMs. Messaging people who never contacted you. This is the big one, and it is only possible with non-API tools.
2. Password-based tools. Instagram detects the login pattern and treats it as a compromised account.
3. Two official tools on one account. Duplicate sends, silent failures, then a panic add-on that is a password extension.
4. Identical-message spam. Even inside consent, hundreds of byte-identical messages in a short window look like spam.
5. Bought engagement mixed with API tools. Fake comments fire real DMs. The mix looks like a farm.
6. Follow-ups outside the 24-hour window plus a workaround tool. The workaround is the problem.

If the banner already says Instagram suspects automated behavior, stop adding tools. Read “We suspect automated behavior” on Instagram. This page will not walk the recovery clicks. The job here is to not earn the banner.

Password-tool failure modes

Password-tool failure modes start at the connect screen and end in a locked login. The vendor asks for username and password, or a “show password” Chrome extension, or an APK that “runs Instagram for you.” You type it. For a week, DMs go out to people who never wrote. Then Instagram challenges the login, forces a reset, or shows the automated-behavior warning. The vendor still has the password until you rotate it, and some of them keep sending after you “paused” in their dashboard.

A password form is not the Instagram API. Repeat that when a freelancer says “this one is cheaper and it DMs new followers.” Cheaper is not the metric. Allowed is the metric.

Other failure modes we keep seeing:

• Session hijack lookalikes. The tool stays logged in as you on a VPS. Instagram sees a new device in another country. You get emailed about a login you did not do. You think you were hacked. You were. You handed it over.
• Rate-limit theater. The tool claims “human-like delays,” then blasts 400 identical openers overnight. Delays do not create consent.
• List reuse. A CSV from a scrape in March gets sent again in June. Those people still never contacted you.
• Recovery loops. After a restriction, the same tool is reconnected with a “warm-up” of 20 cold DMs a day. That is how a 3-day restriction becomes a longer one.

If you already typed a password into a vendor, change the Instagram password, kill other sessions, disconnect unknown apps, and do not reconnect that vendor. Then, if you still want automation, use Instagram login on an official-API tool from the table above.

Identical-message spam

Identical-message spam is sending the same bytes to hundreds of people in a short window so Instagram’s classifiers treat even a legal trigger as junk. Consent gets you in the door. Copy still matters.

You do not need a novel for each person. You do need not to paste one 600-character pitch with three links and a fake “hey saw your profile.” Rotate two or three short variants. One URL. One ask. If 2,000 people comment LINK, they can all get a short DM. They should not all get a 12-line speech that looks like 2019 outreach.

Public comment replies can be identical. That is normal. Private DMs that read like a scraped opener are what get people reporting you. Reports beat your “but they commented” defense in practice.

Also skip fake-human filler. “haha love this, totally random but…” is a tell. Keyword in, URL out. That is the allowed product.

Bought engagement mixed with API tools

Bought engagement mixed with API tools is how a legal comment-to-DM setup starts firing at fake accounts, pods, and farms, which looks like automated abuse even though the DM tool is on the API. You paid for comments. The keyword is LINK. The tool does its job and DMs 800 “people” who never watched the Reel. Those accounts do not tap. Some report. Some are already flagged. Your account now has a spike of outbound DMs to junk profiles.

Do not buy comments, likes, or followers and then turn on comment-to-DM. The API tool will do what you asked. The signal Instagram sees is a farm talking to a farm.

If a clip goes genuinely viral, pace is a limits issue, not a “buy more comments” issue. See Instagram DM limits in 2026. If you need a bigger legal bucket, DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever, and you upgrade before the post, not after you buy a comment pod.

Two tools on the same account

Two official DM tools on the same Instagram account is a practical rules failure: duplicate DMs, silent sends, then a panicked password add-on. Meta’s official connection is not a stack of five chat apps. The last app you connected often wins. The other one looks “on” in its dashboard and sends nothing.

Symptoms: keywords that worked last week do nothing. Story replies fire from the wrong vendor. Welcome messages duplicate, then Instagram rate limits you. The client swears they “only connected one,” then you find a leftover ManyChat page.

Fix: open Instagram’s connected apps and Business integrations. Remove extras. Leave one official messaging app. Reconnect that one. Test from a second account. Do not add a password extension to “make both work.”

Full walkthrough: Two Instagram DM tools on the same account in 2026.

What does a 2,000-comment spike cost if I stay on the API?

A 2,000-comment spike on the official API costs whatever your tool meters, not a Meta fine, as long as you only reply to those commenters and you respect throughput. The people already contacted you. The send is allowed. The invoice is the part that changes by vendor.

Rough October 2026 math, same 2,000 legal DMs:

• DM Automation. Starter is built for 2,000 DMs at $19/month ($15/month yearly). Free 100 DMs will not cover it. Pro is 15,000 DMs at $49/month if you expect repeats. DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever.
• InstantDM. Legend Pro is $9.99/month billed yearly with unlimited DMs up to 800/hour. 2,000 comments do not fill a monthly bucket. They may still pace across hours because of Meta, not because the plan ran out.
• ManyChat. 2,000 new people can blow past Essential’s 250 contacts and sit inside Pro’s 2,500, or push you toward extra contacts. You are paying for people, not DMs. Pro is $39/month or $29 billed yearly on the 2 March 2026 table (Featurebase).
• LinkDM. Free 1,000 DMs is short. Pro at $19/month for 25,000 DMs covers 2,000 easily, if you are on Pro so comment auto-reply is on.
• ReplyRush. Lite at $10/month for 7,500 DMs covers 2,000. Free 1,500 does not, and Free has no comment auto-reply.
• Chatfuel. US$18/month yearly plus AI credits. 2,000 FAQ threads will spend credits if you let the AI talk. A single URL send is cheaper than a conversation.
• Respond.io. $79 Starter. You did not need a $79 inbox for 2,000 keyword DMs.
• SetSmart. Light’s 250 AI messages will not cover 2,000. Wrong meter.

Staying inside the rules does not mean “unlimited free.” It means you pay a real vendor instead of paying with a restricted account. Throughput still applies. If the API paces you, wait. That is Instagram DM limits in 2026, not a reason to switch to a password blaster.

Upgrade before you post the noisy Reel. A queue that starts after the spike is how people add a second tool “just for overflow,” which is how they break the one-app rule.

How do I choose a rule-safe tool in 10 minutes?

You choose a rule-safe tool in 10 minutes by checking Instagram login, consent-only triggers, one app per account, and a meter that survives your next spike. Skip everything else on the first pass.

Use this timer:

Minute 1 to 2. Open the connect flow. If it asks for your Instagram password, leave. If it sends you to Instagram’s own login and a permissions screen, stay. A password form is not the Instagram API.

Minute 3 to 4. Read the trigger list. You want comment keyword, story reply, inbound DM welcome. You do not want “new followers,” “likers,” “profile visitors,” or CSV upload of usernames.

Minute 5. Confirm account type. Business or Creator. Convert if needed.

Minute 6. Disconnect any other official messaging app on that Instagram account. One tool.

Minute 7 to 8. Check the meter against a 2,000-comment day. Free 100 DMs will not do it. Free 25 ManyChat contacts will not do it. Starter $19, Lite $10, LinkDM Pro $19, or Legend Pro $9.99 billed yearly will.

Minute 9. Write one short DM with one URL. No fake-human opener. Test from a second account.

Minute 10. Publish the keyword on a quiet post first, not on the launch Reel. If the test DM arrives, you are inside the rules. If it does not, fix connect and the leftover app before you spend ads.

Rank if you are still staring at eight logos: DM Automation first on this site, then InstantDM, then ManyChat if WhatsApp has to sit next to Instagram. Then LinkDM, ReplyRush, Chatfuel, Respond.io, SetSmart. No-card tests live at Free Instagram automation tool 2026. The broader how-to is Instagram DM automation.

If the 10-minute check fails on password or cold lists, there is no “maybe.” That product is not allowed, and a discount code does not change Meta’s docs.

Instagram DM automation compliance checklist

A compliance checklist for Instagram DM automation in 2026 is: official API, Instagram login, Business or Creator, consent-only triggers, one app, window-aware follow-ups, short copy, no bought comments, no password. Print it. Run it before every launch Reel.

Connect

• Account is Business or Creator, not Personal.
• Connect uses Instagram login, not a password field.
• You can name the permissions you approved.
• Only one official messaging app is connected.
• Agency staff do not have the Instagram password in a doc.

Triggers

• Comment keyword, story reply, or inbound DM welcome.
• No new-follower blast, no liker blast, no CSV of strangers.
• Test comment from a second account received the DM.

Window and copy

• First send is immediate after contact.
• Promotional follow-up is inside 24 hours, or it is a human in the app.
• DM is short, one URL, no fake “just saw your profile.”
• Two or three variants if you expect a huge spike.

What you will not mix in

• No password Chrome extension “for overflow.”
• No bought comments, pods, or follower packs on the same post.
• No second vendor on the same account.
• No day-3 automated “last chance” through the API.

Invoice

• Plan covers the spike you are about to ask for.
• You know whether you pay for DMs, contacts, or AI messages.
• Payment links go to Stripe or PayPal. The DM tool only sends the URL.

If a box is unchecked, you are not “being extra.” You are one toggle away from the restricted-account list. The safety one-pager is still Is Instagram DM automation safe?. This checklist is the operating version.

FAQ

Is Instagram DM automation allowed in 2026?

Yes. Instagram DM automation is allowed when it runs on Meta’s official Messaging API and you reply to people who already contacted you. Comment, story reply, or inbound DM counts. Follows and likes do not. Password bots that message strangers are not allowed.

Is an Instagram DM bot against Meta’s rules?

Only the password or cold-outreach kind. An official-API bot that replies to comments, story replies, or inbound DMs is the product Meta built the Messaging API for. See Instagram DM bot: what is safe in 2026.

What is the Instagram 24-hour messaging window?

It is the period after they last messaged you when promotional API follow-ups are allowed. Miss it and the automated nudge fails. Humans can still type in the app. Full write-up: Instagram 24-hour messaging window in 2026.

Can I auto DM people who never contacted me?

No. The official API has no method for DMing people who only followed or liked. Tools that offer that are not using the API. Put a keyword on the post instead.

Do I need a Business or Creator account for Instagram DM automation?

Yes. Personal accounts cannot connect to the official Messaging API. Convert, then use Instagram login. Switching account type does not allow cold DMs.

How much does DM Automation cost if I stay inside the rules?

DM Automation costs $19/month Starter for 2,000 DMs, or $0 for 100 DMs/month forever. Pro is $49/month ($39/month yearly) for 3 accounts and 15,000 DMs (pricing, October 2026). You still only message people who already contacted you.

How much does InstantDM cost?

Legend Pro is $9.99/month billed yearly with unlimited DMs up to 800 an hour. Trendsetter is $24.99/month billed yearly. Trendsetter Pro is $49.99/month billed yearly. Free is 500 DM automations/month. Multi Starter is $160/year for 3 accounts (pricing, October 2026). It sends payment links. Stripe or PayPal process payments.

Does ManyChat follow Instagram DM automation rules?

Yes, when you connect through Instagram login and only talk to people who already contacted you. Free is 25 active contacts. Essential is $17/month or $14 yearly. Pro is $39/month or $29 yearly (Featurebase, ManyChat 2 March 2026 table). See ManyChat pricing. Contact pricing is not a consent loophole.

What gets Instagram accounts restricted for DM automation?

Password logins, DMs to people who never contacted you, identical spam, bought comments firing API DMs, and two tools fighting on one account. Official-API comment-to-DM to real commenters is not the usual cause. If you already have the warning, use “We suspect automated behavior” on Instagram.

Can I run two Instagram DM tools on one account?

No. Pick one official messaging app. Duplicate sends and silent failures are how people add a password workaround. Walkthrough: Two Instagram DM tools on the same account in 2026.

About the author

DM Automation editorial writes the comparison pages on this site. We sell DM Automation. Prices for other tools are taken from those vendors’ public pricing pages, or a dated public quote of those pages, on 30 October 2026.

Next step

Pick a free plan, connect one Business or Creator account through Instagram login, and ship one keyword to people who already commented or replied. Stay on the official API. Skip password forms and follower blasts. Pay for a bigger DM bucket only after the test send works.