Skip to main content

Blocklist

Email blocklist​

The email blocklist policy allows customization of email blocklist settings to prevent account sign-up abuse. It monitors email addresses used for sign-up and account settings. If a user attempts to sign up or link an email address that violates any blocklist rules, the system will reject the request, helping to mitigate spam accounts and enhance overall account security.

Visit the Console > Security > Blocklist to configure the email blocklist settings.

Block disposable email addresses​

This is a cloud-only feature. Once enabled, the system will automatically validates the domain of the provided email address against a list of known disposable email domains. If the domain is found in the list, the request will be rejected. The list of disposable email domains is regularly updated to ensure its effectiveness.

Block email subaddressing​

Email subaddressing allows users to create variations of their email addresses by adding a plus sign (+) followed by additional characters (e.g., user+tag@example.com). This feature can be exploited by malicious users to bypass blocklist restrictions. By enabling the block email subaddressing feature, the system will reject any sign-up or account linking attempts that utilize subaddressed email formats.

Custom email blocklist​

You can create a custom email blocklist by specifying a list of email addresses or domains to block. The system will reject any sign-up or account linking attempts that match these entries. The blocklist supports both full email address and domain matching.

For instance, adding @example.com to the blocklist will block all email addresses with that domain. Similarly, adding foo@example.com will specifically block that email address.

You can also use * as a wildcard in the local part or domain. For example, foo*@example.com blocks addresses such as foo1@example.com and foo.bar@example.com, while @*.example.com blocks addresses from subdomains such as user@team.example.com. Wildcard rules still need to follow the same email address or domain entry formats, and matching is case-insensitive. To block both a root domain and its subdomains, add both entries, such as @example.com and @*.example.com.

note:

Disposable emails, subaddressing, and custom email are restricted during new-user registration, linking email during social sign-in, and updating emails via Account API. Existing users with these email addresses can still sign in.

What is disposable email? How to handle them in your app?