Block disposable email addresses from signing up

Stop people from creating accounts with temporary or throwaway email addresses, such as @temp-mail.com. These addresses are commonly used for spam, abuse, and one-time sign-ups you can never reach again.

When Block disposable email addresses is switched on, Kinde rejects any sign-up whose email domain is on a list of known disposable email providers. Kinde maintains the list, so you do not need to keep your own list up to date.

This setting is off by default. It applies to every organization in the environment. Each environment is independent, so switching it on in one environment does not affect any other.

Turn on disposable email blocking

Link to this section

Blocking disposable email addresses requires the Kinde Plus plan or higher. It is available on the Plus, Scale, and Enterprise plans.

1. In Kinde, go to Settings > Environment > Policies.

2. In the Sign up section, below Allowed domains, switch on Block disposable email addresses.

3. Select Save.

   

The policy takes effect for new sign-ups in this environment. Repeat these steps in any other environment where you want it on.

If your environment is on the Free or Pro plan and the switch already appears on, this is because the policy was briefly available on all plans before the Plus requirement was added. Blocking is not applied while the environment stays on Free or Pro. Your saved setting is kept, and blocking resumes when you upgrade.

What gets blocked

Link to this section

Kinde checks the domain of the email address a person enters when they register. If the domain is on the disposable list, the sign-up is rejected.

Matching is suffix-based, so subdomains of a listed domain are also blocked. For example, if listed.com is on the list, a sign-up with user@mail.foo.listed.com is rejected.

The reverse does not apply. Some entries on the list are specific subdomains of otherwise legitimate hosting providers that are known to be abused. When only a subdomain is listed, the parent domain and the provider’s other subdomains are not blocked.

The policy applies to these registration paths.

Registration path	Blocked
Sign-up page registration (email and password, email code, trusted social)	Yes
Registration started from the sign-in page via Create account	Yes
SAML or enterprise SSO automatically provisioning a new user	Yes
Accepting an invitation	No
Users created through the Kinde Management API	No
Users added from the Kinde admin console	No
Bulk user import	No
SCIM provisioning from a directory	No
Converting an access request or subscriber into a user	No
Phone-only and username-only sign-up	No

Kinde manages the contents of the list. You cannot add domains to it, edit it, or exclude individual domains from it. If you need different rules, see If you need different behaviour below.

What is not blocked

Link to this section

Existing users are never affected. The policy applies at registration only. A user who already has an account on a domain that is later added to the list continues to sign in as normal.

Invitations are exempt. Someone who accepts an invitation can complete sign-up with any email address, including one on the disposable list. An invitation names a specific address, so the policy does not override the choice of whoever sent it. When the Allow invitations policy is on, organization members can send invitations as well as admins. See Invitations.

Users you create are not checked. The policy does not apply to users added in the admin console, imported in bulk, created through the Kinde Management API, or provisioned through SCIM from a directory. Converting an access request or a subscriber into a user is also not checked.

Registrations without an email address are not checked. Phone-only and username-only sign-ups have no email domain to check, so they proceed as normal.

What the person signing up sees

Link to this section

When a sign-up is blocked, the person sees an error page with this message:

We can’t finish signing you up as the email domain we detected is not allowed. Try a different sign up method.

The page also shows Error code: 9697. The message is localised into the language of the sign-up page. See Error code 9697.

The person is not told that their email domain was classified as disposable, and Kinde does not notify your business when a sign-up is blocked.

If you need different behaviour

Link to this section

The disposable email list is maintained by Kinde and cannot be customised. If you need something different, you have two options.

• Allow only specific domains. Use the Allowed domains policy to permit sign-ups only from the email domains you list, for example your own company domain or a partner’s. See Allowed domains. If you also use Allowed domains, both checks apply. A domain must be on your allow list and not on the disposable list to complete self-service sign-up.
• Use your own list or logic. Write a pre-user registration workflow that checks the email address against your own list of domains, or applies any other rule you need. See Block disposable emails with Kinde workflows. A workflow is also the only option on the Free and Pro plans.

A workflow cannot override this setting. If a domain is on Kinde’s disposable list and the switch is on, sign-up is blocked before the workflow runs.