[User] Block another batch of disposable email domains - #14693
Open
garyhtou wants to merge 1 commit into
Open
Conversation
Adds throwaway email domains to the disposable blocklist. They run on shared throwaway-mail infrastructure alongside domains blocked in earlier rounds, and none of them is a provider anyone holds a real mailbox at. Also adds more unambiguous misspellings of gmail.com and outlook.com to the typo list. Several are parked on typosquat mail hosts, so they do accept misdirected mail; the rest don't resolve at all. Either way blocking costs nothing, and the signup form suggests the intended address instead of a generic rejection. Both validations are `on: :create`, so existing accounts are unaffected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of the problem
Another batch of throwaway email domains is being used to create accounts. They run on shared throwaway-mail infrastructure alongside domains blocked in earlier rounds, and none of them is a provider anyone holds a real mailbox at.
Separately, the typo list was still missing a number of common misspellings of
gmail.comandoutlook.com. Some of those are parked on typosquat mail hosts, so they actively accept misdirected mail; the rest don't resolve at all.Describe your changes
hcb_sourced_domains.EmailTypoDomains, so the signup form suggests the intended address instead of returning a generic rejection.Both validations are
on: :create, so existing accounts are unaffected and only new signups (and email changes) are blocked.Known gap: some signups arrive on randomly generated subdomains of a wildcard domain. The blocklist only matches exact domains, so this change doesn't stop them. Closing that needs parent-domain matching against an explicit opt-in list, which can't be automatic since plenty of legitimate school domains are subdomains.