Email requirements for new accounts
Refuse addresses whose domain does not exist, block throwaway mailboxes, and require verification before the first sign-in.
- Beginner
- 5 min read
- Applies to 2.0
Three toggles
User Access → Registration, in the Email requirements panel of whichever sign-up method you use.
The Email requirements panel, with its three toggles.
| Toggle | What it does |
|---|---|
| Validate email domain exists | Refuses an address whose domain resolves to nothing |
| Block disposable email addresses | Refuses known throwaway mailboxes |
| Require email verification before login | The account is created but cannot sign in until the address is confirmed |
Validate email domain exists
A DNS lookup on the part after the @. jean@exemple-inexistant.fr is refused
before an account is created; a typo like gmial.com is caught the same way.
It checks that the domain can receive mail at all — not that this particular mailbox exists. No check can do that without sending something.
The check fails open. If the lookup times out, or the server cannot perform one, the sign-up goes through. A network problem on your side is not a reason to turn a visitor away.
Block disposable email addresses
Refuses the throwaway services people use to get past a sign-up form without giving a real address: Mailinator, YOPmail, 10 Minute Mail and around twenty others.
The list is deliberately short, and covers the services seen most often. There
is no exhaustive list of disposable domains — new ones appear constantly — so
treat this as friction rather than a wall. Developers can extend the list with
the attrua_pro_disposable_email_domains filter.
Require email verification before login
The account is created, but sign-in is refused until the address is confirmed. This is the toggle that actually proves an address belongs to the person, which the other two cannot do.
Test your email delivery before switching this on. If confirmation messages do not arrive, every new member is stuck with an account they cannot use — and they have no way to tell you.
- Signed up with a normal address: it goes through
- Signed up with a deliberate typo in the domain: it is refused
- Signed up with a
@mailinator.comaddress, if you enabled that toggle - The confirmation email arrives, if you require verification
Related articles
Something missing or out of date? Tell support.