Blocklist
Email allowlist and blocklist
Use the email allowlist and blocklist settings to control which email addresses can be used for new account registrations and account linking. Logto rejects email addresses that do not satisfy every enabled rule, helping to mitigate spam accounts and enhance overall account security.
Visit the Console > Security > Blocklist to configure the email allowlist and blocklist settings.
Custom email allowlist
Use the custom email allowlist to restrict new sign-ups and newly linked emails to approved addresses. The allowlist is disabled when it has no entries. When it contains one or more entries, an email address must match at least one entry:
| Entry type | Example | Matches |
|---|---|---|
| Exact email | [email protected] | Only [email protected] |
| Domain | @example.com | Any email address whose domain is exactly example.com |
| Local-part wildcard | foo*@example.com | Emails such as [email protected] and [email protected] |
| Subdomain wildcard | @*.example.com | Emails from subdomains, such as [email protected] |
Matching is case-insensitive. A wildcard subdomain entry such as @*.example.com does not match the root domain example.com; add both @example.com and @*.example.com to allow the root domain and its subdomains.
The allowlist is not an exception list for the blocklist. An email that matches the allowlist must still pass all enabled blocklist checks, including disposable email, subaddressing, and custom blocklist rules.
Block disposable email addresses
This is a cloud-only feature. Once enabled, the system will automatically validates the domain of the provided email address against a list of known disposable email domains. If the domain is found in the list, the request will be rejected. The list of disposable email domains is regularly updated to ensure its effectiveness.
Block email subaddressing
Email subaddressing allows users to create variations of their email addresses by adding a plus sign (+) followed by additional characters (e.g., [email protected]). This feature can be exploited by malicious users to bypass blocklist restrictions. By enabling the block email subaddressing feature, the system will reject any sign-up or account linking attempts that utilize subaddressed email formats.
Custom email blocklist
You can create a custom email blocklist by specifying a list of email addresses or domains to block. The system will reject any sign-up or account linking attempts that match these entries. The blocklist supports both full email address and domain matching.
For instance, adding @example.com to the blocklist will block all email addresses with that domain. Similarly, adding [email protected] will specifically block that email address.
You can also use * as a wildcard in the local part or domain. For example, foo*@example.com blocks addresses such as [email protected] and [email protected], while @*.example.com blocks addresses from subdomains such as [email protected]. Wildcard rules still need to follow the same email address or domain entry formats, and matching is case-insensitive. To block both a root domain and its subdomains, add both entries, such as @example.com and @*.example.com.
Email allowlist and blocklist rules apply during new-user registration, linking email during social sign-in, and linking or updating emails via Account API. Existing users can still sign in with email addresses that are already linked to their accounts.
- Admins can "bypass restrictions" by manually adding users in Console > User management, or via Management API. E.g., Create an user with a subaddress email when subaddressing is blocked.
- Block existing accounts by deleting or suspending them in Console > User management.
Related resources
What is disposable email? How to handle them in your app?