Disposable Email Blocker — stop throwaway signups

Ten-minute mailboxes are how a banned member comes back, how one person becomes fifty accounts, and how a spam run gets its foothold. Invision Community has no idea those domains are different from anybody else's.

This knows about eight thousand of them, keeps the list current by itself, and decides what happens the moment such an account is created.

What it does

• Recognises throwaway domains. A maintained public blocklist, fetched at install and refreshed daily, so a service that launched last week is caught this week.
• You choose the response. Hold the account for approval, ban it outright, or record it and do nothing — useful for watching what arrives before you act on it.
• Your list beats the public one. Add domains it misses, and mark domains it is wrong about as always allowed. A refresh never touches either.
• Blocking a domain blocks its subdomains. One entry for example.com covers mail.example.com without listing every variation by hand.
• Shows you what it caught. A panel of counts and the recent catches, so you can tell whether the rule is right rather than trusting that it is.

Holding for approval is the default, on purpose

Not everybody using a forwarding address is a spammer. Plenty of careful people sign up to a new forum with a throwaway address precisely because they do not know you yet, and some of them become your best members.

So the default is to hold the account for a human, not to ban it. You get to look. Ban is there when you want it, and there is a third setting that changes nothing at all and simply keeps a record — the honest way to find out what your signups actually look like before you start turning people away.

It acts when the account is created, not at the signup form

Worth being straight about, because it is visible to you: Invision Community 5 provides no way for an application to refuse a registration while the form is being filled in. The account is created, and this acts on it immediately afterwards.

That is not a workaround — it is the better place to stand. It means the check also covers registrations that never touch the form: social and OAuth logins, and anything created through the REST API. A guard bolted onto the signup form would miss all of them, which is exactly where a determined spammer goes next.

Built not to get in the way

• A fault never blocks a real signup. If the database is unhappy, the check is skipped rather than failing closed. A spam tool must never be the reason somebody cannot join your community.
• A bad download cannot empty your blocklist. If the source returns a suspiciously small list, it is treated as a failed fetch and the existing list is kept.
• Existing members are never touched. It only ever looks at an account as it is created.
• The log records the domain, never the address. You do not need a file of other people's email addresses to decide whether a rule is working.

Requirements

• Invision Community 5.0 or newer, self-hosted
• Outbound access to fetch the blocklist — or add domains by hand and turn the refresh off, which works perfectly well on a closed network

Built to be safe

It adds two small tables, hooks no templates, and never edits a core file. Everything it does happens on the member-created event, wrapped so that no fault of its own can surface to the person registering.

Version 1.0.0 · Invision Community 5 · self-hosted