django-disposable-email

Block disposable and temporary email domains (mailinator, 10minutemail, ...) when people sign up to your Django site, with first-class support for django-allauth, including social logins. You can switch blocking on and off with an environment variable, with a database flag in the admin, or with your own server-configuration model.

• Domain list: the disposable-email-domains list. The copy bundled with the PyPI package always applies; a daily download adds to it.
• Downloads: the downloaded list is stored in the database, so every process sees it and no restart is needed.
• Download safety: a download that fails, or has fewer than 1000 domains, keeps the previous list.
• Subdomains: x.mailinator.com is blocked because mailinator.com is.
• Rules by hand in the admin: block a domain, or allow one that the list gets wrong. A manual allow rule wins over everything else.
• What it blocks with allauth:
  • signup, add email and change email;
  • new accounts from Google, Apple, Microsoft and other providers, including auto-signup, which skips the forms.
• What it leaves alone: existing accounts keep logging in and resetting their passwords. Admin and createsuperuser are never blocked.
• Audit: every blocked attempt is stored with the email masked (jo***@domain). An email_blocked signal fires for your own alerts.
• Wiring check: a system check warns when an allauth form is not wired.

Install

pip install "django-disposable-email[allauth,celery]"

INSTALLED_APPS += ["disposable_email"]

DISPOSABLE_EMAIL = {
    "ENABLED": env.bool("DISPOSABLE_EMAIL_ENABLED", default=True),
}

# django-allauth: use the ready forms, or add DisposableEmailFormMixin FIRST
# in the bases of your own forms (see below).
ACCOUNT_FORMS = {
    "signup": "disposable_email.allauth.forms.SignupForm",
    "add_email": "disposable_email.allauth.forms.AddEmailForm",
    "change_email": "disposable_email.allauth.forms.ChangeEmailForm",
}
SOCIALACCOUNT_FORMS = {"signup": "disposable_email.allauth.social_forms.SocialSignupForm"}

python manage.py migrate
python manage.py update_disposable_domains     # first download

Your own forms

from allauth.account.forms import SignupForm
from disposable_email.allauth.forms import DisposableEmailFormMixin

class MySignupForm(DisposableEmailFormMixin, SignupForm):
    disposable_email_source = "signup"   # shown in the audit

Outside allauth (for example invitations or contact forms), use the validator:

from disposable_email.validators import validate_not_disposable

email = forms.EmailField(validators=[validate_not_disposable])

Or call the check directly:

from disposable_email.checks import check_email

verdict = check_email("someone@mailinator.com")
verdict.blocked, verdict.reason   # True, "disposable"  ("blocked" = admin rule)

On / off

ENABLED accepts:

Values that come from the database or a callable are cached for 60 seconds in each process (ENABLED_CACHE_SECONDS). If the callable raises, blocking stays on. With blocking off, nothing is checked or audited.

Daily update

Celery beat:

CELERY_BEAT_SCHEDULE["disposable-email-update"] = {
    "task": "disposable_email.update_blocklist", "schedule": 86400.0,
}

app.autodiscover_tasks() finds it. If you pass an explicit list of apps, include "disposable_email".

Without Celery, use cron:

45 3 * * *  python manage.py update_disposable_domains

Other modes of the command:

• --stats prints the numbers without downloading.
• --check someone@example.com tells you what would happen to that address.

Settings

All of them go under DISPOSABLE_EMAIL, and all are optional.

Why not the adapter's clean_email?

allauth also calls DefaultAccountAdapter.clean_email in two other places:

• Password reset and login by code. Blocking there would lock out existing users who have such an address.
• Reading a social provider's email. There a validation error is silently turned into "no email".

So this package hooks the forms that create or change an address, plus the pre_social_login signal.

Development

uv run pytest

MIT licence.