Limit sign-ups per email domain

Someone creating fake accounts in bulk can register a domain and make up as many addresses at it as they like. You see a run of new accounts at one domain you don't recognize. This protection caps how many sign-ups can use one email domain in an hour, whichever IP addresses they come from. Common email services that Clerk recognizes, such as Gmail and Outlook.com, aren't counted.

What happens when the limit is reached

Once a domain reaches your limit, Protect blocks further sign-ups from it until its count for the past hour drops below the limit. The user sees a message that they can't sign up. See What blocked users see.

Blocked sign-ups also count toward the limit. Clerk records each one as a protect.sign_up.blocked event in Application Logs.

Settings

Choose a limit

Real people at one domain often sign up together: a company onboarding its staff, a school enrolling a class, or an enterprise customer rolling out single sign-on can each pass 20 sign-ups in an hour. If your application serves businesses or schools, set the limit above the largest rollout you expect from a single customer in an hour. A real person who reaches the limit can't sign up until the domain's count drops below it, so when in doubt, set the limit higher rather than lower. Review blocked sign-ups in Application Logs before you lower it.

How it works with other protections

• Limit sign-ups per IP address caps sign-ups from one IP address. The email domain limit applies across IP addresses.
• Limit sign-ups from shared infrastructure applies a separate limit to sign-ups that appear to use the same infrastructure.
• Block risky email domains blocks sign-ups from domains that Clerk rates as risky.

Before you enable it

• Check your automated tests. Tests that create many accounts at one email domain can reach the limit. Protect doesn't count sign-ups with a valid Testing Token.