# Limit sign-ups per email domain

> This protection requires the [Business plan](https://clerk.com/pricing), and it's off by default.

Someone creating fake accounts in bulk can register a domain and make up as many addresses at it as they like. You see a run of new accounts at one domain you don't recognize. This protection caps how many sign-ups can use one email domain in an hour, whichever IP addresses they come from. Common email services that Clerk recognizes, such as Gmail and Outlook.com, aren't counted.

## What happens when the limit is reached

Once a domain reaches your limit, Protect blocks further sign-ups from it until its count for the past hour drops below the limit. The user sees a message that they can't sign up. See [What blocked users see](https://clerk.com/docs/guides/protect/protections/overview.md#what-blocked-users-see).

Blocked sign-ups also count toward the limit. Clerk records each one as a `protect.sign_up.blocked` event in [Application Logs](https://clerk.com/docs/guides/dashboard/logs/application-logs.md#protect-events).

## Settings

| Setting                                | Default | Description                                                            |
| -------------------------------------- | ------- | ---------------------------------------------------------------------- |
| **Sign-ups per email domain per hour** | 20      | The hourly limit for sign-ups from one email domain. The minimum is 1. |

## Choose a limit

Real people at one domain often sign up together: a company onboarding its staff, a school enrolling a class, or an enterprise customer rolling out single sign-on can each pass 20 sign-ups in an hour. If your application serves businesses or schools, set the limit above the largest rollout you expect from a single customer in an hour. A real person who reaches the limit can't sign up until the domain's count drops below it, so when in doubt, set the limit higher rather than lower. Review blocked sign-ups in [Application Logs](https://clerk.com/docs/guides/dashboard/logs/application-logs.md#protect-events) before you lower it.

## How it works with other protections

- [Limit sign-ups per IP address](https://clerk.com/docs/guides/protect/protections/limit-sign-ups-per-ip-address.md) caps sign-ups from one IP address. The email domain limit applies across IP addresses.
- [Limit sign-ups from shared infrastructure](https://clerk.com/docs/guides/protect/protections/limit-sign-ups-from-shared-infrastructure.md) applies a separate limit to sign-ups that appear to use the same infrastructure.
- [Block risky email domains](https://clerk.com/docs/guides/protect/protections/block-risky-email-domains.md) blocks sign-ups from domains that Clerk rates as risky.

## Before you enable it

- **Check your automated tests.** Tests that create many accounts at one email domain can reach the limit. Protect doesn't count sign-ups with a valid [Testing Token](https://clerk.com/docs/guides/development/testing/overview.md#testing-tokens).

---

## Sitemap

[Overview of all docs pages](https://clerk.com/docs/llms.txt)