Block risky email domains

Bad actors who create fake accounts in bulk often use email domains that were set up for abuse. This protection blocks sign-ups from email domains that Clerk rates as risky.

What it blocks

A sign-up is blocked when Clerk rates the domain of its email address as risky at the Protection level you choose. Higher levels block more domains. This protection catches many risky domains, but not all of them.

This protection checks the email address as soon as it's entered.

This protection applies to sign-ups only. It never affects a sign-in. A sign-up without an email address, such as one using only a phone number, isn't affected.

What happens when a sign-up is blocked

The account isn't created, and the user sees a message that they can't sign up. See What blocked users see.

Each blocked sign-up appears as a protect.sign_up.blocked event in Application Logs.

Settings

Each level blocks more domains than the one before it:

• Low blocks only the riskiest domains.
• Medium blocks risky domains. It's recommended for most applications.
• High blocks more domains, including some used by new businesses.
• Very high blocks the most domains, including many used by new businesses. Use it while you're under attack.

How it works with other protections

This protection isn't a list of disposable email providers, and many temporary-inbox services pass it. To block those, turn on Block disposable email addresses.

Before you enable it

• Higher levels block some real customers. At High and Very high, sign-ups from some newly founded businesses are blocked too. Start with Medium, and raise the Protection level while you're under attack.