goauthentik / goauthentik/authentik
Feature Request: email and domain blocking/blacklist functionality
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
### Is your feature request related to a problem?
Yes. I'm receiving 3-5 spam account registrations daily that I have to manually delete. These accounts clutter my other services and pollute my SSO system with unwanted entries. Examples of spam addresses I receive daily include:
[[ EMAILS REMOVED ]]
Even with hCaptcha enabled on strict settings, a significant amount of spam still passes through.
### Describe the solution you'd like
I would like authentik to have an email and domain blacklist/blocking feature that allows administrators to:
- Block individual email addresses from registering
- Block entire domains from registering
- Optionally provide bulk import functionality for lists of blocked domains/emails
- Apply the block at the registration stage to prevent spam accounts from being created in the first place
This would be a proactive measure to reduce spam account creation without relying solely on CAPTCHA validation.
### Describe alternatives that you've considered
- Relying on hCaptcha alone (currently insufficient)
- Manually reviewing and deleting spam accounts daily (time-consuming and reactive)
### Additional context
The spam is clearly coming from disposable/temporary email providers and specific domains. A simple blacklist would eliminate the need for daily account cleanup and keep the SSO system clean. This is a common feature in most authentication/registration systems and would significantly improve the user experience for administrators managing instances that receive high volumes of spam registrations.
Contributor guide
Assessment
This issue has not been assessed yet.