goauthentik / goauthentik/authentik

Feature Request: email and domain blocking/blacklist functionality

Open
#19,176 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Is your feature request related to a problem?

Yes. I'm receiving 3-5 spam account registrations daily that I have to manually delete. These accounts clutter my other services and pollute my SSO system with unwanted entries. Examples of spam addresses I receive daily include:
[[ EMAILS REMOVED ]]

Even with hCaptcha enabled on strict settings, a significant amount of spam still passes through.

### Describe the solution you'd like

I would like authentik to have an email and domain blacklist/blocking feature that allows administrators to:
- Block individual email addresses from registering
- Block entire domains from registering
- Optionally provide bulk import functionality for lists of blocked domains/emails
- Apply the block at the registration stage to prevent spam accounts from being created in the first place

This would be a proactive measure to reduce spam account creation without relying solely on CAPTCHA validation.

### Describe alternatives that you've considered

- Relying on hCaptcha alone (currently insufficient)
- Manually reviewing and deleting spam accounts daily (time-consuming and reactive)

### Additional context

The spam is clearly coming from disposable/temporary email providers and specific domains. A simple blacklist would eliminate the need for daily account cleanup and keep the SSO system clean. This is a common feature in most authentication/registration systems and would significantly improve the user experience for administrators managing instances that receive high volumes of spam registrations.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.