Email Blocklist
Block submissions containing specific email addresses or domains before they are stored or counted.
How it works
The email blocklist checks every incoming submission against your list of blocked patterns. The check happens before the submission is stored in your database or counted toward your monthly limit — blocked submissions cost you nothing.
FormBlade scans all fields in the submission that contain an @ symbol, not just the field named "email". If any value matches a blocked pattern, the entire submission is rejected.
Pattern syntax
Patterns use fnmatch-style wildcard matching and are case-insensitive. One pattern per line.
| Pattern | What it blocks | Example matches |
|---|---|---|
spam@example.com |
Exact email address | spam@example.com |
*@mailinator.com |
All addresses at a domain | anything@mailinator.com |
*@*.tempmail.net |
All addresses at all subdomains | user@abc.tempmail.net, user@xyz.tempmail.net |
bot*@* |
Any address starting with "bot" | bot123@gmail.com, botnet@evil.com |
*noreply*@* |
Any address containing "noreply" | noreply@company.com, do-noreply@test.org |
Example blocklist
*@mailinator.com *@guerrillamail.com *@tempmail.net *@*.tempmail.net *@throwaway.email *@yopmail.com *@sharklasers.com spam-king@* bot*@*
What happens when a submission is blocked
AJAX / JSON requests
Returns a 403 status with a JSON body:
{
"ok": false,
"error": "This email address is not allowed"
}
Browser form submissions
The visitor sees a generic error page. The response intentionally does not reveal which pattern matched or which field triggered the block. This prevents spammers from iterating around your rules.
Setup
- Open your form in the dashboard.
- Go to the Security tab.
- Find the Email blocklist textarea.
- Enter one pattern per line.
- Click Save.
Tips
- Start with disposable email domains. Services like mailinator.com, guerrillamail.com, yopmail.com, and tempmail.net are commonly used by spammers. Blocking these eliminates a large share of junk submissions.
- Test before going live. After adding patterns, submit a test form using a blocked address to confirm it works as expected.
- Don't over-block. Broad patterns like
*@gmail.comwill block all Gmail users. Stick to known-bad domains and specific addresses. - Combine with other defenses. The email blocklist works well alongside captcha, FormShield, and rate limiting for layered protection.