We’ve had a recent flood of registration attempts with email addresess looking like @services.cn that are filling up our MTA queue as non-deliverable. My understanding is that there is no way to block domains using wildcards ( as per Use of an asterisk in blocked email domains prevents registration from any email address - #7 by selase ) Is there any other way to avoid this kind of attack ?

Discourse does not support wildcards in the blocked email domains list, so blocking entire domain patterns like @services.cn is not possible directly. However, there are several measures you can take to reduce or prevent these spam registration attacks: Reduce “max new accounts per registration IP” Lower this setting to 1 or another low number to limit how many new accounts can be created from the same IP address. This helps prevent mass registrations from a single IP and is very effective during an attack. Enable hCaptcha on Registration Add a CAPTCHA challenge to your signup form by enabling the Discourse hCaptcha Plugin. This increases friction for bots and automated signups and is available on all hosted plans. Manually Block Known Bad Domains While wildcards are not supported, you can explicitly add problematic domains to your “blocked email domains” list. Require New User Approval Temporarily enable the setting to “must approve users.” This puts all new registrations in a moderation queue for manual approval.

We ended up blocking those addresses at the postfix level

That’s a smart move! What was the wildcard that worked? [image] jahan_gagan: Manually Block Known Bad Domains While wildcards are not supported, you can explicitly add problematic domains to your “blocked email domains” list. I wonder why this did not work? Maybe there is a case to be made for supporting wildcards, though I can imagine that would be very easy to misconfigure and make your site impossible for anybody to use!

I replied by mail but don’t see my reply here, no time to dig it up now and the web UI doesn’t let me just type preformatted text (I hate it!) so you’ll have to guess :slight_smile:

WDYM you can’t type preformatted text? strk says the wildcard was /.*@service\..*\.cn/.

Welcome to meta, @lnicola! :sunflower: @strk maybe you are not familiar with how preformatted text works in Discourse. There are multiple ways to do it and it’s quite powerful once you learn how. See: Posting code or preformatted text

@tobiaseigen there’s a little bug, though, if I copy that regex as text and paste it in Discourse, it gets mangled to /.@service...cn/ (the backslashes are lost).

We are veering into off topic territory here! :rofl: What you are seeing there is not a bug, but intended markdown behavior. Two asterisks surrounding text displays the text as italics. Because it includes an @ it is displayed as an invalid @username. Once you surround the regex in backticks it displays as preformatted text: Italics with username: /.@service...cn/ Preformatted text: /.*@service\..*\.cn/

It doesn’t work for me: paste /.*@service\..*\.cn/into a plain-text editor, copy it back open a backtick on Discourse, paste, you get /.@service...cn/ paste as plain text (Ctrl-Shift-V) in backticks, you still get /.@service...cn/ if you copy as HTML (from my comment above), pasting works fine

Blocking spammer.<random>.domain registration attempts

Product Support

tobiaseigen (Tobias Eigen) September 29, 2025, 8:19pm 3

Sandro, were you able to resolve your issue?

Topic		Replies	Views
Use of an asterisk in blocked email domains prevents registration from any email address Bug	3	1638	January 20, 2023
Suggestion: Wildcard Block Email Address Feature	32	5112	December 7, 2021
How to prevent registration spam Product Support	27	4658	March 17, 2025
Protecting against gmail dot trick in Discourse Feature	86	22718	April 24, 2020
How to block certain types of user registrations Product Support	3	282	January 21, 2025

Blocking spammer.<random>.domain registration attempts

Related topics