# Email domain blacklist is not consulted when receiving emails (and creating staged users)
**URL:** https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424
**Category:** Bug
**Created:** [20 בספטמבר, 2017, 9:20am UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424 "2017-09-20T09:20:44Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@schungx](https://meta.discourse.org/u/schungx)
#### Post date: [20 בספטמבר, 2017, 9:20am UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/1 "2017-09-20T09:20:44Z")
File: `email/receiver.rb`
Func: `process_internal`
When an email is received, `Email.Receiver` only checks the following:
```plaintext
Regexp.new(SiteSetting.ignore_by_title) =~ @mail.subject // Blacklisted TOPIC TITLE
raise BouncedEmailError if is_bounce? // Bounce mail
raise NoSenderDetectedError if @from_email.blank? // No From field
raise ScreenedEmailError if ScreenedEmail.should_block?(@from_email) // Screend Email address
```
After this, a new _staged_ user is created via `find_or_create_user`.
The result is, when an email is received via `email in`, the originator address is not checked whether it is from a blacklisted domain.
`EmailValidator.validate_each` should be called on `@from_email`.
The procedure should be:
1. Do the checks above
2. Further check first if the user with that email address already exists (`find_user`?). If so, let it pass.
3. If the email address doesn’t exist, call `EmailValidator.validate_each` to check if it is blacklisted. **DO NOT** create a _staged_ user if the email domain is blacklisted.
4. If not blacklisted, then create the user (`create_user`?)
5. Continue processing
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [20 בספטמבר, 2017, 11:04am UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/2 "2017-09-20T11:04:41Z")
What do you think @zogstrip?
---
### Author:  [@schungx](https://meta.discourse.org/u/schungx)
#### Post date: [27 בספטמבר, 2017, 11:16am UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/4 "2017-09-27T11:16:17Z")
Wonder if anyone is working on this… It gets a bit inconvenient to keep having spammers create staged accounts when i know I should be able to blacklist them.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [27 בספטמבר, 2017, 12:33pm UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/5 "2017-09-27T12:33:09Z")
I can confirm @zogstrip is aware of this. We actually ran into this with one of our customers - they were being flooded by “spam” accounts whose domains were already blacklisted.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [3 באוקטובר, 2017, 3:24pm UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/7 "2017-10-03T15:24:32Z")
Looks like @gerhard actually committed the fixes. This should prevent staged user creation when the email domain is blacklisted:
[https://github.com/discourse/discourse/commit/7f50380221f4a77bec7dfedc141ef99213de9438](https://github.com/discourse/discourse/commit/7f50380221f4a77bec7dfedc141ef99213de9438)
We also will no longer staged accounts if the email was rejected:
[https://github.com/discourse/discourse/commit/76706f91447de810f6aa3b618a2f5fe8c0924b4b](https://github.com/discourse/discourse/commit/76706f91447de810f6aa3b618a2f5fe8c0924b4b)
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [3 באוקטובר, 2017, 9:53pm UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/8 "2017-10-03T21:53:52Z")
@gerhard you have a typo in the fix (76706f914)! deleted a character from a symbol
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [4 באוקטובר, 2017, 2:44pm UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/9 "2017-10-04T14:44:00Z")
For the record, here’s the fix:
[https://github.com/discourse/discourse/commit/9ff1c23a38cea1bbee247de3e842a0624e1460cd](https://github.com/discourse/discourse/commit/9ff1c23a38cea1bbee247de3e842a0624e1460cd)
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [4 באוקטובר, 2017, 10:00pm UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/10 "2017-10-04T22:00:28Z")
This topic was automatically closed after 30 hours. New replies are no longer allowed.