# Email domain blacklist is not consulted when receiving emails (and creating staged users)

**URL:** <https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424>\
**Category:** Bug\
**Created:** [20. September 2017 um 09:20 UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424 "2017-09-20T09:20:44Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![schungx](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/schungx/32/70989_2.png) [@schungx](https://meta.discourse.org/u/schungx)\
**Post date:** [20. September 2017 um 09:20 UTC](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424/1 "2017-09-20T09:20:44Z")

</div>

File: `email/receiver.rb`  
Func: `process_internal`

When an email is received, `Email.Receiver` only checks the following:

```plaintext
Regexp.new(SiteSetting.ignore_by_title) =~ @mail.subject // Blacklisted TOPIC TITLE
raise BouncedEmailError if is_bounce? // Bounce mail
raise NoSenderDetectedError if @from_email.blank? // No From field
raise ScreenedEmailError if ScreenedEmail.should_block?(@from_email) // Screend Email address

```

After this, a new _staged_ user is created via `find_or_create_user`.

The result is, when an email is received via `email in`, the originator address is not checked whether it is from a blacklisted domain.

`EmailValidator.validate_each` should be called on `@from_email`.

The procedure should be:

1. Do the checks above
2. Further check first if the user with that email address already exists (`find_user`?). If so, let it pass.
3. If the email address doesn’t exist, call `EmailValidator.validate_each` to check if it is blacklisted. **DO NOT** create a _staged_ user if the email domain is blacklisted.
4. If not blacklisted, then create the user (`create_user`?)
5. Continue processing

---

_[View the full topic](https://meta.discourse.org/t/email-domain-blacklist-is-not-consulted-when-receiving-emails-and-creating-staged-users/70424)._