I am seeing a small but consistent number of spam accounts being created on my Discourse forum each day. Many appear to be using fake or invalid email addresses.
I am looking for a way to automate the following process:
- A new user creates an account and Discourse sends the activation/verification email.
- If the activation email results in a confirmed hard bounce, the unactivated user account is automatically deleted.
- The system records the domain of the bounced email address.
- If multiple new accounts using the same domain result in hard bounces within a defined period of time, the domain is automatically added to the blocked email domain list.
- Common legitimate email providers such as Gmail, Outlook, Yahoo, etc., would need to be excluded from automatic domain blocking.
For example, if several accounts using different email addresses from suspicious-domain.example are created within a few days and all of their activation emails hard bounce, the domain would eventually be blocked from creating additional accounts.
The goal is to use bounce data as another signal for identifying automated spam registrations while automatically cleaning up unactivated accounts created with nonexistent email addresses.
Does Discourse currently have a plugin or existing functionality that can accomplish this? If not, are there hooks available in Discourse’s bounce-handling process that could be used to build a plugin to implement this?