Block disposable signups in Auth0 with a Pre User Registration Action

Why Auth0's built-in check isn't enough

Auth0 can flag well-known disposable domains, but that check runs against a static list. It doesn't catch a throwaway domain registered an hour ago, or the long tail of rotating lookalike domains that all point at the same handful of temp-mail servers. Those pass through untouched.

Add a Pre User Registration Action

Auth0 Actions let you run custom code during the signup flow. The Pre User Registration trigger runs before the user is created, so calling api.access.deny() stops a disposable signup outright, leaving no account to clean up afterward, unlike a post-creation ban.

In the Auth0 dashboard: Actions → Flows → Pre User Registration, create a new custom action, add mailsurity as a dependency, and add MAILSURITY_API_KEY as a secret (Action settings, not an environment variable, since Actions run in their own sandbox).

// Add "mailsurity" in the Action's dependency panel (left sidebar).
const { Mailsurity } = require('mailsurity');

exports.onExecutePreUserRegistration = async (event, api) => {
  const ms = new Mailsurity({ apiKey: event.secrets.MAILSURITY_API_KEY });

  if (await ms.isDisposable(event.user.email)) {
    // Blocks the registration outright: the account is never created.
    api.access.deny(
      'disposable_email',
      'Please sign up with a permanent email address.',
    );
  }
};

A note on fail-open behavior

The Mailsurity SDK fails open by default: a timeout or transient error resolves isDisposable() to false rather than throwing, so a Mailsurity outage never blocks a real signup. The default 2-second timeout comfortably fits inside Auth0 Actions' execution window given Mailsurity's <100ms p99 latency.

Why this catches more than the static list

Mailsurity fingerprints the mail servers behind throwaway addresses, so a brand-new disposable domain is flagged the moment it points at a known throwaway host, before any list has heard of it. Run the audit on your real Auth0 signups to see how many are getting through today.