How to Block Disposable Emails in Auth0 using Actions and MailCheck API

SaaS platforms lose thousands of dollars annually to infrastructure costs, polluted CRM data, and free-trial abuse caused by users signing up with disposable email addresses (e.g., Mailinator, TempMail).

If you are using Auth0 for identity management, the absolute best place to block this fraud is at the identity layer—before the user is ever created in your database.

In this guide, we will use Auth0 Actions and the MailCheck API to instantly reject signups originating from disposable, high-risk, or invalid email addresses.

1. Why Block Burners at the Identity Layer?

Many developers make the mistake of handling email validation inside their application backend (e.g., in a Next.js API route after the user submits a form).

The problem with this approach:

1. Ghost Users: If a malicious user hits the Auth0 signup endpoint directly, they bypass your frontend checks.
2. Database Bloat: The user is already created in Auth0 before you can delete them.
3. Security: It increases the surface area for abuse.

By using an Auth0 Pre-User Registration Action, the validation happens securely inside Auth0's serverless environment. If the email is a burner, Auth0 rejects the request with a native error message, and the user is never created.

2. Creating a Pre-User Registration Action

Auth0 Actions allow you to run custom Node.js code at specific triggers in the identity lifecycle.

1. Log in to your Auth0 Dashboard.
2. Navigate to Actions > Library.
3. Click Build Custom.
4. Set the Name to Block Disposable Emails.
5. Set the Trigger to Pre User Registration.
6. Set the Node version to the latest recommended version.
7. Click Create.

3. Adding API Secrets in Auth0

To call the MailCheck API, you will need your API key. (You can grab your free key from the RapidAPI Marketplace).

In the Auth0 Action code editor:

1. Click on the 🔑 (Secrets) icon on the left sidebar.
2. Click Add Secret.
3. Key: MAILCHECK_API_KEY
4. Value: (Paste your RapidAPI key here)
5. Click Create.

4. The Node.js Validation Code

Auth0 Actions use the native axios library, making HTTP requests incredibly easy. We will hit the MailCheck edge endpoint, which processes validations in under 50ms (crucial so you don't slow down the user's signup experience).

Copy and paste this code into your Action editor:

const axios = require("axios");

/**
 * Handler that will be called during the execution of a PreUserRegistration flow.
 *
 * @param {Event} event - Details about the context and user that is attempting to register.
 * @param {PreUserRegistrationAPI} api - Methods and utilities to help change the behavior of the user registration.
 */
exports.onExecutePreUserRegistration = async (event, api) => {
  const email = event.user.email;

  try {
    const response = await axios.post(
      "https://mailcheck.fadsync.com/api/v1/verify",
      { email: email },
      {
        headers: {
          "Content-Type": "application/json",
          "Authorization": `Bearer ${event.secrets.MAILCHECK_API_KEY}`
        },
        timeout: 3000 // Ensure we never block the UI for too long
      }
    );

    const data = response.data;

    // 1. Block Disposable Emails
    if (data.is_disposable) {
      return api.access.deny(
        "invalid_email",
        "Signups using disposable or temporary email addresses are not permitted."
      );
    }

    // 2. Block High-Risk / Undeliverable Emails
    if (data.risk_score > 80 || !data.domain_details.has_valid_mx) {
      return api.access.deny(
        "invalid_email",
        "Please provide a valid corporate or personal email address."
      );
    }

  } catch (error) {
    // Fail-open: If the API is unreachable, allow the signup so we don't block legitimate users.
    console.error("MailCheck API Error:", error.message);
  }
};

How it Works:

• api.access.deny(): If the MailCheck API returns is_disposable: true, we halt the registration. The user will see the custom error message natively on the Auth0 signup widget.
• Fail-Open Design: In the catch block, we deliberately do not call api.access.deny(). If there is a network error, it is always better to allow a potential spammer than to block a paying customer.
• Speed: Because MailCheck uses edge-caching and an in-memory threat database, this entire network round-trip typically takes ~40-60ms.

5. Testing and Deploying

Before deploying, click the ▶️ (Test) button in the Auth0 editor. Try passing a test payload using a known burner email (like test@mailinator.com). You should see the Action return an Access Denied error.

Once tested:

1. Click Deploy in the top right corner.
2. Navigate to Actions > Flows > Pre User Registration.
3. Drag and drop your new Block Disposable Emails action into the flow between "Start" and "Complete".
4. Click Apply.

Conclusion

You have now successfully hardened your entire SaaS application against free-trial abuse! No matter what frontend framework you use (Next.js, React, Vue), your identity layer is natively protected by MailCheck API.

Ready to secure your application? Get your free MailCheck API key today.