How can I block users from registering with disposable email addresses?

Question

I have a site where users send messages to one another using the Private Message module, and they are notified of messages by email.

On this site, there are a variety of spammers, scammers, and abusive users who attempt to register multiple accounts using disposable email addresses.

I know it's impossible to block every possible disposable email address domain, but is there anything in the Drupal world that can help me?

• I considered white-listing valid domains, but my user base is too diverse for this.

• The only project I could find on drupal.org has been abandoned.

• There are third-party APIs such as this one.

At the moment, I'm blocking them manually using this code:

/**
 * Custom validation function from the Domain Registration module (1.0).
 *
 * Checks if the domain in the email address is on a list of blocked domains.
 * @param $form
 * @param $form_state
 */

function MYMODULE_domain_registration_user_register_validate(&$form, &$form_state) {
  $default_message = t('You are not allowed to register for an account on this site.  Contact support for more information.');
  $mail = explode('@', $form_state['values']['mail']);
  $exact_domains = array(
    'ad.drupaler.org',
    'drupaler.org',
  );
  $partial_domains = array(
    'pp.ua',
    'guerrilamail',
  );
  if (isset($mail[1]) && !empty($exact_domains)) {
    if (in_array($mail[1], $exact_domains) || MYMODULE_contactinfo_check_banned_words($mail[1], $partial_domains)) {
      form_set_error('account', variable_get('domain_registration_message', $default_message));
    }
  }
}

Answer 1

Like you mentioned it is impossible to block all disposable domains.

If you want to end the madness, the most effective solution would be: Upon registration you send a confirmation link or code to a mobile phone number

Take a look at:

1. SMS Framework module
2. VoIP Drupal module

Using Unique field you could make sure that the phone number can only be used once.

Checkout: How to send SMS messages (Drupal Tutorial)

Answer 2

Your solution is good ( but I think sms verification is better solution),any way I improved your solution with integrate it with block-disposable-emai,have simple JSON BASE APIs

   /**
 * Custom validation function from the Domain Registration module (1.0).
 *
 * Checks if the domain in the email address is on a list of blocked domains.
 * @param $form
 * @param $form_state
 */

function MYMODULE_domain_registration_user_register_validate(&$form, &$form_state) {
  $default_message = t('You are not allowed to register for an account on this site.  Contact support for more information.');
  $mail = explode('@', $form_state['values']['mail']);
  $exact_domains = array(
    'ad.drupaler.org',
    'drupaler.org',
  );
  $partial_domains = array(
    'pp.ua',
    'guerrilamail',
  );

  $key     = '12345abcapikey'; //please get your own valid api key
  $request = 'http://check.block-disposable-email.com/api/json/'.$key.'/'.$mail[1]; 
  if (isset($mail[1])) {
  $response = file_get_contents($request);
  $dea = json_decode($response);
  if ($dea->request_status == 'success'){
    if ($dea->domain_status == 'block' && $dea->domain_type == 'dea_provider' && $dea->domain_is_handpicked == 1){
    // deny registration ...
              form_set_error('account', variable_get('domain_registration_message', $default_message));

    }

  }else{
    form_set_error('account', "try again");
   }
  }
  }

Answer 3

I'm facing the same problems so I create a Free API service that recognize disposable and temporary email address: Block Temporary Email

Email Endpoint:

GET https://block-temporary-email.com/check/email/[email protected]

JSON response:

{
  "status": 200,
  "domain": "simplemail.top",
  "temporary": true,
  "dns": true,
}

This API is 100% free and have no limits.

This site provides a free and updated TXT list of disposable email providers too.

Disclaimer: I made this API