Gmail and other email services allow users to extend their address using the + (plus) character.

For example, mail to




will all be receivable by the owner of spamme@gmail.com

In its default configuration, Drupal 7 would allow the owner of spamme@gmail.com to register 3 separate accounts using the 3 addresses above... and more if they want!

I would like to prevent this type of multiple registration.

While I could just create a rule that blacklists email addresses containing the + character, there are legitimate uses of this.

I would prefer to be able to check for other equivalent email addresses, where in the above example, all 3 addresses are equivalent, because they are all collectable by spamme@gmail.com, and allow only one of them.

Is there some way to do that?


Check email before register user with add your custom validator in hook_form_alter, then check user email without +secondpart :

As a Example you can Try something like this (I didn't test this but it can give you a good clue to achieve what you want )

 function YOURMODULENAME_form_alter(&$form, &$form_state, $form_id){
       if ($form_id == "user_register_form") {
            // add your custom validator
            $form['#validate'][] = 'my_custom_email_validate';

in your custom validator check it with regular expression

function my_custom_email_validate($form, $form_state, $form_id){
    // dpm($form_state['values']);
    $mail = $form_state['values']['mail'];
    // this mean it has  xxx+xx@xxx pattern
    $clean_mail = $matches[1][0].$matches[2][0];
    $user_load = user_load_by_mail($clean_mail);
        form_set_error('mail',t('Sorry,This email used before.don\'t waste your time dear spammer'));
        return false;
| improve this answer | |

Create a second field for users that stores only real email address (everything before the +).

then use a user registration preprocess hook to check if that exists already with a simple database query.


| improve this answer | |
  • Why use an additional field and presave hook? I think this is not the correct way. Better alter your registration form and add a custom validator where you check if the email without the +xxx already exists. This way you can easily raise an error correctly. – schlicki Feb 15 '17 at 5:37
  • @schlicki because it still leaves the user with their preferred address. sometimes a user is not malicious and just wants to be able to track/filter using a +xxx. better to keep the user's choice, and solve the multiple registration problem separately, in my opinion. – user5482 Feb 15 '17 at 14:17
  • I like the concept of keeping both addresses here - as you mentioned, it's better to be able to contact the user with their preferred address, even if it contains a +, but then performing validation operations on the clean version of the address. But I don't want to ask the user to enter it twice! How would you copy and clean the email into a separate field? – Tadhg Feb 15 '17 at 16:28

I actually found a module that solves this problem already: Duplemail.

This doesn't actually answer my problem just yet, because I found it's incompatible with LoginToboggan, which seems to bypass the validate method that Duplemail hooks onto. Since LoginToboggan is already deployed...

So... I'm going to try Email Registration and Duplemail to see if this solves the issue

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.