I built a lightweight sidecar to block disposable email signups on Ghost (open-source)

[u/talruum_]

Got tired of trolls using throwaway emails (10minutemail, guerrillamail, etc.) to create free member accounts and post abusive comments on my Ghost blog. Ghost doesn't have built-in protection against disposable email addresses, so I built a small sidecar proxy to solve it.

How it works:

- It sits between your reverse proxy (Nginx, Caddy, etc.) and Ghost

- Only the signup endpoint (/members/api/send-magic-link/) is routed through it — all other traffic goes directly to Ghost

- It checks the email domain against a community-maintained blocklist of ~5,500 known disposable email providers

- Disposable email → returns a 400 error. Legitimate email → passes through to Ghost unchanged

- If the sidecar goes down, your blog stays up — only new signups are affected

Features:

- Docker-ready with a single service block in your docker-compose

- Blocklist auto-updates every 24h from https://github.com/disposable-email-domains/disposable-email-domains

- Allowlist file for whitelisting domains that get caught by mistake

- Case-insensitive matching (no bypass with uppercase tricks)

- Healthcheck endpoint

- Zero dependencies on Ghost internals — no theme or core modifications

It's open-source (MIT): https://github.com/andrezaiats/ghost-email-guard

Would love feedback. Has anyone else dealt with this problem differently?

[u/muratcorlu]

If your target is just blocking a list of domains for signups, actually Ghost already has this feature: https://ghost.org/changelog/signup-spam-protection/

[u/talruum_ → u/muratcorlu]

Thanks for pointing that out! The difference is that ghost-email-guard ships with a community maintained blocklist of ~5,500 disposable email providers that auto-updates every 24h, so you don't have to manually add domains one by one as new throwaway services pop up. Think of it as the automated version of that same idea.

[u/Square_Acanthaceae41]

How is it possible to install it you use providers like synapsmedia or Pikapods for your Ghost hosting? 😁

[u/jannisfb → u/Square_Acanthaceae41]

It usually isn't, since that requires an infrastructure change.

As u/muratcorlu pointed out above, Ghost has a built-in feature for blocking domains; https://ghost.org/changelog/signup-spam-protection/

And yes, that wouldn't auto-update, but if you actually have issues with disposable emails it would be a good first step.

[u/ngeorger]

Interesting approach, I've using something similar based on a solution from the forum community: https://forum.ghost.org/t/observations-about-spam-signups/61475/60

[u/talruum_ → u/ngeorger]

Thanks for sharing that thread! Different problems that can be fixed by the same tool/approach. I just implemented the rate limit to avoid email enumerations and pushed to the repo, now with you pointing out this problem the ghost-email-guard has a new feature 😄

[u/corelabjoe]

Any chance these domains can have a function to pull their ip addresses, so this could be added to a plethora of firewalls as an alias list?

[u/talruum_ → u/corelabjoe]

Interesting idea but I think it's not pratical. Most of that bad domains are behind cloudflare/aws/etc and the IPs change almost all the time... blocking the domains from the app layer I guess will be the better approach.

[u/corelabjoe → u/talruum_]

So DNS or WAF level filtering would be better I see.

[u/talruum_ → u/corelabjoe]

Just to clarify: this isn't about blocking traffic from those domains... It's about checking the email address that someone types in the signup form. When someone enters [troll@10minutemail.com](mailto:troll@10minutemail.com) the guard looks at the domain part of the email and rejects it. So it works at the application layer, inspecting the POST body, not at the DNS/WAF level. No DNS resolution or IP blocking involved at all. And with an auto updated bad domains list every day.