At work, I was asked to add stricter email validation to our forms to help reduce spam. Honestly, my first thought was that it was kind of pointless. If someone wants to spam a form, they can use a regular email address too. But I started looking into it and found projects like fakeout and disposable-email libraries on GitHub. That got me thinking about the practical side: blocking certain addresses, making exceptions, and deciding which rule wins when they overlap. I wanted something I could reuse across forms without rewriting those checks each time, so I built mailrules. It uses validator.js for email syntax and fakeout for disposable-domain data. You can block individual addresses or domains, allow exceptions, or restrict a form to specific domains or mailboxes. It also returns rejection reasons so you can tell the user what happened. npm install mailrules A small example: import { createEmailValidator } from 'mailrules'; const validator = createEmailValidator({ blocklist: { emails: ['abuse@example.com'], }, allowlist: { emails: ['trusted@mailinator.com'], }, }); validator.check('person@mailinator.com').reasons; // ['disposable'] validator.check('trusted@mailinator.com').valid; // true validator.check('abuse@example.com').reasons; // ['blocked'] Explicit blocks always win over allowlist exceptions. Everything runs locally and synchronously. You can also use mailrules/core to supply your own disposable-domain list. It won't tell you whether a mailbox actually exists or belongs to the person submitting the form, and the disposable-domain list needs to stay updated. I still wouldn't rely on email validation alone for spam prevention, but I wanted these particular rules in one place. It's MIT licensed and includes TypeScript types and ESM/CJS support. GitHub · npm If you've used disposable-email blocking in a real app, what exceptions did you end up needing? I'd like to hear where it caused problems for legitimate users.   submitted by   /u/Ramirez_001 [link]   [comments]