Ability to block domains when receiving emails #2 by tozo · Pull Request #2384 · simple-login/app

tozo · 2025-02-06T18:32:59Z

Sorry, I had to recreate this PR.

This PR adds the functionality to block domains so that the user won't receive emails no matter which email was used from that domain.
It's mainly to prevent spam emails coming from the same domain but from different email addresses.

Since this feature is not tied to a specific alias/custom domain I added it to the setting page.
Let me know if there is a better place for this feature or if anything else needs to be changed.

Note: This feature was discussed here: #1344

Couple of screenshots:

Default view:

Page once domains are blocked:

app/models.py

app/custom_domain_utils.py

tozo · 2025-04-08T13:01:54Z

I updated the code, except the one where I asked the question

aksolotl222 · 2025-04-08T21:26:58Z

@tozo can you please add also sender block?

Now SL doesn't have option to block sender and/or domain account wide. What stops spammer from if I block him in example@my-sub.aleeas.com just send emails to another-example@my-sub.aleeas.com? As I see, such adresses created automatically by default on subdomains.

So this feature will help against this.

tozo · 2025-04-09T06:08:17Z

@aksolotl222 If I understand you correctly this PR does what you describe.

You can block complete domains so no matter what email addresses the sender use on that domain they all will be blocked.

tozo · 2025-10-10T19:24:23Z

Hi @acasajus

Could you let me know if there is any other changes that need to be done?
I think this would be a great feature for many people.

acasajus · 2025-10-20T16:09:03Z

app/custom_domain_utils.py

        )

    new_domain = sanitize_domain(domain)
-    domain_forbidden_cause = can_domain_be_used(user, new_domain)


Why is this changed. This would allow users to create a custom domain with an invalid domain or an SL domain.

Based on the original code I modified the existing and created 2 separate functions (can_domain_be_used, can_custom_domain_be_used and can_blocked_domain_be_used respectively).

Because of that I also had to change this to call the function can_custom_domain_be_used to still include all the previously executed checks.
But inside of that function I call the can_domain_be_used which should check for the domain validity and SL domain as well and if that reason is not None, then return with that error.

Currently in this branch that call is in line 119:

reason = can_domain_be_used(user, domain) if reason is not None: return reason

alik-090 · 2025-10-24T13:26:46Z

Guys, can you also add ability to

block sender (ex example@example.com) from sending emails to ANY alias (non only domain)
Separate in settings behavior. So I I disable alias - user won't see that email rejected. And when I BLOCK sender he should get error that email doesn't exist. Now there is such feature but it is combined with block and disable alias. This is bad because some services, when see "email does not exist" will not try to send email even after I turn on alias. But when I BLOCK sender, I think sender should see "email does not exist". This will prevent most soammers to use different adress/domain because they will think there is no such address.

What do you think?

tozo · 2025-10-30T09:54:29Z

@alik-090

For your first point, this PR somewhat covers that, since this blocks the whole sender domain (not just a specific email). But I can see that in some situations it might be better to block only some sender emails.

Either way I would implement those features in a separate PR, so that we keep this as simple as possible

erik65679 · 2026-01-17T15:18:33Z

@acasajus @cquintana92 @nguyenkims

Any progress on this? It is really neat feature. I am waiting for it.

acasajus · 2026-03-11T16:36:46Z

app/dashboard/views/setting.py

            flash("Your preference has been updated", "success")
+        elif request.form.get("form-name") == "blocked-domains-add":
+            domain = request.form.get("domain-name")
+            new_domain = sanitize_domain(domain)


If domain is None this will fail

app/models.py

acasajus · 2026-03-11T16:39:54Z

app/models.py


    default_mailbox = orm.relationship("Mailbox", foreign_keys=[default_mailbox_id])

+    _blocked_domains = orm.relationship("BlockedDomain", lazy="joined")


This will add a join to every user query. Please remove the lazy="joined"

acasajus · 2026-03-11T16:41:08Z

email_handler.py


+    mail_from_domain = get_email_domain_part(mail_from)
+    if is_domain_blocked(user.id, mail_from_domain):
+        # by default return 2** instead of 5** to allow user to receive emails again when domain is unblocked


Add a log here so that we can track when an email is dropped in the logs.

acasajus · 2026-03-11T16:41:44Z

app/dashboard/views/setting.py

+                flash(domain_forbidden_cause.message(new_domain), "error")
+                return redirect(url_for("dashboard.setting"))
+
+            BlockedDomain.create(user_id=current_user.id, domain=new_domain)


Add an user audit log here to keep track on what happened.

acasajus · 2026-03-11T16:41:54Z

app/dashboard/views/setting.py

+
+            BlockedDomain.delete(domain.id)
+
+            Session.commit()


Same here. Missing an user audit log.

acasajus · 2026-03-11T16:42:36Z

app/dashboard/views/setting.py

+
+            domain = BlockedDomain.get(domain_id)
+
+            BlockedDomain.delete(domain.id)


Any user seems to be able to delete any domain.

I now validate if the current user is the owner of the domain before deleting it, let me know if that looks ok
Other option is to have a call like this:

deleted = ( BlockedDomain.filter_by( id=domain_id_int, user_id=current_user.id, ).delete() )

acasajus · 2026-03-11T16:43:28Z

app/dashboard/views/setting.py

+            domain_id = request.form.get("domain_id")
+            domain_name = request.form.get("domain_name")
+
+            domain = BlockedDomain.get(domain_id)


If domain_id is none this will crash

acasajus · 2026-03-11T16:44:18Z

app/custom_domain_utils.py

+    if reason is not None:
+        return reason
+
+    if BlockedDomain.get_by(domain=domain):


Missing check that the domain belongs to the user

acasajus · 2026-03-11T16:45:30Z

app/dashboard/views/setting.py

            flash("Your preference has been updated", "success")
+        elif request.form.get("form-name") == "blocked-domains-add":
+            domain = request.form.get("domain-name")
+            new_domain = sanitize_domain(domain)


If domain is None it will fail with an exception

acasajus · 2026-03-11T16:45:49Z

app/dashboard/views/setting.py

+
+            BlockedDomain.create(user_id=current_user.id, domain=new_domain)
+
+            Session.commit()


Missign user audit log on the action done

acasajus · 2026-03-11T16:46:04Z

app/dashboard/views/setting.py

+            domain_id = request.form.get("domain_id")
+            domain_name = request.form.get("domain_name")
+
+            domain = BlockedDomain.get(domain_id)


If domain_id is None it will fail with an exception

acasajus · 2026-03-11T16:46:16Z

app/dashboard/views/setting.py

+
+            domain = BlockedDomain.get(domain_id)
+
+            BlockedDomain.delete(domain.id)


Any user can delete any domain

acasajus · 2026-03-11T16:47:13Z

app/custom_domain_utils.py

+    if reason is not None:
+        return reason
+
+    if BlockedDomain.get_by(domain=domain):


Any other user adding a domain invalidates this user from using that domain.

acasajus · 2026-03-11T16:47:35Z

email_handler.py

+    mail_from_domain = get_email_domain_part(mail_from)
+    if is_domain_blocked(user.id, mail_from_domain):
+        # by default return 2** instead of 5** to allow user to receive emails again when domain is unblocked
+        res_status = status.E200


Add a log entry here to mark that the email has been dropped.

tozo · 2026-03-15T11:37:41Z

all the notes should be fixed now, let me know if anything else needs to be fixed/changed

updating ui adding tests, fixing bugs

moved the function is_domain_blocked into its own utils refactoring the function can_domain_be_used

making sure the query and delete functionality is specific to a given user additional checks to data that's coming from the front-end

tozo requested review from acasajus, cquintana92 and nguyenkims as code owners February 6, 2025 18:33

tozo mentioned this pull request Feb 6, 2025

Ability to block domains when receiving emails #2344

Closed

tozo force-pushed the master branch 2 times, most recently from 7f01f4f to 8aa10b5 Compare February 14, 2025 03:45

tozo force-pushed the master branch from 8aa10b5 to 334ba7c Compare February 24, 2025 06:46

tozo force-pushed the master branch from 334ba7c to d556ba7 Compare March 3, 2025 13:29

acasajus reviewed Mar 28, 2025

View reviewed changes

app/models.py Outdated Show resolved Hide resolved

acasajus reviewed Mar 28, 2025

View reviewed changes

app/models.py Outdated Show resolved Hide resolved

acasajus reviewed Mar 28, 2025

View reviewed changes

app/models.py Show resolved Hide resolved

acasajus reviewed Mar 28, 2025

View reviewed changes

app/custom_domain_utils.py Outdated Show resolved Hide resolved

tozo force-pushed the master branch from c6a73fc to bab5e49 Compare October 10, 2025 19:05

tozo force-pushed the master branch from 371dabe to b293121 Compare October 15, 2025 04:13

acasajus reviewed Oct 20, 2025

View reviewed changes

tozo force-pushed the master branch from b293121 to 8bcc97b Compare March 1, 2026 09:12

acasajus reviewed Mar 11, 2026

View reviewed changes

tozo added 5 commits March 15, 2026 12:38

adding blocked domain check to the email handler

4c44d2a

updating ui adding tests, fixing bugs

replacing the DB script with a new version

04b776e

Updating the files based on the findings on the PR:

af682dd

moved the function is_domain_blocked into its own utils refactoring the function can_domain_be_used

replacing the DB script with a new version

08b5ff9

fixing the findings on the PR:

6065d5e

making sure the query and delete functionality is specific to a given user additional checks to data that's coming from the front-end

tozo force-pushed the master branch from 297eb8d to 6065d5e Compare March 15, 2026 11:38


		default_mailbox = orm.relationship("Mailbox", foreign_keys=[default_mailbox_id])

		_blocked_domains = orm.relationship("BlockedDomain", lazy="joined")


		domain = BlockedDomain.get(domain_id)

		BlockedDomain.delete(domain.id)


		BlockedDomain.create(user_id=current_user.id, domain=new_domain)

		Session.commit()

Uh oh!

Conversation

tozo commented Feb 6, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tozo commented Apr 8, 2025

Uh oh!

aksolotl222 commented Apr 8, 2025

Uh oh!

tozo commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tozo commented Oct 10, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tozo Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alik-090 commented Oct 24, 2025

Uh oh!

tozo commented Oct 30, 2025

Uh oh!

erik65679 commented Jan 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tozo commented Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tozo commented Apr 9, 2025 •

edited

Loading

tozo Oct 22, 2025 •

edited

Loading