How to Block Email Domains on Shopify
When fraud keeps coming from the same email domain, blocking addresses one at a time can't keep up. Here's how to block a whole domain, and its subdomains, at checkout on Shopify.
Short answer
Shopify has no setting to block an email domain. With Ongoing Defender, add the domain to your checkout rules and every address at it is blocked, including its subdomains, on any payment provider. One switch also blocks about 50 well-known throwaway inbox services.
When to block a whole domain
Blocking a domain is the fastest way to shut down a group that keeps making new addresses. Here's when to use it, and when a narrower block is better.
| Situation | What to block |
|---|---|
| A fraud ring using its own domain, like [email protected] | The whole domain |
| Throwaway inbox services like Mailinator | The disposable email switch, plus any new services you spot |
| One person with one address | Just that email address |
| Someone using Gmail, Outlook or another big provider | Their email, phone and shipping address, never the provider's domain |
How to do it with Ongoing Defender
- 1Install Ongoing Defender and turn on Checkout rules.
- 2Add the domain to your checkout rules, for example ab12shop.xyz. Subdomains like mail.ab12shop.xyz are blocked too.
- 3Switch on Block disposable email addresses to cover the well-known throwaway services in one go.
- 4Add your best customers' emails to the always-allow list, so a broad rule never catches them.
- 5Test a checkout with an address at that domain to see it blocked.
Defender blocks the domain and its subdomains, not lookalike domains, so you only ever block exactly what you mean to.
How to spot a domain worth blocking
- Several orders or abandoned checkouts from the same unfamiliar domain.
- Orders from that domain flagged as risky in Shopify's Order risk section.
- A domain that looks random, or that has no real website when you search for it.
- The same shipping address or phone number appearing with different addresses at one domain.
Keep the customers you want
Always-allow emails and tags are checked first, so a real customer is never caught by a domain rule. If a company domain has one bad actor and many good customers, block the individual address instead, and keep the rest of the company welcome.
Why Ongoing Defender instead of Shopify's built-in tools
| What you need | Shopify on its own | With Ongoing Defender |
|---|---|---|
| Block every address at a domain | Not built in | One rule |
| Include subdomains | Not built in | Automatic |
| Block throwaway inbox services | Not built in | One switch |
| Keep good customers safe from a broad rule | Not built in | Always-allow emails and tags |
Tips for best results
- Never block a big email provider's domain, like gmail.com or outlook.com. Block the person's details instead.
- Leave private relay domains such as privaterelay.appleid.com unblocked. Real iPhone customers use them.
- Turn on Stop repeated checkout attempts too, so anyone cycling through new addresses is caught by their phone or address.
- Check your abandoned checkouts weekly for new domains to add.