Announcing GATES

Our solution for disposable-email signups and duplicate accounts created with email aliases.

Now open source, with PostgreSQL migration scripts and connectors for Better Auth, Auth0 and Supabase Auth.

Why we built GATES

Every app offering free credits or trials eventually runs into someone creating multiple accounts to keep using them. Two ways people do this are disposable email services and email aliases.

Disposable email services let someone create inbox after inbox, often for free. Each address looks like a new signup, so the same person can keep coming back for more credits.

Aliases let someone do the same thing with an inbox they already own. If my Gmail address is johndoe@gmail.com, I can sign up as johndoe+trial1@gmail.com, johndoe+trial2@gmail.com or john.doe@gmail.com. They look like different addresses to your app, but they all reach the same inbox. Outlook, Fastmail and Proton also support aliases, though each provider handles them differently.

One way to limit this is to require a credit card before starting a trial. But that also puts a step between someone and trying your product. Many of us, including our own team, would rather try a product before handing over card details.

We built GATES to handle these two signup paths. It combines IronDome's disposable email checks with database-level email ownership. Once a user verifies an address, GATES records its matching key in PostgreSQL. Another account cannot claim that same key in your app, even if it uses a different supported alias.

GATES is open source under the MIT license. You can install it from npm or build it from GitHub. It includes connectors for Better Auth, Auth0 and Supabase Auth, SQL migrations for PostgreSQL, and custom email-matching rules.

Features

• Screen the submitted address with IronDome before continuing signup.
• Match supported aliases without changing where verification emails are sent.
• Record one verified owner per matching email key within your application tenant.
• Connect Better Auth, Auth0 or Supabase Auth to live ownership checks.

How it works

The idea is simple: reject disposable addresses before recording ownership. When a genuine user signs up and verifies their email, we let their account claim one mailbox key in your app.

Mail Canon derives a matching key using the provider's alias rules. For Gmail, alex+1@gmail.com and a.lex@gmail.com map to alex@gmail.com. The original address stays unchanged for delivery.

Once an account verifies its email, GATES claims that mailbox key in PostgreSQL. If another account later verifies an alias that maps to the same key, it cannot claim it again. This also holds when two accounts verify at the same time. Unverified signups do not reserve a key, and a match never signs someone in or merges accounts.

Alex can sign up for the first time with alex+trial@gmail.com. After verification, GATES keeps that address for delivery and records alex@gmail.com as the mailbox key for future ownership checks. A simplified view of the stored owner and key records can look something like this:

Now you may ask: why not send email directly to the mailbox key? Because the user chose the address they gave you. People use aliases to filter messages, organise their inbox and keep track of which service has their address. Replacing that address could disrupt those rules. Keep using the verified delivery address for communication, and use the canonical key to check ownership.

Before granting credits or protected access, your server checks current provider state and live GATES ownership. An old session token alone is not enough.

This is not limited to Gmail. Built-in matching rules also cover supported Outlook, Proton and Fastmail domains, using each provider's own behavior. Developers can add rules for exact custom domains with a few lines of configuration, as shown below.

Add GATES to your app

Use Node.js 22 or later, ESM, PostgreSQL and a server-side IronDome API key.

npm install irondome-gates pg

Follow your provider's guide to apply migrations, connect verification and add live access checks:

• Better Auth 1.7.7
• Auth0
• Supabase Auth

Test signup, verification, competing aliases, email changes and deletion. For an app with existing users, review conflicts and establish ownership records using the migration guide before enabling enforcement.

Match aliases deliberately

For a domain whose mail system treats Alex+trial@company.example and alex@company.example as the same mailbox, you can define that behavior explicitly:

import { createEmailPolicy } from 'irondome-gates';
const policy = createEmailPolicy({
  'company.example': { lowercase: true, stripPlusTag: true },
});

Pass the policy to your online engine as emailPolicy. Enable a rule only after confirming the domain's delivery behavior. Other domains keep their original local part; hosting on Google Workspace or Microsoft 365 does not make every alias rule safe.

Read about email matching before configuring a policy. Changing an existing policy requires a migration to check for newly conflicting addresses.