ANNOUNCING GATES

Stop email aliases from creating duplicate accounts.

Our solution for disposable-email signups and duplicate accounts created with email aliases. Now open source, with PostgreSQL migration scripts and connectors for Better Auth, Auth0 and Supabase Auth.

GATES recognises supported aliases and enforces one verified owner per matching mailbox key within your application tenant. It does not identify a person or guarantee one account per person.

Why we built GATES

Every app offering free credits or trials eventually runs into someone creating multiple accounts to keep using them. Two ways people do this are disposable email services and email aliases.

Disposable email services let someone create inbox after inbox, often for free. Each address looks like a new signup, so the same person can keep coming back for more credits.

Aliases let someone do the same thing with an inbox they already own. If my Gmail address is johndoe@gmail.com, I can sign up as johndoe+trial1@gmail.com, johndoe+trial2@gmail.com or john.doe@gmail.com. They look like different addresses to your app, but they all reach the same inbox. Outlook, Fastmail and Proton also support aliases, though each provider handles them differently.

One way to limit this is to require a credit card before starting a trial. But that also puts a step between someone and trying your product. Many of us, including our own team, would rather try a product before handing over card details.

We built GATES to handle these two signup paths. It combines IronDome's disposable email checks with database-level email ownership. Once a user verifies an address, GATES records its matching key in PostgreSQL. Another account cannot claim that same key in your app, even if it uses a different supported alias.

GATES is open source under the MIT license. You can install it from npm or build it from GitHub. It includes connectors for Better Auth, Auth0 and Supabase Auth, SQL migrations for PostgreSQL, and custom email-matching rules.

Features

• Screen the submitted address with IronDome before continuing signup.
• Match supported aliases without changing where verification emails are sent.
• Record one verified owner per matching email key within your application tenant.
• Connect Better Auth, Auth0 or Supabase Auth to live ownership checks.

How it works

The idea is simple: reject disposable addresses before recording ownership. When a genuine user signs up and verifies their email, we let their account claim one mailbox key in your app.

Mail Canon derives a matching key using the provider's alias rules. For Gmail, alex+1@gmail.com and a.lex@gmail.com map to alex@gmail.com. The original address stays unchanged for delivery.

Once an account verifies its email, GATES claims that mailbox key in PostgreSQL. If another account later verifies an alias that maps to the same key, it cannot claim it again. This also holds when two accounts verify at the same time. Unverified signups do not reserve a key, and a match never signs someone in or merges accounts.

Alex can sign up for the first time with alex+trial@gmail.com. After verification, GATES keeps that address for delivery and records alex@gmail.com as the mailbox key for future ownership checks. A simplified view of the stored owner and key records can look something like this:

Now you may ask: why store both the email the user entered and the derived mailbox key? Why not just keep the key? They serve different purposes. The key lets us recognise the same mailbox across supported aliases. The original email preserves the address the user chose for communication. People often use aliases to organise their inbox or track which service is emailing them, so we keep that address intact.

Before granting credits or protected access, your server checks current provider state and live GATES ownership. An old session token alone is not enough.

This is not limited to Gmail. Built-in matching rules also cover supported Outlook, Proton and Fastmail domains, using each provider's own behavior. Developers can add rules for exact custom domains with a few lines of configuration, as shown below.

Add GATES to your app

Use Node.js 22 or later, ESM, PostgreSQL and a server-side IronDome API key.

npm install irondome-gates pg

Follow your provider's guide to apply migrations, connect verification and add live access checks:

• Better Auth 1.7.7
• Auth0
• Supabase Auth

Test signup, verification, competing aliases, email changes and deletion. For an app with existing users, review conflicts and establish ownership records using the migration guide before enabling enforcement.

What about other providers?

GATES currently covers major public providers, including Gmail, Outlook, Proton and Fastmail. We’re planning to add more. If you need support for another domain, you can add your own matching rules with a few lines of configuration.

For a domain whose mail system treats Alex+trial@company.example and alex@company.example as the same mailbox, you can define that behavior explicitly:

import { createEmailPolicy } from 'irondome-gates';

const policy = createEmailPolicy({
  'company.example': {
    lowercase: true,
    stripPlusTag: true,
  },
});

Pass the policy to your online engine as emailPolicy. Enable a rule only after confirming the domain's delivery behavior. Other domains keep their original local part; hosting on Google Workspace or Microsoft 365 does not make every alias rule safe.

Read about email matching before configuring a policy. Changing an existing policy requires a migration to check for newly conflicting addresses.