Skip to main content
Free - unlimited domains on every plan.
This page is about the domain allowlist - where a form is allowed to receive submissions from. It is not about custom sending domains for outbound email; Formpaste doesn’t offer that.

​
Why this exists

access_key lives in public page source - it’s designed to, the same way a form ID would be. CORS on /submit is intentionally permissive (Access-Control-Allow-Origin: *) so any origin can POST. The allowed domains list on each form is the actual security boundary: it’s what stops someone who copies your access_key from wiring it into their own site and routing their traffic into your inbox.

​
Configuring it

From a form’s Setup tab in the dashboard:
  1. Add one or more domains to Allowed domains.
  2. Save. Submissions from an origin that isn’t on the list are rejected.
If the list is empty, the form accepts submissions from any domain - useful while you’re first wiring things up, but worth locking down once your form is live.

​
Allow disposable emails

The same Setup tab has an Allow disposable emails toggle (allow_disposable_email). By default, submissions whose email field is on a disposable/throwaway provider are scored as suspicious by spam filtering and quarantined. Turning this toggle on skips that check - useful if disposable addresses are legitimately expected for your use case.