> ## Documentation Index
> Fetch the complete documentation index at: https://formpaste.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain allowlist

> Restrict which domains a form can be submitted from - the real security boundary behind access_key.

<Info>**Free** - unlimited domains on every plan.</Info>

<Note>
  This page is about the **domain allowlist** - where a form is allowed to
  receive submissions *from*. It is not about custom sending domains for
  outbound email; Formpaste doesn't offer that.
</Note>

## Why this exists

`access_key` lives in public page source - it's designed to, the same way a
form ID would be. CORS on `/submit` is intentionally permissive
(`Access-Control-Allow-Origin: *`) so any origin can POST. The **allowed
domains** list on each form is the actual security boundary: it's what stops
someone who copies your `access_key` from wiring it into their own site and
routing their traffic into your inbox.

## Configuring it

From a form's Setup tab in the [dashboard](https://app.formpaste.com):

1. Add one or more domains to **Allowed domains**.
2. Save. Submissions from an origin that isn't on the list are rejected.

If the list is empty, the form accepts submissions from any domain - useful
while you're first wiring things up, but worth locking down once your form
is live.

## Allow disposable emails

The same Setup tab has an **Allow disposable emails** toggle
(`allow_disposable_email`). By default, submissions whose `email` field is
on a disposable/throwaway provider are scored as suspicious by
[spam filtering](/docs/features/spam-filtering) and quarantined. Turning this
toggle on skips that check - useful if disposable addresses are legitimately
expected for your use case.

## Related errors

| Code                 | HTTP | Meaning                                                                                       |
| -------------------- | ---- | --------------------------------------------------------------------------------------------- |
| `domain_not_allowed` | 403  | This form does not accept submissions from this domain.                                       |
| `invalid_redirect`   | 400  | The `redirect` URL (see [Redirects](/docs/features/redirects)) is not on the allowed-domains list. |