How to Restrict Email Domains in WordPress Forms

What Is Email Domain Restriction?

Email domain restriction limits which email addresses a form accepts based on the part after the @ symbol. For example, if you allow only yourcompany.com, then [email protected] passes but [email protected] is rejected.

Auto Form Builder uses an allowlist approach — you specify domains that are permitted. Any email from a domain not on the list is blocked with an inline error message.

This is configured per email field, so one form can have a strict work-email field and a separate personal-email field with different rules — or no restriction at all.

How to Enable Domain Restriction

1. Open your form in the Auto Form Builder editor
2. Add an Email field (or select an existing one)
3. In the field settings sidebar, scroll to Email Field Options
4. Check Restrict Allowed Email Domains
5. In Allowed Email Domains, enter each permitted domain on a new line — without the @ symbol
6. Click Save Form

Example allowed domains list:

yourcompany.com
partner.org
university.edu

The form validates the domain when the visitor leaves the email field and again before the form is submitted. If the domain is not allowed, submission is blocked and the page scrolls to the error.

How Validation Works

When domain restriction is enabled, Auto Form Builder:

• Renders the email input with domain validation attributes on the frontend
• Extracts the domain from the entered email address (the part after @)
• Compares it against your allowlist (case-insensitive)
• Shows an error if the domain is not permitted: “Only email addresses from these domains are allowed: [domain list]”
• Clears the error while the user is typing so they can correct it
• Re-validates on form submit and prevents submission if any restricted email field fails

Standard email format validation still applies — the address must be a valid email before domain checking runs.

Common Use Cases

Employee-only internal forms

Restrict to your company domain so only staff can submit HR requests, IT tickets, or internal feedback forms.

yourcompany.com

Student or academic forms

Accept emails from your institution and partner universities.

university.edu
partnercollege.edu

B2B partner registration

Limit registration to known partner organization domains.

partner1.com
partner2.org
partner3.co.uk

Approved vendor applications

When vetting suppliers, restrict submissions to domains you have pre-approved for the application period.

Multi-domain organizations

Companies with regional domains can allow all variants on one form.

company.com
company.co.uk
company.de

Combine with Email Confirmation

Domain restriction works alongside the Add Confirmation Field option in email field settings. When both are enabled:

1. The visitor enters their email address
2. Domain validation checks the address against your allowlist
3. The visitor re-enters the email in the confirmation field
4. Both fields must match before submission succeeds

This combination catches typos and enforces domain policy — ideal for registration and account forms where email accuracy matters.

Combine with Conditional Logic

Use conditional logic to show different email fields with different domain rules based on the user’s selection:

• Radio question: “Are you a student or faculty member?”
• Student email field (shown if Student) → Allow only university.edu
• Faculty email field (shown if Faculty) → Allow university.edu and research.org

Each email field has its own independent domain allowlist, giving you flexible per-audience restrictions within a single form.

Best Practices for Email Domain Restrictions

• Enter domains without @ — Use company.com, not @company.com
• One domain per line — Keeps the allowlist readable and easy to maintain
• Include all valid variants — Add regional domains (.co.uk, .de) if your organization uses them
• Tell users upfront — Add help text like “Please use your company email address” so visitors know the requirement before typing
• Mark the field as required — Domain restriction only runs when an email is entered; required fields ensure submission is not skipped
• Test with allowed and blocked domains — Submit test entries with both valid and invalid domains before going live
• Keep the list updated — When partners join or leave, update the allowed domains and save the form
• Do not over-restrict public forms — Contact forms meant for the general public should usually accept any valid email

What Domain Restriction Does Not Do

Understanding the limits helps you use the feature correctly:

• It is an allowlist, not a blocklist — You specify permitted domains, not banned ones. To block Gmail, you would need to list every domain you do accept instead
• It applies to Email fields only — Domain restriction is configured on the dedicated Email field type, not on generic Text Input fields
• It validates the domain string, not mailbox existence — The form checks that the domain matches your list; it does not verify the mailbox actually exists
• Subdomains must be listed separately — mail.company.com and company.com are treated as different domains unless both are added

Step-by-Step Example: Employee Feedback Form

1. Create a new form titled “Employee Feedback”
2. Add a Name field (required)
3. Add an Email field labeled “Work Email” (required)
4. Enable Restrict Allowed Email Domains
5. Enter your company domain: acmecorp.com
6. Enable Add Confirmation Field to prevent typos
7. Add help text: “Please use your @acmecorp.com email address”
8. Add a Text Area for feedback (required)
9. Save the form and embed it on your intranet page
10. Test with [email protected] (should pass) and [email protected] (should fail)

Frequently Asked Questions

Get Started with Auto Form Builder

Control who can submit your forms by restricting email domains to company, academic, or partner addresses — configured in a few clicks with no custom code.

Download:
Auto Form Builder on WordPress.org

Plugin last updated: Last update 12 August