HubSpot newsletter form script blocks specific country-code TLD emails

A newsletter signup page adds client-side email validation that blocks addresses from specific country-code top-level domains and ties the rule to a particular HubSpot form ID.

Research Overview

The page includes JavaScript that selects a form tied to a configured target form ID and validates the email field before form submission.

The validation checks the email domain for a trailing match against a fixed set of blocked TLDs.

Key Findings

When an entered email address ends with .by, .cu, .ir, .kp, .ru, .sy, or .cn, the script sets a custom validity message stating that email addresses from this domain are not allowed.

The code runs validation on input events and again on blur and invalid events to trigger browser validity messaging.

Technical Breakdown

The script defines a function that extracts the domain part after the @ symbol, lowercases it, removes trailing dots, and tests whether it ends with any blocked TLD.

For blank or type-mismatched values, it clears custom validity to defer to native required or type=email checks.

Operational Impact

On submit, the handler calls the validation function and prevents the default submission flow when the email fails the blocked-TLD check.

In the blocked case, it stops propagation and calls reportValidity on the email input to display the browser’s validation message.

Form Wiring and Consent

The script listens for the hs-form-event:on-ready event, filters by the configured target form ID, and binds the validation to the matching form within a specific HTML container.

If the form markup is injected after the event, it uses a MutationObserver to bind once the form appears, and the newsletter consent text includes a link to a privacy policy.

This blog signals brief client-side enforcement of blocked country-code TLDs on a newsletter signup form tied to a specific HubSpot form ID, with validation on input, blur, and submit and a custom error message shown via standard validity APIs.