Before User Created hook that blocks disposable and dead-domain signups (free, no API key)

[yasaiiko]

I kept seeing throwaway signups (mailinator, yopmail…) eating free-tier quotas, so I wrote a small Before User Created hook for it and open-sourced it:

https://github.com/yasaiiko/supabase-vetto-hook

What it does:

Rejects throwaway inboxes and domains that can't receive mail (NXDOMAIN, no MX) before the user row exists. It covers email/password, magic link, OTP and OAuth signups.
Lets privacy relays through (Apple Hide My Email, Firefox Relay, DuckDuckGo). They forward to real inboxes, and blocking them loses real users.
Fails open: it gives the check 2.5 s of the 5 s hook budget, and if the lookup is slow or down the signup goes through.
Needs no API key: it uses a free domain lookup endpoint.

Deploy:

supabase functions deploy before-user-created-hook --no-verify-jwt

Then go to Authentication → Hooks → Before User Created → HTTP, paste the function URL, and set the secret.

There's a Deno test that signs requests the same way Supabase Auth does (Standard Webhooks) and checks the 400/200/401 responses.

Disclosure: the lookup it calls is from Vetto, which I build. The hook works on its own and is MIT, so fork it and swap in your own list if you prefer.

Feedback welcome, especially on the error message.
The docs say a hook's 400 message reaches the client, but I've read reports of it showing up as a generic error.
What do you see in supabase.auth.signUp's error.message?