GitHub customer service responded in a community discussion that the platform has suspended new account registrations using Outlook and Hotmail addresses due to ongoing, coordinated fraud and abuse associated with these domains. Existing accounts are not affected, and there is no exception review channel for outlook.com.

Users will see "Email domain could not be verified" on the registration page, while username and password validation can pass, and verification emails will not be sent. Changing browsers, clearing cache, or checking spam folders will not bypass this, as the interception occurs before the email is sent.

Customer service recommends using other supported email addresses for registration. GitHub documentation requires personal accounts to verify their email. On September 13, the platform experienced a failure rate of over 90% for new account registrations, which has been separately resolved and is not related to this domain suspension.

Outlook and Hotmail have a large volume and relatively high reputation scores, which have previously allowed them to bypass disposable email blacklists. There exists a toolchain in public repositories for bulk registering Outlook/Hotmail accounts, obtaining OAuth refresh tokens, and performing survival checks, turning Microsoft's consumer email into a scalable identity resource.

The interception only applies to new registrations and does not affect developer accounts already linked to these email types. The platform stated it will continue to evaluate methods between preventing abuse and secure access but did not provide a timeline for restoration.

In market mechanisms, what is sold is high-reputation email identities that can be produced in bulk, while what is bought are free repositories, Stars, and CI quotas on the platform. Funds and scripts flow from email farms to the intercepted registration funnel; beneficiaries are Gmail and other still-open email services and corporate domains, while those under pressure are gray market users relying on the Outlook pool for dummy accounts and new users who are mistakenly affected. The event is driven by risk control thresholds rather than product functionality being taken offline.

Source: Public Information