School email gates for hackathon applications without killing signup
When .edu verification helps, when it hurts, and how to configure allowlists for campus vs company events.
July 30, 2026
Gates are a product decision
School-email verification is not "security theater" by default — and it is not free either. Every extra step costs applicants. Use it when the event is actually campus-scoped.
Campus-only vs open
- Club / university weekend with limited rooms: require verified .edu (or an allowlist of schools). You will lose random LinkedIn drive-bys; that is the point.
- Company challenge recruiting broadly: do not require .edu unless the brief is literally student-only. You will filter out the builders you wanted.
On The Hackathon Company, student-hosted events can lock .edu verification after review; company challenges stay sales-led and should not pretend to be a club signup form.
Allowlists vs any .edu
Allowlisted domains (berkeley.edu, stanford.edu) beat "any .edu" when you are co-hosting with one campus. Any .edu is fine for regional student opens. Say which one you chose on the event page so applicants do not bounce mid-flow.
Messaging that does not feel like spam
- Tell people before they start: "We will email a 6-digit code to your school address."
- Use a from-address they recognize.
- If verification fails, show a human path (
hello@hackathoncompany.com) instead of a dead end.