diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py
index 15056cf64e6..f5c39230285 100644
--- a/litellm/proxy/auth/handle_jwt.py
+++ b/litellm/proxy/auth/handle_jwt.py
@@ -1066,6 +1066,15 @@ class JWTAuthManager:
                     f"JWT Auth: Resolved org_alias='{org_alias}' to org_id='{org_object.organization_id}'"
                 )
 
+        # Check if email domain is allowed before attempting to get/create user
+        if valid_user_email is False:
+            raise ProxyException(
+                message=f"Email domain not allowed. User email: {user_email}. Allowed domain: {jwt_handler.litellm_jwtauth.user_allowed_email_domain}",
+                type=ProxyErrorTypes.auth_error,
+                param="user_email",
+                code=403,
+            )
+
         user_object: Optional[LiteLLM_UserTable] = None
         if user_id:
             user_object = (