How to Detect Disposable Email Addresses
Disposable email detection works by matching an address's domain against a maintained database of known temporary-mailbox providers — services like Mailinator or 10-minute-mail domains that anyone can use to receive mail without registering an account. It's a domain lookup, not a pattern-matching guess, and it's a completely separate check from "is this a free email provider," which is a different classification entirely.
How the detection actually works
Disposable-domain detection is a direct lookup: normalize the domain, check it against a maintained set of domains known to run temporary-mailbox services. There's no heuristic guessing involved — if the domain is in the set, it's flagged; if it isn't, it's not. The accuracy of the check is entirely a function of how current the underlying list is.
Why the list has to be kept current
New disposable-email services and disposable-domain generators appear constantly, and old ones disappear. A disposable-domain list that isn't actively maintained decays quickly. This API's list is refreshed from a configured source on a schedule: new domains are diffed against the existing set and added, domains no longer present in the source are removed, and every update is versioned with a checksum and a record count, so it's possible to see exactly when the list last changed and by how much — rather than trusting a static file that was accurate on the day it was written and has been silently stale ever since.
Disposable is not the same thing as free
This is the most common mistake in disposable-email detection: treating every free consumer provider (Gmail, Outlook, Yahoo, iCloud) as if it were disposable. It isn't. The two are tracked as entirely separate classifications:
| Disposable domain | Free provider | |
|---|---|---|
| What it means | Designed for temporary, throwaway mailboxes — often no registration required to receive mail | A legitimate, ongoing consumer mailbox service anyone can sign up for |
| Examples | Mailinator-style and 10-minute-mail-style services | Gmail, Outlook, Yahoo, iCloud |
| Typical risk weight | High — one of the heaviest-weighted signals in the scoring model | Low — a small signal, because most real users legitimately sign up with a free provider |
| Who uses it | Someone who specifically wants a mailbox that won't matter tomorrow | The majority of real consumer email users |
Blocking every free-provider signup because "it might be disposable" will reject the majority of legitimate consumer users. The two checks exist independently in the API response specifically so you can act on them differently — reject or heavily downweight disposable, treat free-provider as a minor, mostly-ignorable factor unless combined with other risk signals.
Why disposable domains carry a heavy weight
A disposable domain isn't a borderline signal — it's one of the highest base-weighted signals in the risk model, close to a domain not existing at all. That's because the entire premise of a disposable-email service is that the person receiving mail there has no ongoing relationship with that address: they can't be re-contacted, a password reset is meaningless the next day, and a free trial signed up through one is, by construction, a one-time-use account.
What this check can't catch
- Brand-new disposable services not yet added to the source list — this is a coverage gap inherent to any list-based approach, mitigated by keeping the source current, not eliminated
- A disposable-style domain registered privately and never publicly listed as a temporary-mail service
- Someone using a real, non-disposable provider but generating throwaway-style local parts (that's the fake-address / local-part shape problem, a separate check — see How to Detect Fake Email Addresses)
Example
{
"email": "test@mailinator.com",
"checks": { "disposable": true, "free_provider": false },
"domain": { "type": "disposable", "disposable": true, "free_provider": false },
"signals": [
{ "code": "DISPOSABLE_DOMAIN", "severity": "critical", "impact": 60, "description": "The email domain is known to provide temporary or disposable mailboxes." }
]
}Compare that with a Gmail address, where disposable is false, free_provider is true, and the only contribution to risk is the small, low-severity free_provider weight — the two checks producing opposite outcomes for two very different kinds of "free-to-use" email.
FAQ
No. Gmail is a free consumer provider — a legitimate, ongoing mailbox service. Disposable providers are specifically designed for temporary, throwaway addresses. They're tracked as separate classifications.
Yes, that's exactly what makes them useful for evading verification-by-confirmation-email — they can receive a signup confirmation just fine, which is why domain-level detection (not deliverability checking) is the right tool for catching them.
New services appear regularly, so a list that isn't refreshed at least every few weeks will drift stale. This API refreshes its list from a maintained source on a schedule and tracks exactly when and how much changed on each update.
For most SaaS signup and lead-generation use cases, yes — there's rarely a legitimate reason to sign up with a domain built for temporary mail. Some use cases (privacy-focused products, for example) may deliberately choose to allow it; the API returns the signal either way and lets you decide the policy.