How to detect disposable email addresses

Updated 2026-10-19 · 6 min read

A disposable email address is an inbox that exists for minutes or hours: someone opens a temporary-mail site, copies an address like x7k2q@mailinator.com, confirms your signup and never sees that inbox again. If you give away free trials, credits, coupons or downloads, these addresses are how one person becomes fifty "new users".

Why it matters

• Free-tier and trial abuse. Each new address gets another round of free credits.
• Dead lists. The addresses stop working, so later emails bounce and hurt your sender reputation.
• No way back to the customer for receipts, security notices or password resets.

Method 1: a domain list

Most disposable services use a fixed set of domains, so the first line of defense is a list. The open disposable-email-domains project (CC0, free for commercial use) has close to 10,000 of them. Two details matter when you use it:

• Match parent domains. Some services hand out subdomains (abc.mailinator.com), so check the domain and every parent above it.
• Refresh it. The list changes weekly. A copy baked into your code a year ago misses hundreds of domains.

Code for this: Python, Node.js.

Where lists fall short

• New domains every day. Disposable services register fresh domains precisely because lists block the old ones.
• Custom domains on shared servers. Many throwaway domains point their MX records at the same few mail servers. Checking the mail server, not just the domain name, catches domains no list has seen yet.
• Brand-new domains. A domain registered yesterday that already receives mail for a signup form is worth a second look, even if it's on no list.

What isn't disposable (don't block these)

Some addresses look throwaway but forward to a real, long-lived inbox. Blocking them annoys exactly the privacy-minded customers who read your terms:

• Apple Hide My Email (@privaterelay.appleid.com), used automatically by "Sign in with Apple".
• Firefox Relay (@mozmail.com), DuckDuckGo (@duck.com), SimpleLogin and addy.io aliases.
• Plus addressing such as jane+shop@gmail.com: it's Jane's normal Gmail inbox.

If abuse through relays is a real problem for you, limit the reward (for example, free credits only after a payment method is added) rather than refusing the address.

What to do when you find one

Using an API instead

The Verified.net email check includes disposable detection (a list refreshed weekly, matching subdomains too), and the result's recommendation becomes reject with the reason disposable:

curl https://api.verified.net/v1/email \
  -H "Authorization: Bearer $VERIFIED_KEY" \
  -H "Content-Type: application/json" \
  -d '{"address": "x7k2q@mailinator.com"}'

{
  "email": "x7k2q@mailinator.com",
  "valid": true,
  "checks": { "syntax": true, "mx_found": true, "disposable": true, ... },
  "recommendation": { "action": "reject", "reasons": ["disposable", ...] }
}

1 credit per check, and the same check catches typos, missing mail servers and nonexistent mailboxes. You can try a single address with the free email checker.