Disposable email checker
A temporary inbox exists for ten minutes and takes the account with it. Detecting one before signup avoids a customer record that will never be reachable again — and a free-trial abuse loop.
How the check works
- 1
The domain is extracted
Only what follows the @ matters: the local part carries no signal here.
- 2
It is matched against a list
The browser-side list covers the well-known consumer services. The server-side list, which the API uses, tracks the thousands of domains these services rotate through.
- 3
A verdict, not a moral judgement
A disposable address is not fraud. It is a signal about the durability of the contact, and about a visitor unwilling to commit an address yet.
Why blocking outright often backfires
Some users reach for a temporary inbox exactly because they do not yet trust your form. Rejecting them at the door costs signups. Marking the record and gating only the actions that matter — a free trial, a discount code — keeps the funnel open while protecting what needs protecting.
The list is a moving target
These services open new domains constantly, which is why any static list drifts. A domain unknown to a browser-side list can still be disposable; the point of a server-side list is that it can be updated without shipping new code.
Frequently asked questions
What is a disposable email address?
An address handed out by a service that opens a public, short-lived inbox with no signup — Yopmail, Mailinator, 10 Minute Mail and hundreds of others. It exists to receive one confirmation link and then disappear.
Should I reject them at signup?
It depends what is behind the form. For a free trial or a promotional code, yes: the abuse loop is exactly what these addresses enable. For a newsletter or a support ticket, blocking mostly costs you contacts who would have converted later.
Is a Gmail alias with a plus sign disposable?
No. jane+shop@gmail.com goes to the same durable mailbox as jane@gmail.com. It is a filing convenience, not a temporary inbox — treating it as disposable rejects perfectly legitimate users.
The same check over API
This tool runs in your browser. To run the same check from your code, in bulk or server-side, the API answers in JSON.
Read the documentation