How to block disposable email addresses at signup

The short answer: check every new address against a maintained list of throwaway domains, then also check where the domain's email goes and how old the domain is. The list catches the known ones; the mail-server and age checks catch the new ones that appear every day.

Why disposable emails are a problem

A disposable (or "temporary", "burner", "throwaway") address is an inbox anyone can open without an account, like those from Mailinator or 10 Minute Mail. They're useful for privacy, but on a signup form they usually mean one of three things:

• Free-trial abuse: the same person signing up again and again for another free month.
• Promo and referral abuse: farming sign-up bonuses or referral credits.
• Bad data: you can never reach the person again, so onboarding emails, receipts and password resets go nowhere.

Why a blocklist isn't enough

Public lists track thousands of throwaway domains, and they're a great start. But throwaway services register new domains constantly, precisely because lists exist. A domain registered this morning isn't on anyone's list yet.

Two facts give the new ones away:

1. They reuse mail servers. Running mail servers is the expensive part, so a throwaway service points hundreds of domains at the same few servers. If a brand-new domain's MX record points to the same servers as 300 known throwaway domains, it's one of them.
2. They're young. Real businesses and people rarely sign up with a domain registered last week.

The three checks

Veqen runs all three in one call. The free disposable email checker shows the same result in your browser.

Block them in code

Call the API from your server when the form is submitted, before you create the account:

async function isThrowaway(email) {
  const res = await fetch("https://veqen-app.com/v1/email/check", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.VEQEN_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ email }),
    signal: AbortSignal.timeout(3000),
  });
  if (!res.ok) return false; // fail open: never block real people because of an outage
  const result = await res.json();
  const codes = result.risk.reasons.map((r) => r.code);
  return result.disposable || codes.includes("mx_shared_with_disposable");
}

if (await isThrowaway(req.body.email)) {
  return res.status(400).json({ error: "Please use a permanent email address." });
}

import os, requests


def is_throwaway(email: str) -> bool:
    try:
        r = requests.post(
            "https://veqen-app.com/v1/email/check",
            headers={"Authorization": f"Bearer {os.environ['VEQEN_API_KEY']}"},
            json={"email": email},
            timeout=3,
        )
        r.raise_for_status()
    except requests.RequestException:
        return False  # fail open
    result = r.json()
    codes = {reason["code"] for reason in result["risk"]["reasons"]}
    return result.get("disposable") or "mx_shared_with_disposable" in codes

Prefer to roll your own with just the list? Download it as JSON, CSV or text. It's public domain.

Write a good error message

• Say what to do: "Please use a permanent email address" beats "Invalid email".
• Don't accuse: plenty of people use throwaway inboxes out of privacy habits.
• Offer a typo fix when the API returns did_you_mean ("Did you mean jane@gmail.com?"). Typos are a bigger source of bad addresses than throwaways.

Frequently asked questions

Should I block all disposable emails?

For free trials, referral programs, coupons and anything with a per-account reward: yes. For a newsletter or a download, you may prefer to allow them and simply not count them as leads.

Are Gmail +tag addresses disposable?

No. jane+trial@gmail.com reaches Jane's real inbox. But one person can create many of them, so compare the canonical address (jane@gmail.com) to stop duplicate accounts.

What about privacy relays like iCloud Hide My Email?

Relay addresses forward to a real inbox and the person can reply, so they aren't throwaway. Veqen doesn't flag them as disposable.