6 min read
Card testing and fake accounts: where email signals help and where they don't
Card testing is stopped mainly by payment-side controls: rate limits, CAPTCHA, Radar-style rules and 3DS. Email signals help with the fake accounts around it.
Disposable email
Temp-mail services, fake signups, trial and referral abuse, and how to filter them.
- 7 min read
Keeping fake and internal signups out of product analytics
Tag every signup as real, suspect, fake or internal when the account is created, then filter on that tag in PostHog, Mixpanel, Amplitude or plain SQL.
- 5 min read
How to check if an email address is disposable (with and without code)
Check if an email is disposable by hand (public blocklist, MX lookup, a quick search) or in code with a list or an API. Includes a short checklist.
- 7 min read
Domain age as a signup risk signal
How to check a signup domain's registration age with RDAP, when a young domain means risk, the innocent cases, and how to combine it with a domain lookup.
- 6 min read
Free tools for detecting disposable email addresses
Free disposable email detection tools by type: open lists, libraries, keyless endpoints, free APIs and web checkers, with list sizes and the trade-offs of each.
- 6 min read
Should you block disposable emails or just flag them?
A decision framework for disposable email at signup: which surfaces deserve a hard block, when to flag instead, and what a flag should do to the account.
- 7 min read
Disposable email checker APIs: open lists vs paid services
Open blocklists, free hosted endpoints, paid verification APIs and domain intelligence APIs compared on cost, latency, freshness and failure modes.
- 6 min read
Referral and promo-code abuse: the email signals that help
Referral abuse is one person posing as many. The email signals that link those fake referees together, with code that scores a referrer before you pay out.
- 7 min read
Detecting machine-generated email addresses
How to spot bot-made addresses like xk7qmz2p@gmail.com from the local part alone: the features that work, a runnable scorer, and where it flags real people.
- 6 min read
Apple Hide My Email, Firefox Relay and SimpleLogin are not disposable email
Relay addresses look random but forward to a real, long-lived inbox. Why they differ from disposable email, why filters misfire on them, and how to allow them.
- 7 min read
Fake signups: where they come from and how to filter them
Fake SaaS signups come from five different sources, and each needs a different filter. How to tell which one you have, and what to put in front of each.
- 7 min read
Stopping free-trial abuse without punishing real users
A practical playbook for SaaS founders: screen signup emails, dedupe identities and gate trial value in steps, so abusers stall and real users never notice.
- 7 min read
Why disposable email blocklists go stale, and how to keep yours fresh
The open disposable domain list doubled in a year. Why vendored copies decay, how lists also gather bad entries, and a safe update process with code.
- 6 min read
Block disposable emails in Python (Django and FastAPI)
Block disposable email signups in Django and FastAPI with one shared validator, the PyPI blocklist package, offline PSL matching and a fail-open API option.
- 7 min read
Block disposable emails in Node.js and Express
Express 5 middleware that blocks disposable email signups using a self-refreshing open blocklist or a single API call, with tests and fail-open handling.
- 7 min read
How to detect disposable email addresses at signup
Four layered checks that catch disposable email at signup: domain normalization, an updating blocklist, MX fingerprinting and DNS signals, with working code.
- 6 min read
What is a disposable email address, and should you block it?
What disposable email addresses are, how services like Mailinator work, who uses them, and a simple rule for deciding whether your product should block them.