Free tools for detecting disposable email addresses

The best free disposable email detection tool for most developers is an open blocklist checked in your own code: disposable-email-domains (about 9,900 domains, CC0 licensed) or a library that bundles a list, such as MailChecker. For a one-off manual check, a free web checker answers in a second. Free APIs are worth adding when you want a second opinion on domains your list doesn't know, or signals beyond the domain, such as machine-generated local parts.

All of these tools fail in the same two ways: they miss domains that are new, and they flag domains that aren't throwaway at all. Pick on how each tool handles those two failures, not on the size of its list.

Free disposable email tools by type

The rest of this post covers when each type is the right call. If you're choosing between hosted options for a production signup path, disposable email checker APIs: open lists vs paid services goes further into failure modes and fail-open code.

Open lists: free, fast, and only as good as their review process

An open list is a text file of domains. You download it, load it into a hash set and check the domain of each signup. Nothing leaves your server and lookups take microseconds.

The two well-known lists differ in philosophy. disposable-email-domains is smaller and curated: contributors are asked to show evidence that a domain hands out throwaway addresses, and removal requests are accepted. wesbos/burner-email-providers is almost three times larger and less conservative. It includes duck.com, DuckDuckGo's forwarding service, whose addresses belong to real users.

The weakness of any list is time. New throwaway domains appear constantly, and a list you copied into your repo a year ago misses all of them. A weekly scheduled refresh fixes most of that; the details are in why disposable email blocklists go stale.

Normalize before you compare. Lowercase the domain, convert internationalized domains to punycode and strip a trailing dot. Some list entries sit under shared hosting suffixes, so check the full host and its parents as well as the registrable domain.

Libraries: convenient, but read the list first

MailChecker packages a list of about 56,500 domains with bindings for many languages, so the check is one function call:

const MailChecker = require('mailchecker');

if (!MailChecker.isValid(email)) {
  // invalid syntax or a domain on MailChecker's list
}

That convenience comes with a policy you didn't choose. We compared its list with disposable-email-domains: only 3,846 domains appear in both, and MailChecker includes duck.com, mozmail.com (Firefox Relay), simplelogin.com and anonaddy.com. Those are forwarding services. The person behind a Firefox Relay address has a real inbox and is often exactly the privacy-minded user you want. Blocking them is a product decision, and we usually advise against it: see why Apple Hide My Email, Firefox Relay and SimpleLogin are not disposable email.

Library updates also arrive only when you upgrade the package. If your dependency bot is set to monthly, so is your list.

A quick way to see what any list will block: diff it against another one and skim the domains that only appear in the larger list. Five minutes of reading tells you more than the README.

Keyless endpoints: one HTTP call, no account

Two vendors run free disposable checks with no API key:

curl -s https://open.kickbox.com/v1/disposable/mailinator.com
# {"disposable":true}

curl -s "https://disposable.debounce.io/?email=test@mailinator.com"
# {"disposable":"true"}

Note that DeBounce returns the string "true", not a boolean, so compare against the string. DeBounce enables CORS for all origins, which makes it usable for instant feedback in a form. Neither publishes a rate limit or an SLA, which is fair for a free service and means you shouldn't make either one a hard dependency of your signup endpoint.

Both accept a bare domain. Send the domain, not the full address, and you avoid passing your users' personal data to a third party for a check that only needs the part after the @.

A free API when you want more than a yes/no

A domain list answers one question. A classification API answers a few at once, which matters when "disposable" is only part of your policy. pingutil syncs the disposable-email-domains list weekly, adds webmail, ISP, education and government categories, and looks at the local part for machine-generated patterns:

curl -s -X POST https://pingutil.com/v1/lookup \
  -H "Authorization: Bearer $PINGUTIL_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "input": "x7kq2mz9@mailinator.com", "skip_enrichment": true }'
# "category": "disposable",
# "verdict": { "is_spam": true, "low_trust": false, "reason": "disposable_domain" }

verdict.reason tells you why, so you can show a specific error and log the decision. With skip_enrichment: true there's no LLM call and the response is fast. Forwarding services are not on its disposable list; duck.com, for example, is classified as free webmail.

The limits, plainly: 60 requests per minute per key, no bulk endpoint, and the list lags upstream by up to a week, so it shares the open list's blind spot for brand-new domains. The randomness heuristic can also flag privacy-relay aliases and some real non-English names, which is why is_randomized alone shouldn't hard-block anyone. You can try it without a key in the live demo, and browse what it treats as throwaway on the disposable domains page.

Web checkers for people, not code

Support and ops teams sometimes need to answer "is this customer's address throwaway?" without writing code. Kickbox's open page at open.kickbox.com has a form for exactly that, and pingutil's demo on the homepage shows the category, signals and verdict for any address you paste in. Both are fine for a handful of manual checks a day. Don't script against a web form.

What free tools can't catch

Every tool above works on the domain, with a little help from the local part. That leaves gaps no free list closes:

• Brand-new throwaway domains. Until someone reports them, they look like any small company domain. DNS signals help a little: a domain with no website and mail hosted on a known throwaway provider's servers is suspicious. See how to detect disposable email addresses at signup for MX fingerprinting.
• Real but abandoned inboxes. A Gmail address created for one free trial is not disposable by any list's definition.
• Gmail dots and plus addressing. jane+trial7@gmail.com is a real, permanent inbox. If trial abuse is the problem, normalize and deduplicate instead.

A setup that costs nothing

1. Vendor disposable-email-domains into your service and refresh it weekly from a scheduled job.
2. Check the domain locally first. Most hits end here.
3. For domains not on your list, optionally ask a free API with a timeout under two seconds, and accept the signup if it doesn't answer.
4. Flag forwarding services and random-looking local parts for review rather than blocking them.
5. Log the reason for every block so you can find and fix false positives.