Disposable email domains: what they are and how to detect them
A disposable address comes from a temporary inbox service and stops working within minutes or hours. Most products should not let one become an account.
Services like Mailinator, Guerrilla Mail and YOPmail hand out inboxes that anyone can read and that expire quickly. People use them to grab a download or a free trial without giving a real address. That is a reasonable thing for a person to want, but it means the account behind it is not reachable later, and it is the easiest way to create accounts in bulk.
The practical effect on a product: inflated signup numbers, free trials claimed over and over, referral credits farmed, and password resets that go nowhere. Blocking these domains at signup is cheap and almost never stops a real customer.
pingutil checks the domain against the open disposable-email-domains list on GitHub, which holds about 9,900 domains and is maintained by volunteers. We pull it into Cloudflare KV every Monday. New throwaway services appear constantly, so we also score the part before the @: a machine-generated name like "ccjxx90sze" sets verdict.is_spam even when the domain is not on the list yet.
How pingutil detects it
A per-domain lookup in the disposable list, checked before any other rule. The list is refreshed weekly by a cron job, and the email signals catch randomized addresses on domains the list has not caught up with.
POST /v1/lookup
{ "input": "someone@mailinator.com" }
→ { "category": "disposable", ... }Example domains
A few well-known ones. The full list has about 9,900 entries.
- mailinator.com
- 10minutemail.com
- guerrillamail.com
- yopmail.com
- temp-mail.org
- trashmail.com
- getnada.com
- maildrop.cc
- sharklasers.com
Common questions
- Should I block disposable emails or just flag them?
- Block them at signup for anything with a free trial, credits or referral rewards. For a newsletter or a one-off download, flagging is enough. Either way, show a short message asking for a permanent address rather than a generic error.
- Are Apple Hide My Email and Firefox Relay addresses disposable?
- No. Relay services forward to a real inbox the person keeps using, so they are not on the disposable list and you should not block them.
- How fresh is the list?
- The upstream repository changes often; pingutil re-syncs it every Monday at 06:00 UTC. A brand-new temp-mail domain can slip through for a few days, which is why the randomized-address check exists.
Related guides
- What is a disposable email address, and should you block it?
What disposable email addresses are, how services like Mailinator work, who uses them, and a simple rule for deciding whether your product should block them.
- How to detect disposable email addresses at signup
Four layered checks that catch disposable email at signup: domain normalization, an updating blocklist, MX fingerprinting and DNS signals, with working code.
- Should you block disposable emails or just flag them?
A decision framework for disposable email at signup: which surfaces deserve a hard block, when to flag instead, and what a flag should do to the account.
- Apple Hide My Email, Firefox Relay and SimpleLogin are not disposable email
Relay addresses look random but forward to a real, long-lived inbox. Why they differ from disposable email, why filters misfire on them, and how to allow them.
- Stopping free-trial abuse without punishing real users
A practical playbook for SaaS founders: screen signup emails, dedupe identities and gate trial value in steps, so abusers stall and real users never notice.
Check a domain now
Run any address through the live demo, or get an API key for your app.