# pingutil > pingutil is a free, community-run REST API that classifies an email address or domain as company, free webmail, disposable, ISP, educational, government or unknown, returns heuristic email signals and a spam verdict, and for company domains returns a structured company profile (industry, headquarters, employee range, funding stage, links). Endpoint: POST https://pingutil.com/v1/lookup with a free API key (60 requests/minute). Key facts: - Disposable detection uses the open disposable-email-domains list (about 9,900 domains), re-synced weekly, plus a randomized-address heuristic. - Educational and government detection is rule-based on the domain (.edu, .ac., .gov, .gouv., .gob., ...). - Company profiles are generated by an AI model into a fixed schema, validated, cached per registrable domain, and include a confidence score. - Not offered: SMTP mailbox verification, bulk endpoint, person-level data. ## Docs - [API reference](https://pingutil.com/api): request flags, every response field, errors and limits - [OpenAPI spec](https://pingutil.com/openapi.json): machine-readable OpenAPI 3 description - [Quickstart](https://pingutil.com/blog/domain-lookup-api-quickstart): curl, JavaScript, Python and Go examples - [About](https://pingutil.com/about): data sources, what is stored, limits ## Categories - [Disposable email domains](https://pingutil.com/category/disposable) - [Free webmail domains](https://pingutil.com/category/free) - [ISP email domains](https://pingutil.com/category/isp) - [Educational email domains](https://pingutil.com/category/educational) - [Government email domains](https://pingutil.com/category/government) ## Disposable email - [Card testing and fake accounts: where email signals help and where they don't](https://pingutil.com/blog/card-testing-fake-accounts-email-signals): Card testing is stopped mainly by payment-side controls: rate limits, CAPTCHA, Radar-style rules and 3DS. Email signals help with the fake accounts around it. - [Keeping fake and internal signups out of product analytics](https://pingutil.com/blog/exclude-fake-signups-from-analytics): Tag every signup as real, suspect, fake or internal when the account is created, then filter on that tag in PostHog, Mixpanel, Amplitude or plain SQL. - [How to check if an email address is disposable (with and without code)](https://pingutil.com/blog/check-if-email-is-disposable): Check if an email is disposable by hand (public blocklist, MX lookup, a quick search) or in code with a list or an API. Includes a short checklist. - [Domain age as a signup risk signal](https://pingutil.com/blog/domain-age-signup-risk): How to check a signup domain's registration age with RDAP, when a young domain means risk, the innocent cases, and how to combine it with a domain lookup. - [Free tools for detecting disposable email addresses](https://pingutil.com/blog/free-disposable-email-detection-tools): Free disposable email detection tools by type: open lists, libraries, keyless endpoints, free APIs and web checkers, with list sizes and the trade-offs of each. - [Should you block disposable emails or just flag them?](https://pingutil.com/blog/block-or-flag-disposable-emails): A decision framework for disposable email at signup: which surfaces deserve a hard block, when to flag instead, and what a flag should do to the account. - [Disposable email checker APIs: open lists vs paid services](https://pingutil.com/blog/disposable-email-checker-api-options): Open blocklists, free hosted endpoints, paid verification APIs and domain intelligence APIs compared on cost, latency, freshness and failure modes. - [Referral and promo-code abuse: the email signals that help](https://pingutil.com/blog/referral-and-promo-abuse-email-signals): Referral abuse is one person posing as many. The email signals that link those fake referees together, with code that scores a referrer before you pay out. - [Detecting machine-generated email addresses](https://pingutil.com/blog/detect-random-email-addresses): How to spot bot-made addresses like xk7qmz2p@gmail.com from the local part alone: the features that work, a runnable scorer, and where it flags real people. - [Apple Hide My Email, Firefox Relay and SimpleLogin are not disposable email](https://pingutil.com/blog/email-relay-services-vs-disposable): Relay addresses look random but forward to a real, long-lived inbox. Why they differ from disposable email, why filters misfire on them, and how to allow them. - [Fake signups: where they come from and how to filter them](https://pingutil.com/blog/fake-signups-saas): Fake SaaS signups come from five different sources, and each needs a different filter. How to tell which one you have, and what to put in front of each. - [Stopping free-trial abuse without punishing real users](https://pingutil.com/blog/stop-free-trial-abuse): A practical playbook for SaaS founders: screen signup emails, dedupe identities and gate trial value in steps, so abusers stall and real users never notice. - [Why disposable email blocklists go stale, and how to keep yours fresh](https://pingutil.com/blog/disposable-email-blocklists-go-stale): The open disposable domain list doubled in a year. Why vendored copies decay, how lists also gather bad entries, and a safe update process with code. - [Block disposable emails in Python (Django and FastAPI)](https://pingutil.com/blog/block-disposable-emails-python): Block disposable email signups in Django and FastAPI with one shared validator, the PyPI blocklist package, offline PSL matching and a fail-open API option. - [Block disposable emails in Node.js and Express](https://pingutil.com/blog/block-disposable-emails-nodejs): Express 5 middleware that blocks disposable email signups using a self-refreshing open blocklist or a single API call, with tests and fail-open handling. - [How to detect disposable email addresses at signup](https://pingutil.com/blog/how-to-detect-disposable-email-addresses): Four layered checks that catch disposable email at signup: domain normalization, an updating blocklist, MX fingerprinting and DNS signals, with working code. - [What is a disposable email address, and should you block it?](https://pingutil.com/blog/what-is-a-disposable-email-address): What disposable email addresses are, how services like Mailinator work, who uses them, and a simple rule for deciding whether your product should block them. ## Business email - [Personalizing onboarding from the signup email domain](https://pingutil.com/blog/personalize-onboarding-from-email-domain): Branch onboarding on the signup email domain: team setup for company addresses, a solo flow for Gmail, an education plan for .edu. Code, UX copy and privacy rules. - [Is a Gmail address a business email?](https://pingutil.com/blog/is-gmail-a-business-email): No: @gmail.com is free personal webmail, even when a business uses it. Google Workspace on a custom domain is business. How to tell them apart in code. - [Email and domain intelligence glossary](https://pingutil.com/blog/email-domain-intelligence-glossary): Plain definitions of 40 email and domain intelligence terms, from catch-all and null MX to eTLD+1, RDAP, SPF and DMARC, with links to deeper guides. - [Detecting government email domains in every country](https://pingutil.com/blog/government-email-domains): A country-by-country guide to government email domains: what .gov, gov.uk and gouv.fr rules catch, what they miss (gc.ca, bund.de, go.jp), with detection code. - [Verifying student and academic email addresses worldwide](https://pingutil.com/blog/verify-student-email-address): How to check if an email belongs to a university or school: TLD rules that work, the countries they miss, a university domain list, and a verification flow. - [ISP email domains: why comcast.net is not a company](https://pingutil.com/blog/isp-email-domains): comcast.net, btinternet.com and orange.fr are consumer ISP mailboxes. Why they break lead enrichment and routing, which domains to list, and how to treat them. - [Role-based email addresses (info@, sales@): what to do with them](https://pingutil.com/blog/role-based-email-addresses): Role-based addresses like info@ and support@ are shared inboxes, not people. When to accept, flag or reject them, and how to detect them without false hits. - [How to find the company behind an email address](https://pingutil.com/blog/find-company-from-email-address): Turn an email address into a company name: normalize the domain, discard webmail and ISP domains, then resolve the rest from its website or an enrichment API. - [Should your B2B signup form require a work email?](https://pingutil.com/blog/require-work-email-b2b-signup): When a work-email-only signup helps a B2B funnel, when it quietly costs you customers, and how to ask for a work email without rejecting anyone. - [Free email provider domains: the list that actually matters](https://pingutil.com/blog/free-email-provider-domains): The webmail domains worth listing, grouped by provider and region, why 30,000-domain lists answer a different question, and how to tune a list to your users. - [How to tell a business email from a personal one in code](https://pingutil.com/blog/business-email-vs-personal-email): Classify an email as business or personal: reduce to the registrable domain, check provider lists, then use MX records to catch personal custom domains. ## Company enrichment - [Free domain intelligence API: what you can get without paying](https://pingutil.com/blog/free-domain-intelligence-api): What a free domain intelligence API should return, exactly what pingutil gives for free (fields and rate limits), what it doesn't do, and how free tiers compare. - [A B2B lead scoring model built from email and company data](https://pingutil.com/blog/b2b-lead-scoring-email-domain): A transparent points-based lead scoring model from email category, company size, industry and email signals, with starting weights and a calibration method. - [Filtering fake leads from website forms with a webhook](https://pingutil.com/blog/filter-fake-form-leads-webhook): Put a small webhook between Tally or Typeform and your CRM: verify the signature, classify the submitter's email, and route real leads to the CRM and junk to review. - [LLM lead qualification: where a lookup API beats the model](https://pingutil.com/blog/llm-lead-qualification-deterministic-data): Which lead qualification steps an LLM is good at, which ones a deterministic lookup should own, and a pipeline that puts each in the right place. - [Spotting multiple signups from the same company](https://pingutil.com/blog/detect-teammates-same-company): Detect teammates who sign up separately: group signups by registrable domain, skip webmail and schools, then send a team invite or a sales alert. - [eTLD+1 explained: why mail.stripe.com is stripe.com](https://pingutil.com/blog/etld-plus-one-explained): What eTLD+1 means, how the Public Suffix List defines it, why splitting on dots breaks on bbc.co.uk, and how to compute it in JavaScript, Python and Go. - [Caching domain lookups: keys, TTLs and when to refresh](https://pingutil.com/blog/caching-domain-lookups): How to cache email and domain lookup results: what to key on, which fields can share a cache entry, TTLs per data type, stale-on-error, and when to force a refresh. - [How accurate is LLM-based company enrichment?](https://pingutil.com/blog/llm-company-enrichment-accuracy): Where AI company enrichment is reliable, where it fails (invented funding, stale HQs, the wrong company), and the guardrails that make it safe to use. - [Free domain lookup tools: WHOIS, DNS, classification and company data](https://pingutil.com/blog/free-domain-lookup-tools): Free domain lookup tools grouped by the question they answer: registration (RDAP, WHOIS), DNS, domain type and company data, with commands you can run now. - [CRM data hygiene: cleaning contacts by email domain](https://pingutil.com/blog/crm-data-hygiene-email-domains): Clean up a CRM by email domain: normalize company domains, merge duplicate accounts, separate personal and disposable contacts, and keep it clean. - [Routing inbound leads by company size and industry](https://pingutil.com/blog/route-leads-by-company-size): Build lead routing rules on enriched company size, industry and country: segment buckets, an ordered rule table, confidence gates and a triage queue for unknowns. - [Enriching inbound leads from nothing but an email domain](https://pingutil.com/blog/enrich-leads-from-email-domain): Design a lead enrichment step that starts from a work email: gate by domain type, enrich async, record provenance, never overwrite human input. - [Clearbit alternatives after the HubSpot acquisition](https://pingutil.com/blog/clearbit-alternatives): What changed at Clearbit after HubSpot bought it, which features are gone, and a replacement for each one: logos, enrichment, form shortening and signup screening. - [Free company enrichment APIs: what you actually get](https://pingutil.com/blog/free-company-enrichment-api): Free company enrichment comes in three forms: capped tiers of paid databases, LLM-generated profiles, and DIY scraping. What each returns, and how to test them. - [What is domain intelligence? A practical definition](https://pingutil.com/blog/what-is-domain-intelligence): Domain intelligence is everything you can learn about a domain name: what kind of domain it is, whether it works, who registered it and which company is behind it. ## Email validation - [Cleaning a newsletter list before you hit send](https://pingutil.com/blog/newsletter-list-cleaning): What to remove from a newsletter list before a send: disposable and dead domains, provider typos, system addresses and sometimes role addresses. With a script. - [Building a simple email risk score from free signals](https://pingutil.com/blog/email-risk-score-free-signals): A practical email risk score for signups: which free signals to use, hard rules vs points, score bands, and how to calibrate it against your own abuse data. - [Signup domains with no website: what it tells you](https://pingutil.com/blog/domains-without-websites): A signup domain that receives mail but has no website is a useful fraud signal, not a verdict. What DNS shows, the innocent cases, and how to score it. - [Catch-all email domains and what they mean for validation](https://pingutil.com/blog/catch-all-email-domains): A catch-all domain accepts mail for any address, so verifiers can't confirm a mailbox. How detection works, why it's common in B2B, and how to treat it. - [Gmail dots, plus addressing and duplicate accounts](https://pingutil.com/blog/email-normalization-gmail-dots-plus): Why jane.doe+trial2@gmail.com and janedoe@googlemail.com are one inbox, and how to build a canonical email key that catches duplicates without breaking login. - [SMTP mailbox verification: why it's unreliable](https://pingutil.com/blog/smtp-email-verification-limits): What an SMTP mailbox probe really tests, the six ways its answers mislead you (VRFY, catch-all, greylisting, port 25 blocks), and what to use instead. - [Internationalized email domains: punycode and normalization](https://pingutil.com/blog/idn-punycode-email-domains): Handle addresses like jane@bücher.de: convert the domain to punycode with UTS 46, leave the local part alone, and avoid the traps that split one domain in two. - [DNS-over-HTTPS for domain checks in serverless code](https://pingutil.com/blog/dns-over-https-domain-checks): Run MX, A and AAAA lookups from edge functions and serverless runtimes with the Cloudflare and Google DoH JSON APIs: request format, status codes and gotchas. - [Checking MX records to see if a domain can receive email](https://pingutil.com/blog/check-mx-records-email-domain): How to tell from DNS whether a domain accepts mail: MX lookups, the implicit MX fallback, null MX, and which DNS errors should never block a signup. - [Why an email regex is never enough](https://pingutil.com/blog/email-regex-is-not-enough): A regex can only tell you an email address is shaped right. What to match, what to deliberately reject, and the checks a pattern can never replace. - [Email validation vs verification: what each one catches](https://pingutil.com/blog/email-validation-vs-verification): Validation checks that an address could work. Verification proves someone receives mail there. What each layer catches, misses, and where it belongs. - [What SPF and DMARC records tell you about a signup domain](https://pingutil.com/blog/spf-dmarc-domain-legitimacy): SPF and DMARC show whether a domain's owner set up outbound mail authentication. How to look them up over DNS, what they prove, and what they don't. - [RDAP vs WHOIS: looking up domain registration data](https://pingutil.com/blog/rdap-vs-whois-domain-lookup): RDAP replaced WHOIS for generic TLDs in 2025. How the two protocols differ, how to query RDAP in code, and where you still need WHOIS for country-code domains. - [Email verification services vs domain classification APIs: which do you need?](https://pingutil.com/blog/email-verification-vs-domain-classification): Verification services check if a mailbox will accept mail. Classification APIs tell you what kind of address it is. Which job needs which, and when to use both. - [Free email validation APIs compared (and what "free" really includes)](https://pingutil.com/blog/best-free-email-validation-apis): Free tiers of ZeroBounce, Abstract, Hunter, MailboxValidator, Emailable, Kickbox and pingutil compared: quotas, resets, SMTP checks and where each fits. ## Tutorials - [Real-time email feedback in a React signup form](https://pingutil.com/blog/react-signup-form-email-feedback): Check signup emails on blur in React 19: catch typos, disposable domains and role addresses with clear messages, a backend proxy and no blocking on failures. - [Classifying new signups with n8n](https://pingutil.com/blog/n8n-signup-classification-workflow): Build an n8n workflow that classifies each new signup's email as company, webmail, disposable or role-based and routes it, plus a deduped nightly batch. - [Enriching HubSpot contacts with a workflow webhook](https://pingutil.com/blog/hubspot-contact-enrichment-webhook): Use a HubSpot workflow's Send a webhook action to classify each new contact's email domain and write category, spam verdict and company fields to the record. - [Cleaning an email list from a CSV with a short script](https://pingutil.com/blog/clean-email-list-csv-script): A dependency-free Python script that dedupes a CSV of emails, classifies each domain, drops disposable and invalid addresses, and respects API rate limits. - [Classifying a list of emails in Google Sheets](https://pingutil.com/blog/google-sheets-email-domain-lookup): An Apps Script that tags every email in a Google Sheet as company, free, disposable, ISP or education, with throttling, domain dedupe and a safely stored key. - [Checking emails in an Auth0 pre-user-registration Action](https://pingutil.com/blog/auth0-pre-registration-email-check): Reject disposable and machine-generated signup emails in an Auth0 pre-user-registration Action, with secrets, a timeout, 429 backoff and fail-open logic. - [Blocking disposable emails in Supabase Auth](https://pingutil.com/blog/supabase-auth-block-disposable-emails): Use Supabase's Before User Created hook and an Edge Function to reject disposable and machine-generated emails at signup, with timeouts and fail-open handling. - [Email validation at the edge with Cloudflare Workers](https://pingutil.com/blog/cloudflare-workers-email-validation): Screen signup emails in a Cloudflare Worker before they reach your origin: secrets, timeouts, 429 backoff and fail-open forwarding, with complete code. - [Validating signup emails in a Next.js server action](https://pingutil.com/blog/nextjs-signup-email-validation): Check signup emails for disposable and machine-generated addresses inside a Next.js server action, with timeouts, 429 backoff and a clear fail-open policy. - [Checking emails in the Auth.js (NextAuth) signIn callback](https://pingutil.com/blog/authjs-signin-callback-email-check): Use the Auth.js v5 signIn callback to block disposable and machine-generated emails for magic-link and OAuth sign-ins, with caching and fail-open handling. - [Domain lookup API quickstart: curl, JavaScript, Python, Go](https://pingutil.com/blog/domain-lookup-api-quickstart): Call the pingutil domain lookup API from curl, JavaScript, Python and Go, with timeouts, 429 handling and the fields you should actually read. - [Blocking disposable emails with Firebase Auth blocking functions](https://pingutil.com/blog/firebase-auth-block-disposable-emails): Reject disposable and machine-generated emails in Firebase Auth with a beforeUserCreated blocking function: setup requirements, full code, timeouts and fail-open. - [Email domain checks in Go](https://pingutil.com/blog/go-email-domain-validation): A Go signup check with net/http, context timeouts, typed structs, an ICANN-only eTLD+1 helper built on x/net/publicsuffix, a TTL cache and fail-open 429 handling. - [Validating email domains in Ruby on Rails](https://pingutil.com/blog/rails-email-domain-validation): A Rails EachValidator that rejects disposable, machine-generated and optional free webmail emails, with Net::HTTP timeouts, Rails.cache and fail-open logic. - [Laravel validation rule for disposable and personal emails](https://pingutil.com/blog/laravel-disposable-email-validation): A Laravel ValidationRule that rejects disposable, machine-generated and (optionally) free webmail addresses, using the Http facade with timeouts, retry and caching. - [Stopping fake WordPress registrations with an email check](https://pingutil.com/blog/wordpress-block-fake-registrations): Block disposable and machine-generated emails at WordPress and WooCommerce registration with the registration_errors filter, a short timeout and fail-open logic. - [Giving an AI agent an email and domain lookup tool](https://pingutil.com/blog/ai-agent-email-lookup-tool): Tool definitions for Anthropic tool use, OpenAI function calling and MCP that let an LLM agent classify emails and domains with a real API, key kept server-side. ## Optional - [Full text of the docs and every article](https://pingutil.com/llms-full.txt) - [Company lookups for 100 SaaS domains](https://pingutil.com/saas)