Disposable email addresses: what they are and how to block them
Throwaway inboxes let people sign up without giving you a real contact. Here is why they matter and how to deal with them sensibly.
Photo by steve_a_johnson on Pixabay
A disposable email address (DEA) is a temporary inbox from a service built to be thrown away. The user picks an address, receives a confirmation email, and never looks at it again. Some last ten minutes, some a few days.
Why people use them
Often for harmless reasons: they don't want newsletters, they don't trust the site yet, or they just want a free download. Sometimes for less harmless ones: claiming a free trial repeatedly, farming referral rewards, or creating fake accounts at scale.
Why they hurt you
- No audience. The inbox is abandoned, so nobody reads your onboarding emails.
- Skewed metrics. Signups look great, activation looks terrible.
- Abuse. Free trials, coupon codes and referral bonuses get exploited.
- Bounces. When a temporary inbox expires, later emails to it bounce.
How detection works
Disposable services use domains, and those domains are catalogued. A verifier keeps a list and checks the address's domain against it. Two things make this harder than it sounds:
- The number of domains is huge. Mailsure's list holds over 120,000 known disposable domains.
- They rotate. Services register new domains constantly, so a list needs regular updating. Some providers are better matched by wildcard rules that cover every subdomain.
No list is complete, which is why detection is a risk signal rather than a guarantee.
Should you block or just flag?
It depends on what you are protecting:
- Free trials, coupons, referral programmes: block. The abuse risk justifies a little friction.
- Newsletters and content downloads: consider allowing but tagging, and excluding the address from long nurture sequences.
- Paid products: block at signup and ask for a real address. A genuine customer will have one.
When you block, say why. "Please use a permanent email address" is clearer than a generic error, and most real users will happily comply.
Doing it with an API
Call the verification endpoint at signup and check the disposable field in the response. Mailsure also lowers the score and marks the address risky, so you can set your own threshold.
For the wider picture on fake signups, read how to stop fake signups on your SaaS.
