Temporary Email Detector: How to Block Disposable Emails

Open any free-trial signup form and try [email protected]. On many sites, it works.

That address is a temporary email: a public inbox that anyone can open without a password and that is thrown away after a few minutes. People use them to dodge spam, but they are also how bots and trial abusers create dozens of fake accounts.

A temporary email detector stops that at the door. This guide explains how the detection works in plain language, the four methods you can use, and how to block fakes without turning away real customers.

What is a temporary (disposable) email?#

A disposable email address comes from a service whose whole purpose is to be short-lived. Some well-known ones are Mailinator and 10MinuteMail, and thousands of smaller ones exist.

They share a few traits:

• No sign-up needed. You pick any name and read the inbox straight away.
• Public or semi-public inboxes. Anyone who guesses the name can read the mail.
• They disappear. The inbox is wiped after minutes or hours.
• Thousands of domains. New ones appear all the time, which is why a hand-made list goes stale quickly.

Why you might want to block them#

Not every site needs to care. You should care when a fake account costs you something:

• Free-trial abuse. One person creates ten trials with ten throwaway addresses.
• Bounced emails. Your welcome email goes to an inbox that no longer exists, and your sender reputation drops.
• Bad data. Your sales team chases leads that were never real.
• Spam and bot signups. Bots fill forms in bulk, and disposable domains are the cheapest way to do it.
• Wasted resources. Each fake account can use storage, email sends or paid API calls.

If you only run a low-risk newsletter, a lighter approach (flagging, not blocking) is usually enough.

4 ways to detect a temporary email#

You can combine these. Each one catches something the others miss.

1. Check the domain against a disposable-domain list#

This is the core method. You take the domain (the part after @) and look it up in a list of known disposable providers. If it is on the list, the address is temporary.

The catch is maintenance. Thousands of domains exist and new ones keep appearing, so a list you copied once last year will miss many. Use a list that is refreshed automatically, or an API that does it for you.

2. Check that the domain can receive mail#

Some fake addresses use domains that do not exist or have no mail servers. A DNS lookup for MX records shows whether the domain can accept email at all. If there are none, the address cannot be real. Our email validation guide explains this check step by step.

3. Catch typos#

Many "bad" addresses are honest mistakes: gmial.com instead of gmail.com. Suggest the fix ("Did you mean gmail.com?") instead of rejecting. This keeps real users and removes a lot of false alarms.

4. Make the user confirm#

Send a confirmation link and only activate the account after they click it. A throwaway inbox can still receive that link, so this does not stop disposable emails on its own. But combined with the list check, it stops typos, dead addresses and most bulk bots.

Using an API to detect temporary emails#

You can build the list check yourself, but keeping it current is the real work. An API does that part for you.

APIHiver's Disposable Email Detection API works like this:

• It checks addresses against 8,900+ disposable domains, refreshed automatically.
• It has a single check, a batch check (up to 500 addresses in one call), and a classify call that tells you whether a domain is disposable, free webmail (Gmail, Yahoo and similar) or a business domain.
• You subscribe to a plan (the Basic plan is free) and send your key in the X-API-Key header.

Check one address#

curl "https://disposable-email-detector.p.apihiver.com/v1/check?email=x%40mailinator.com" \
  -H "X-API-Key: YOUR_API_KEY"

The response:

{
  "input": "[email protected]",
  "domain": "mailinator.com",
  "disposable": true
}

If disposable is true, the address belongs to a throwaway service.

Use it in a signup handler (Node.js)#

async function isDisposable(email) {
  try {
    const url = `https://disposable-email-detector.p.apihiver.com/v1/check?email=${encodeURIComponent(email)}`;
    const res = await fetch(url, {
      headers: { "X-API-Key": process.env.APIHIVER_KEY },
      signal: AbortSignal.timeout(3000),
    });
    if (!res.ok) return false; // fail open: don't block real users
    const data = await res.json();
    return data.disposable === true;
  } catch {
    return false; // timeout or network error: let them in, confirm by email
  }
}
 
app.post("/signup", async (req, res) => {
  if (await isDisposable(req.body.email)) {
    return res.status(422).json({
      error: "Please use a permanent email address so we can reach you.",
    });
  }
  // ...create the account and send the confirmation link
});

The same in Python#

import os
import requests
 
def is_disposable(email: str) -> bool:
    try:
        r = requests.get(
            "https://disposable-email-detector.p.apihiver.com/v1/check",
            params={"email": email},
            headers={"X-API-Key": os.environ["APIHIVER_KEY"]},
            timeout=3,
        )
        return r.ok and r.json().get("disposable") is True
    except requests.RequestException:
        return False  # fail open

Clean up a list in one call#

To check an existing user list or a CRM export, use the batch endpoint. It accepts up to 500 addresses at once:

curl -X POST "https://disposable-email-detector.p.apihiver.com/v1/check/batch" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"emails": ["[email protected]", "[email protected]"]}'

Plans as listed on 16 October 2026: Basic is free (500 checks a month, 2 requests per second), and paid plans start at ₹299 a month for 10,000 checks a month. See the pricing page for the current plans. You can also try an address live in the playground without writing code.

How to block without losing real customers#

Blocking is easy. Blocking well is harder. These rules keep your conversion rate healthy.

1. Fail open. If the detector times out or errors, let the signup continue and rely on the confirmation email. Never block every new user because a third-party call was slow.
2. Say why. "Please use a permanent email address so we can reach you" is much better than "Invalid email".
3. Do not block privacy-friendly addresses. A Gmail plus address ([email protected]) or a privacy relay address reaches a real person. Treat them as valid.
4. Choose block, flag or allow per case. For a paid trial, block. For a newsletter, flag and move on. For a signup that gives real money away, add more checks.
5. Rate-limit signups. A bot that cycles through hundreds of disposable domains still has to come from somewhere. Limit attempts per IP and per device.
6. Review, do not just reject. Keep a log of flagged signups so you can spot a pattern, or a false positive, early.
7. Send the confirmation link anyway. It remains your safety net for everything the list misses.

Things a temporary email detector cannot do#

Be honest about the limits, so you set the right expectations:

• It cannot catch domains it has never seen. New disposable domains appear constantly, and a detector can only be as current as its list.
• It cannot read the inbox. It tells you the provider type, not whether the person is trustworthy.
• It does not replace verification. A real person can use a real address and still abuse your service. Rate limits and account checks still matter.

If you want to check the whole address (syntax, mail servers, typos and role accounts like info@), pair the detector with a full email validation API, as described in our guide to validating an email address in your app.

Quick checklist#

• The domain is checked against a list that updates automatically
• The check fails open if the service is slow or down
• Users see a clear message and can fix a mistake
• Gmail plus and relay addresses are not blocked
• A confirmation email is still sent
• Signups are rate-limited per IP or device
• You review flagged accounts now and then

Related reading#

• How to Validate an Email Address in Your App: syntax, mail server and typo checks in one place.
• Best Email APIs for Developers: sending email once the address is clean.
• API Design Principles: why a good API keeps working when things go wrong.