Disposable-address detection is the highest-return check on a signup form, and also the one most often implemented badly. The naive version — a hardcoded list of a dozen domains — stops nothing, because throwaway providers add domains faster than you will update your array.
Throwaway providers operate thousands of rotating domains, not one. Public blocklists currently track around 8,000 of them, and the distribution is not what people expect: about a third sit on .com, which means blocking unusual TLDs is not a substitute for a real list. Our Trust Index publishes the current breakdown.
Every team tries `/mailinator|guerrilla|10minute/` first. It fails on day one, because these providers publish hundreds of unrelated-looking domains specifically so that pattern matching does not work. A maintained list is the only approach that keeps working, and it needs updating continuously rather than once.
You want more than a boolean. Whether the domain accepts mail at all, whether the mailbox exists, and whether the handle looks machine-generated are separate facts, and they justify different responses.
curl "https://www.layercall.com/v1/verify/email?email=someone@example.com" \ -H "X-Api-Key: YOUR_KEY"
For a paid product with no free tier, a throwaway address is close to meaningless — nobody pays with a card and then reads their receipts in a temporary inbox. For a free trial, it is the single strongest abuse signal you have. The right response depends on what abuse costs you, which is a decision only you can make.
Every check here has a cost in real customers. These are the ones that actually bite — several because we shipped them ourselves.
Paste any IP, email, phone or domain into the playground — no signup. Or get a free API key for 1,000 lookups a month, no card.