← All guides

How to block disposable email addresses at signup

Disposable-address detection is the highest-return check on a signup form, and also the one most often implemented badly. The naive version — a hardcoded list of a dozen domains — stops nothing, because throwaway providers add domains faster than you will update your array.

  1. 1

    Understand what you are actually detecting

    Throwaway providers operate thousands of rotating domains, not one. Public blocklists currently track around 8,000 of them, and the distribution is not what people expect: about a third sit on .com, which means blocking unusual TLDs is not a substitute for a real list. Our Trust Index publishes the current breakdown.

  2. 2

    Do not write the regex

    Every team tries `/mailinator|guerrilla|10minute/` first. It fails on day one, because these providers publish hundreds of unrelated-looking domains specifically so that pattern matching does not work. A maintained list is the only approach that keeps working, and it needs updating continuously rather than once.

  3. 3

    Check the address, get the reason

    You want more than a boolean. Whether the domain accepts mail at all, whether the mailbox exists, and whether the handle looks machine-generated are separate facts, and they justify different responses.

    curl "https://www.layercall.com/v1/verify/email?email=someone@example.com" \
  -H "X-Api-Key: YOUR_KEY"
  4. 4

    Decide what a hit actually means for your product

    For a paid product with no free tier, a throwaway address is close to meaningless — nobody pays with a card and then reads their receipts in a temporary inbox. For a free trial, it is the single strongest abuse signal you have. The right response depends on what abuse costs you, which is a decision only you can make.

What this gets wrong

Every check here has a cost in real customers. These are the ones that actually bite — several because we shipped them ourselves.

  • Blocking free providers along with disposable ones. Gmail, Outlook and iCloud are where most of your real customers are. These are completely different categories and conflating them is the most expensive mistake on this page.
  • Treating a role address as fake. admin@ or billing@ at a company domain is a real person doing their job — often the person who approves the invoice.
  • Assuming a role handle on a consumer mailbox is a role account. hello@gmail.com is somebody's personal address, not a shared inbox. We flagged those for weeks before catching it.
  • Blocking rather than challenging on a single signal. A disposable address plus nothing else is thin evidence; ask for a code.

Try it before you integrate

Paste any IP, email, phone or domain into the playground — no signup. Or get a free API key for 1,000 lookups a month, no card.