Disposable Email Checker

Check its domain in three steps: is it a known provider or relay, is it on a disposable list, and where does its mail go. The part before the @ tells you nothing; the domain after it tells you almost everything.

The lists come first because they're fast: we use the CC0 list and fakefilter together, 13,337 domains, and match the domain and every parent above its public suffix, so x.yopmail.com matches yopmail.com and a name under one of the CC0 list's own 12 extra suffixes isn't cut too short. A provider or relay on our own reviewed allowlist (130 names) is never called disposable; two public allowlists (2,796 and 352 names) count only when no list and no fingerprint says otherwise.

Then the mail servers: the domain's MX, or its own address when it has no MX, compared with our 31 fingerprints of the servers throwaway services provably run. That's how the checker names a service for a domain registered yesterday. A domain that can't receive mail at all is said first, before any list.

The registration date is shown as context, never as a verdict: half the throwaway domains we dated were more than 334 days old, and 2 were over ten years old.

No. gmail.com, outlook.com, hotmail.com and yahoo.com are free mailbox providers: each address belongs to one account, and their mail goes to Google's, Microsoft's and Yahoo's own servers. None of the lists we use carries them, and a checker that calls them disposable is wrong.

Some sites still refuse them as policy, which is a different thing: in June 2024 PyPI stopped accepting new outlook.com and hotmail.com addresses because bot farms used them. That's a site's rule against abuse, not a disposable label.

And some throwaway sites hand out real Gmail and Outlook.com addresses (aliases of accounts they hold). No list or mail-server check can catch those without calling Gmail disposable, so we don't.

On the service's own mail servers: every YOPmail domain, however new, delivers to the same YOPmail address, and the same holds for most services. In our sample these fingerprints caught 634 of 659 fresh throwaway domains (96 %), 89 of the 91 the day's CC0 list missed, and none of 73 legitimate domains.

A fingerprint is only a single address or a host name under the service's own domain, proved by the service itself: its own MX, its reverse name or the MX target it documents. Each is re-checked every month, and one not confirmed within 60 days stops counting.

Shared platforms are never fingerprints. Cloudflare Email Routing, Google, Microsoft and the forwarding services carry throwaway domains and ordinary ones alike, so mail going there says nothing either way.

Block the clearly disposable ones, but don't stop there: confirm every address by email, and never refuse a privacy relay or a free provider for being one. OWASP lists bulk sign-ups as a named threat (OAT-019), and PyPI calls blocking throwaway domains one of its most effective defences.

A blocked real person costs more than a fake sign-up you could have caught another way. Relay users chose privacy, not a throwaway inbox, and Mozilla and SimpleLogin both note that some sites wrongly refuse them. A public throwaway inbox also hurts its own user: anyone can reset the password of an account made with it.

Gmail, Yahoo and M3AAWG all ask senders to confirm each address before mailing it, which keeps out typos, forged sign-ups and most bots, whatever the domain.