Disposable-email blocking

Extract the domain, check it against a list of throwaway mail providers, refuse or flag on a match. Free public lists exist; commercial providers maintain private ones and that maintenance is the product you are paying for.

It is usually bundled with deliverability checking, which is where most people encounter it — a single API call returning disposable: true alongside deliverable: true.

The laziest fake addresses, and — more usefully — a genuine category of abuse that is not spam at all: free-trial cycling and gated-content leeching. If your problem is one person taking a hundred trials, this is the correct tool and it works.

As a lead-quality signal it is also fair on its own terms. Somebody who reaches for a ten-minute mailbox to download your report has told you something true about their intent, and routing that submission differently is reasonable.

By registering a domain. Throwaway providers rotate through thousands of them, deliberately and continuously, and any list is describing the ones that were noticed. The gap between “new disposable domain in service” and “new disposable domain on your list” is where every determined abuser lives.

And the cost of trying to close that gap is the reason this method needs a warning label rather than a recommendation. Privacy relays — Apple’s Hide My Email, Firefox Relay, DuckDuckGo, SimpleLogin — produce addresses at unfamiliar domains that forward to a real, permanent mailbox. To a naive blocklist they look exactly like a disposable. To your business they are a customer who reads their mail.

The aggressive cousin of this rule is worse still. Blocking free-mail domains on a B2B form — refusing gmail.com because “real businesses have a domain” — rejects founders, consultants, contractors, and anyone whose company email is forwarded to Gmail anyway. That is a substantial fraction of the SMB market, refused at the door by a policy someone wrote in 2014.

Use a maintained list, not a GitHub gist that was last updated in 2021. Then choose your behaviour carefully:

• Flag, do not reject. A disposable address on a submission is a routing decision, not a verdict. Send it somewhere, score it lower, and keep it.
• Allow relays explicitly. Apple, Firefox, DuckDuckGo and SimpleLogin domains belong on an allowlist that overrides the block.
• Never block free mail on a form aimed at SMBs or founders.
• Reject outright only on the trial-abuse case, where the person is claiming something free and repeatable rather than asking to be contacted.

And be honest about the ceiling. This filters a category of address, not a category of person. It has nothing to say about the polished, deliverable, corporate-domain submission that wastes an SDR’s week — see lead scoring for why the usual answer to that one does not work either.