Disposable Email Checker: How to Detect Throwaway Email Addresses

A disposable email checker tells you whether an address comes from a temporary inbox service, the kind people use once and then abandon. To check if an email is disposable, paste it into our free email verifier and read the "Temporary Email" row. It works as a disposable email detector and temporary email checker, with no signup.

This guide covers both jobs: checking a single address right now, and blocking disposable addresses automatically at signup with the API. It also explains what the result means and where a list-based check can miss.

Short answer

1. Paste the address into the free checker at /email-verifier. You get 5 free validations per hour, no account needed.
2. Read the "Temporary Email" row and the score. "yes" means the domain is on our disposable list, and the address gets a low score.
3. For signups, call the API (POST /email/validate) and reject the address when the result's description array contains disposable.

Check if an email is disposable right now

The free email verifier runs the full validation on one address, including disposable email detection.

1. Open /email-verifier and enter the address.
2. Click Verify and complete the quick captcha.
3. Read the result panel. It lists Syntax, Domain, Mailbox, Temporary Email, Catch-All and Spam trap detection, followed by a score out of 10.

The Temporary Email row shows "yes" when the address was flagged as disposable and "no" when it wasn't. A flagged address shows a low score in red. The disposable check looks at the domain, not at whether the mailbox exists; the Mailbox row covers that.

You can run 5 free validations per hour without signing up. In the tool's own words: "Email addresses are validated in real-time and not stored. Validation logs are retained for up to 30 days for debugging purposes."

If you want the broader picture of what makes an address valid (syntax, MX records, mailbox), see our guide on how to check if an email is valid.

What counts as a disposable email address

A disposable email address (also called a throwaway, temporary or burner email address) is an inbox that's meant to be used briefly and then dropped. Well-known examples are Mailinator, Guerrilla Mail, 10 Minute Mail, YOPmail and Temp Mail.

People use them for understandable reasons:

• Privacy: they don't want to give a real address to a site they don't trust yet.
• Avoiding spam: they want the download or the coupon, not the newsletter that follows.
• Gaming free trials: a fresh address per signup means a fresh trial each time.

For you as the sender, the problem is the same in every case. The address may stop being read soon after signup, so your onboarding emails, receipts and password resets go nowhere, and the contact still sits on your list.

A throwaway email checker can't read anyone's intent. What it can do is recognize the domain. That's why most tools, ours included, work as a disposable email domain checker: they look at the part after the @ and compare it with a list of domains known to belong to disposable services.

How disposable email detection works in CampaignKit

Our check compares the domain of the address with lists of known disposable email services, which are kept up to date.

When the domain matches, you see it in three places:

• the Temporary Email row in the free verifier shows "yes",
• the score is low and shown in red,
• the API result's description array contains disposable.

The disposable check is part of the full validation, not a separate tool. That's why a single request tells you both "is this a burner?" and "will mail to it even arrive?"

Should you block or flag disposable signups?

There's no single right answer. It depends on what the address is for:

• Block when you need a real contact address, as with a SaaS trial signup. Show a clear message and ask for a permanent address.
• Flag and tag when the signup is low stakes, such as a content download or a newsletter. Accept the address, tag the record as disposable in your CRM, and use double opt-in as the backstop: an inbox nobody reads never confirms.

Keep in mind that some people use disposable addresses for privacy, not to abuse a trial, so blocking also turns away some genuine interest. For more on choosing per form, see our guide to real-time email validation at the point of capture.

Block disposable signups automatically (API)

Checking by hand doesn't scale to a signup form. The disposable email checker API is the POST /email/validate endpoint, which runs the full validation, including the disposable check. Send the address at signup and reject it when the disposable flag is set.

You need an API key. Create a free account (200 free validations, no credit card) and add a key under Profile, in the API Keys section. Each validation uses 1 credit.

The request

curl --request POST \
  --url 'https://api.campaignkit.cc/v1/email/validate' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{ "emails": ["jane@mailinator.com"] }'

For this Mailinator address, the response looks like this. Mailinator accepts mail for any address, so the result also carries the catch-all flag:

{
  "creditsUsed": 1,
  "results": [
    {
      "email": "jane@mailinator.com",
      "result": {
        "syntax": "pass",
        "mx": "pass",
        "mailbox": "pass",
        "score": 1,
        "description": ["catchAll", "disposable"],
        "classifier": "risky",
        "smtpResponse": ""
      }
    }
  ]
}

The score and the other entries in description can differ from address to address. The disposable entry is what tells you the domain was matched, so check for that instead of a score threshold.

A signup check in Node.js

This script works in Node.js 18 or later (it uses the built-in fetch). Save it as check-disposable.mjs:

// check-disposable.mjs
// Usage: CAMPAIGNKIT_API_KEY=your_key node check-disposable.mjs someone@example.com

const API_URL = "https://api.campaignkit.cc/v1/email/validate";

export async function checkSignupEmail(email) {
  const response = await fetch(API_URL, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.CAMPAIGNKIT_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ emails: [email] }),
    // Don't keep a signup form waiting on a slow check.
    signal: AbortSignal.timeout(5000),
  });

  if (!response.ok) {
    // 400 = bad request, 402 = out of credits, and so on.
    throw new Error(`CampaignKit API returned ${response.status}`);
  }

  const { results = [] } = await response.json();
  const result = results[0]?.result;
  const description = result?.description || [];

  if (description.includes("disposable")) {
    return { allow: false, reason: "disposable" };
  }
  // A blacklisted local part is reported instead of the disposable flag,
  // and "invalid" means mail to the address will bounce.
  if (description.includes("blacklist") || result?.classifier === "invalid") {
    return { allow: false, reason: result.classifier === "invalid" ? "invalid" : "blacklist" };
  }
  return { allow: true, reason: null };
}

const email = process.argv[2];
if (!email) {
  console.error("Usage: node check-disposable.mjs someone@example.com");
  process.exit(1);
}

try {
  const decision = await checkSignupEmail(email);
  console.log(JSON.stringify(decision));
} catch (err) {
  // Fail open: if the check can't run, let the signup through.
  console.error(`Validation failed: ${err.message}`);
  console.log(JSON.stringify({ allow: true, reason: "check_failed" }));
}

In your app, import checkSignupEmail into the signup handler (and drop the command-line part at the bottom). When allow is false with reason disposable, show a message such as "Please use a permanent email address," rather than failing silently.

The script fails open: if the API is unreachable, times out or returns an error, the signup goes through. That keeps an outage from locking out real users. If you'd rather fail closed, return { allow: false } in the catch block instead.

Test it

Run the script with a disposable address, then with one you know is real:

CAMPAIGNKIT_API_KEY=your_key node check-disposable.mjs jane@mailinator.com
# {"allow":false,"reason":"disposable"}

CAMPAIGNKIT_API_KEY=your_key node check-disposable.mjs you@yourcompany.com
# {"allow":true,"reason":null}

For a production example, our Auth0 pre-user registration action uses the same disposable check to block signups in Auth0, with a user-facing error message and a 5-second timeout. The full request and response reference is in the email validation API docs.

Troubleshooting and limitations

Can a disposable email checker miss a new domain or flag a real one? Yes, both can happen with any list-based check, including ours. Here's where and what to do about it.

A brand-new disposable domain isn't flagged. New disposable domains keep appearing, and a new one can take a while to be listed. If signups from a domain you suspect keep getting through, a confirmation email before activation catches addresses nobody reads.

A custom or self-hosted domain is used like a burner. Detection is domain-based. Someone who runs their own domain and creates throwaway addresses on it looks like any other private domain, so it won't get the disposable flag.

A real user's domain is flagged. If a domain ends up on a disposable list, every address on it gets the flag, whoever uses it. If a legitimate user reports this, you can allow that domain in your own signup code.

Subdomains may not be flagged. An address on a subdomain of a listed domain may not get the disposable flag.

The flag is missing even though the domain is disposable. A few results don't carry the disposable flag:

• If the domain doesn't exist or has no MX record, the result is invalid with domain in description. Mail to it bounces anyway.
• If the mailbox check fails, the result is invalid with mailbox.
• If the local part (before the @) is blacklisted, you get blacklist instead of disposable.

The Node.js example above blocks all three.

Catch-all is not the same as disposable. A catch-all domain accepts mail for any address, so the mailbox can't be confirmed. That's a separate check with its own flag, and plenty of catch-all domains belong to ordinary companies. Don't treat a catch-all result as a burner.

Disposable email checker FAQ

How do I check if an email is disposable?

Paste the address into the free email verifier and read the "Temporary Email" row: "yes" means it's disposable. You can check 5 addresses per hour without an account.

Is the disposable email checker free?

Yes. The verifier gives you 5 free validations per hour. For the API, you get 200 free validations when you sign up, and each validation after that uses 1 credit.

Does checking send an email to the address?

No. No email is sent to the address, so the person you're checking doesn't see anything.

What's the difference between a disposable email detector and email verification?

The disposable check is one of several checks in a full email verification. Passing it only means the domain isn't a known disposable service; it doesn't prove the mailbox exists. Our guide on how to check if an email is valid covers the other checks.

Next step

To check an address right now, use the free disposable email checker in our email verifier. There's no signup, and you get 5 free validations per hour.

To block disposable signups automatically, start with 200 free validations, no credit card required. After that, credits start at $6 for 2,500 emails and never expire. Disposable email detection is included on every plan.