Block disposable emails in Next.js and Express (middleware, no API key)

// Block disposable email addresses in Node.js: FFraud's free API decides, its MIT list in a Set answers when the API cannot.
// No packages. Works in Express and in the Next.js Node.js runtime (the default).
const LIST_URL = "https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt";
const API_URL = "https://api.ffraud.com/public/email/check";
const DAY = 24 * 3600 * 1000;
// Relay services such as Apple's Hide My Email forward to an inbox a real person reads. Set to false to refuse them too.
const ACCEPT_RELAYS = true;
const EMAIL = /^(?!\.)(?!.*\.\.)[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+(?<!\.)@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;

let domains = new Set();
let nextRefresh = 0;
let pending = null;
let firstTry = true;
const types = new Map();

async function download() {
  const res = await fetch(LIST_URL, { signal: AbortSignal.timeout(10000) });
  if (!res.ok) throw new Error(`list download answered ${res.status}`);
  const set = new Set();
  for (const line of (await res.text()).split("\n")) {
    const d = line.trim().replace(/\.$/, "").toLowerCase();
    if (d && !d.startsWith("#")) set.add(d);
  }
  if (set.size < 100000) throw new Error(`only ${set.size} domains in the download`);
  return set;
}

function refreshSoon() {
  if (pending || Date.now() < nextRefresh) return pending;
  pending = download()
    .then((set) => { domains = set; nextRefresh = Date.now() + DAY; })
    .catch((e) => { nextRefresh = Date.now() + 5 * 60 * 1000; console.warn(`disposable list: ${e.message}`); })
    .finally(() => { pending = null; });
  return pending;
}

export async function isListed(domain) {
  const waiting = refreshSoon();
  if (firstTry && waiting) { firstTry = false; await waiting; } // only the first request waits for the download
  const labels = domain.trim().replace(/\.$/, "").toLowerCase().split(".");
  for (let i = 0; i < labels.length - 1; i++) if (domains.has(labels.slice(i).join("."))) return true;
  return false;
}

export function looksLikeEmail(email) {
  const at = email.lastIndexOf("@");
  return email.length <= 254 && at >= 1 && at <= 64 && EMAIL.test(email);
}

// "temp", "alias" or "normal", kept for a day per domain; null when the API cannot answer.
// The type depends on the domain alone, so the API gets user@ and the domain, never the address.
export async function apiType(domain, timeoutMs = 2000) {
  const hit = types.get(domain);
  if (hit && Date.now() < hit.until) return hit.type;
  try {
    const res = await fetch(API_URL, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email: `user@${domain}` }),
      signal: AbortSignal.timeout(timeoutMs),
    });
    if (!res.ok) return null;
    const type = (await res.json()).email_type;
    if (typeof type !== "string") return null;
    types.set(domain, { type, until: Date.now() + DAY });
    return type;
  } catch {
    return null;
  }
}

export async function checkEmail(input, timeoutMs = 2000) {
  const email = String(input ?? "").trim();
  if (!looksLikeEmail(email)) return { accept: false, why: "not an email address" };
  refreshSoon(); // keeps the list current in the background, for the moments the API cannot answer
  const domain = email.slice(email.lastIndexOf("@") + 1).toLowerCase();
  const type = await apiType(domain, timeoutMs);
  if (type === null) {
    // The list cannot tell a relay from a throwaway inbox, so it refuses both.
    if (await isListed(domain)) return { accept: false, why: "disposable domain" };
    return { accept: true, why: "API unavailable, list only" };
  }
  if (type === "temp" || (type === "alias" && !ACCEPT_RELAYS)) return { accept: false, why: "disposable domain" };
  return { accept: true, why: type === "alias" ? "relay address" : "ok" };
}

import { checkEmail } from "./disposable.mjs";

// Use after express.json() or express.urlencoded(): app.post("/signup", express.json(), blockDisposableEmail(), handler)
export function blockDisposableEmail(field = "email") {
  return async (req, res, next) => {
    const verdict = await checkEmail(req.body?.[field]);
    if (!verdict.accept) return res.status(400).json({ error: verdict.why });
    req.emailCheck = verdict;
    next();
  };
}

import { checkEmail } from "../../../lib/disposable.mjs";

export async function POST(request) {
  const { email } = await request.json().catch(() => ({}));
  const verdict = await checkEmail(email);
  if (!verdict.accept) return Response.json({ error: verdict.why }, { status: 400 });
  // create the account here
  return Response.json({ ok: true });
}

"use server";

import { checkEmail } from "../../lib/disposable.mjs";

// For a form with useActionState: the action receives the previous state, then the form data.
export async function signup(prevState, formData) {
  const verdict = await checkEmail(formData.get("email"));
  if (!verdict.accept) return { error: `Please use another email address (${verdict.why}).` };
  // create the account here
  return { ok: true };
}

Node v22.19.0 2026-10-26T00:25:59.183Z
first isListed (downloads the list): true 298 ms
heap grew by about 38.3 MB
isListed("mailinator.com") = true, 0.52 microseconds per call
isListed("gmail.com") = false, 0.50 microseconds per call
isListed("inbox.mailinator.com") = true, 0.45 microseconds per call
checkEmail("test@mailinator.com") -> {"accept":false,"why":"disposable domain"} 350.4 ms, API calls: 1
checkEmail("user@inbox.mailinator.com") -> {"accept":false,"why":"disposable domain"} 304.6 ms, API calls: 1
checkEmail("test@privaterelay.appleid.com") -> {"accept":true,"why":"relay address"} 836.3 ms, API calls: 1
checkEmail(" team@ffraud.com\n") -> {"accept":true,"why":"ok"} 188.3 ms, API calls: 1
checkEmail("team@ffraud.com") -> {"accept":true,"why":"ok"} 0.0 ms, API calls: 0
checkEmail("us..er@ffraud.com") -> {"accept":false,"why":"not an email address"} 0.0 ms, API calls: 0
what the API received: {"email":"user@mailinator.com"} {"email":"user@inbox.mailinator.com"} {"email":"user@privaterelay.appleid.com"} {"email":"user@ffraud.com"}
express test@mailinator.com: {"status":400,"json":{"error":"disposable domain"},"nextCalled":false}
express team@ffraud.com: {"nextCalled":true,"emailCheck":{"accept":true,"why":"ok"}}
express test@privaterelay.appleid.com: {"nextCalled":true,"emailCheck":{"accept":true,"why":"relay address"}}
route POST {"email":"test@mailinator.com"}  -> 400 {"error":"disposable domain"}
route POST {"email":"team@ffraud.com"}      -> 200 {"ok":true}
route POST not json                         -> 400 {"error":"not an email address"}
action signup(test@mailinator.com) -> {"error":"Please use another email address (disposable domain)."}
action signup(team@ffraud.com) -> {"ok":true}
API latency, 20 calls: median 198 ms, min 138 ms, max 594 ms
disposable list: network down
list download fails, test@mailinator.com -> {"accept":false,"why":"disposable domain"}
list download fails, team@ffraud.com -> {"accept":true,"why":"ok"}
API down, test@mailinator.com -> {"accept":false,"why":"disposable domain"}
API down, test@privaterelay.appleid.com -> {"accept":false,"why":"disposable domain"}
API down, team@ffraud.com -> {"accept":true,"why":"API unavailable, list only"}
ACCEPT_RELAYS false, test@privaterelay.appleid.com -> {"accept":false,"why":"disposable domain"}