Disposable email statistics: 100 servers carry 65% of throwaway domains that take mail

Throwaway email runs on very few mail servers. Of 46,092 throwaway domains with a recorded mail server, 29,858, or 64.8 percent, use one of just 100 servers (FFraud data, measured November 3, 2026). Two in three domains added in October share a server with older throwaway domains. That makes the mail server a strong signal for spotting a new one.

This page shows how concentrated the servers are, what surprised us, and how to use the mail server to catch a throwaway domain that no list has named yet. The method comes at the end, and the list behind it is free to download.

#How concentrated is throwaway email?

A domain names its mail servers in MX records, each one "a host willing to act as a mail exchange" for the domain (RFC 1035). For throwaway email, a handful of hosts carry most of the load. The busiest receives mail for 3,686 throwaway domains, 8.0 percent of all 46,092. The 25 busiest reach 43.2 percent, and the 1,000 busiest reach 77.4 percent.

1. Top 18.0%
2. Top 517.6%
3. Top 1026.0%
4. Top 2543.2%
5. Top 5056.1%
6. Top 10064.8%
7. Top 25071.7%
8. Top 1,00077.4%

Source: FFraud disposable email data, measured November 3, 2026

Most servers serve a single domain: 11,410 of the 12,507 do, and just 79 serve 100 or more. The IP addresses behind them are just as few. The 100 busiest receive mail for 33,621 of the domains, or 72.9 percent.

The busiest single address receives mail for 3,742 domains, more than any one server name. So several server names lead to that one address.

#Which mail servers carry the most?

1. aero4.unstablemail.com3,686
2. srv4.unstablemail.com3,683
3. generator.email2,434
4. mail.wabblywabble.com1,991
5. mail.wallywatts.com1,991
6. smtp.yopmail.com1,340
7. mx4.beavis99.com1,256
8. mx4.beavis99.net1,255
9. publicms1.mail2world.com1,255
10. publicms2.mail2world.com1,255

Source: FFraud disposable email data, measured November 3, 2026

Eight of the ten form four pairs, and each pair shares its domains. All 3,683 domains on srv4.unstablemail.com also name aero4.unstablemail.com. Two servers under different names, mail.wabblywabble.com and mail.wallywatts.com, serve the very same 1,991 domains.

YOPmail, which counts itself among disposable email services, receives mail for 1,340 listed domains through smtp.yopmail.com.

#What surprised us: three in four listed domains publish no mail server

FFraud checked all 228,897 domains on its list between August 23 and November 3, 2026. At the last check, only 56,504 of them, 24.7 percent, published mail servers. The other 172,393 published none. On a domain list, they look the same as the domains that do take mail.

A domain without mail servers can still receive mail. RFC 5321 then sends it to the domain's own address, when "an empty list of MXs is returned". RFC 7505 lets a domain announce "that it accepts no mail" at all.

A domain with neither mail servers nor an address cannot receive a confirmation email. FFraud's email check marks an address on such a domain invalid.

#Do new throwaway domains reuse old mail servers?

Most do. FFraud added 3,532 domains to its list in October 2026, and 2,700 of them have a recorded mail server. For 1,833 of those, 67.9 percent, the same server also receives mail for older throwaway domains, ones added to the list at least a day earlier. For 1,430, or 53.0 percent, it serves 100 or more of them.

1. Added in October3,532
2. Mail server on record2,700
3. Server serves older ones1,833
4. Server serves 10+ older ones1,717
5. Server serves 100+ older ones1,430

Source: FFraud disposable email data, measured November 3, 2026

So the mail server alone points to two in three new throwaway domains. No list has to name them first.

#How to detect a disposable email address by its mail server

1. Read the domain's mail servers with dig +short MX example.com, or with the free MX lookup.
2. Compare them with servers known for throwaway mail. The disposable email domains list is free, so you can count the servers yourself.
3. Or send the address to the free email check, which does both in one call. It answers detection_source: mx_host when the domain's mail server also serves many confirmed throwaway domains.
4. Treat a domain that cannot receive mail as invalid. It can never confirm a sign-up.

curl https://api.ffraud.com/public/email/check \
  -H "Content-Type: application/json" \
  -d '{"email":"jane@yopmail.com"}'

The email check documentation lists every value of detection_source. The disposable email checker runs the same check in the browser.

#What it means for someone defending a sign-up form

• Check the mail server as well as the domain name. A fresh throwaway domain often uses an old server.
• Keep the check fresh. FFraud added 3,532 throwaway domains in October alone.
• Ask for a confirmed inbox before you trust an account. A domain that cannot receive mail fails at that step.

OWASP lists this threat as OAT-019, Account Creation: "Create multiple accounts for subsequent misuse". A free inbox that needs no registration lets one person confirm many such accounts. For code, see our guide to blocking disposable email sign-ups. For the basics, read what is a disposable email address.

#How we counted

The list held 228,897 domains on November 3, 2026, 224,746 of them active. FFraud checked every one of them for mail servers between August 23 and November 3, 2026.

Since August 29, it has also recorded which server receives each domain's mail, and at which IP address. That record holds 86,078 links between 46,092 domains, 12,507 servers and 5,401 IP addresses. The server, address and October counts on this page come from it, read on November 3, 2026.

Servers are ranked by how many listed domains they serve, and a share counts each domain once. For the October test, an older domain is one added to the list at least one day earlier.

To reproduce it, download the list from the open data, look up each domain's MX records, and count the domains per server. The list is MIT licensed and rebuilt every 30 minutes.

#Questions people ask