What is a disposable email address, and should you block it?

A disposable email address is an inbox meant to be thrown away after one use, such as a single signup or download. Free services hand them out on domains built for the purpose, and some keep every inbox public. For a website, the problem is scale, because one person can open many accounts with addresses that lead nowhere. A sound policy blocks known throwaway domains where an account is worth something and allows them elsewhere.

#How does a disposable email address work?

1. A service registers domains and points their mail records, called MX records, at its own servers. Every mail sender looks those records up first (RFC 5321).
2. A visitor opens the service and reads an inbox in the browser. Mailinator, for one, offers free public inboxes that anyone can open by name.
3. The visitor types the address into a signup form and clicks the confirmation link that arrives.
4. The visitor never comes back to that inbox, while the account stays, tied to an address nobody reads.

OWASP lists this pattern as an automated threat of its own, OAT-019 Account Creation: "Create multiple accounts for subsequent misuse." Free trials, promo codes and referral payouts invite it, because each new account can claim them again.

#What do throwaway domains look like?

FFraud's open list held 224,090 throwaway domains on October 23, 2026, spread over 1,083 top-level domains. Most are ordinary .com names, at 37.9 percent. Endings such as .ru, .net, .xyz and .site follow, with a long tail of country codes behind them.

The list also moves. It grew from 207,334 domains on June 30, 2026, when the public repository began, to 224,090 on October 23. Between September 14 and October 14, 3,424 domains were added and none removed. In the first half of September, a cleanup removed 3,237 (FFraud open data, commit history).

#How is a disposable email address detected?

• A domain list. The part after the @ is compared with known throwaway domains. FFraud's list is MIT licensed and rebuilt every 30 minutes (disposable email domains).
• Mail servers. A new throwaway domain can be recognized by the mail servers it uses, on the day it appears and before any list has it.
• An allowlist. Major providers such as Gmail and Outlook sit on a hard allowlist, so they are never marked disposable.
• Removal. A wrongly listed domain can be reported, and once confirmed it is cleared on the next build.

Live answers from FFraud's API on October 23, 2026, at 08:33 UTC show each route at work. The detection source names the route behind each verdict (email API docs).

curl https://api.ffraud.com/public/domain/mailinator.com

#Should you block disposable email addresses?

Decide by what a new account is worth to the person who opens it. Where an account earns money or a free resource, a throwaway address is a cheap way to claim it twice. Where it earns nothing, a block only costs you real people who value their privacy.

Tell a blocked visitor why in one plain sentence, so a real person can switch to a lasting address. Domain checks also miss throwaways on real domains. Gmail delivers [email protected] to the same inbox, so compare addresses without the plus part when you look for repeat signups (Gmail Help).

#What is a disposable address confused with?

Apple's Hide My Email "generates unique, random email addresses that automatically forward to your personal email inbox" (Apple Support). DuckDuckGo's relay lets a user "create unlimited unique private email addresses on the fly". Yahoo Mail even calls its own aliases disposable addresses, and Mail Plus users can try up to 3 free (Yahoo Help).

FFraud's API marks relay domains such as duck.com as disposable, with the detection source alias_provider, because one person can mint an unlimited number of addresses there. A relay still reaches a real person, so treat it as a policy choice. Role addresses such as info@ are flagged separately as is_role_address.

#Questions people ask

To see the verdict for any domain or address, use the free disposable email checker. For signup code, see blocking disposable email at signup.