Temporary email detection, one call away.
A free, unauthenticated endpoint that tells you whether an address sits on a throwaway mailbox provider. No key to request, no quota to watch, and the entire domain list is downloadable if you would rather not call anything at all.
This address is on a disposable or temporary mailbox provider. It is designed to be abandoned, which makes it a poor basis for an account.
Full history for the domain: mailinator.com
Behind every check
19.8 million
IP addresses profiled
2.4 million
malicious domains tracked
208,000
disposable email domains
1.9 million
networks scored
Counts read live from the engine, not written into the page. The full dataset is published on GitHub under the MIT license and rebuilt every 30 minutes.
The call
One POST, no authentication header, no signup step in front of it. These examples run exactly as they are written.
Check an address
curl -s -X POST https://api.ffraud.com/public/email/check \
-H 'content-type: application/json' \
-d '{"email":"[email protected]"}'The response
{
"email": "[email protected]",
"domain": "mailinator.com",
"is_disposable": true,
"detection_source": "database",
"safe_domain": false,
"valid_format": true,
"is_role_address": false,
"is_known_spammer": false,
"community_blacklisted": false,
"blacklist_reports": 0
}Check a domain on its own
curl -s https://api.ffraud.com/public/domain/mailinator.com
What comes back
is_disposable
The field most integrations act on. True means the domain hands out throwaway mailboxes.
detection_source
How the verdict was reached: database for a confirmed listing, pattern for a heuristic match on a brand-new burner service, safe_domain for an allowlisted major provider. Worth reading, because a pattern match deserves less confidence than a confirmed listing.
safe_domain
True for the major mailbox providers, which can never be flagged disposable regardless of what any upstream feed says.
valid_format
Syntactic validity. Cheap to check, and it catches a surprising share of real signup failures.
is_role_address
admin, info, support and similar. Not a threat, but not a person either.
is_known_spammer
A direct match on an address observed sending spam or used in fraud.
Or skip the API entirely
For signup screening at volume, a local lookup beats a network round trip every time, and nothing about your users leaves your infrastructure. The full list is one plain file, one domain per line, rebuilt every 30 minutes.
Download the list
curl -sO https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt
Use it in Python
with open("disposable-email-domains.txt") as f:
disposable = {line.strip() for line in f if line.strip()}
def is_disposable(address: str) -> bool:
return address.rsplit("@", 1)[-1].lower() in disposableRate limits and fair use
No key, no quota on the public endpoint
It is rate limited per address to keep it available for everyone, not metered against a balance you have to top up.
A free account raises the ceiling
It also unlocks batch calls of up to 100 addresses per request. Still free, still no card.
High volume belongs offline
If you are screening every signup on a busy service, download the list. It is faster, it is private, and it does not depend on us being reachable.
Nothing changes retroactively
The dataset is MIT licensed. A copy you have already downloaded stays yours under those terms whatever we do later.
What the endpoint returns for real domains.
Live results, fetched as this page loaded, from the same public endpoint the code samples above call.
mailinator.com
high risk
disposable mailbox provider
The canonical public throwaway inbox. Anyone can read any mailbox on it, which is precisely why it turns up in fake signups.
temp-mail.org
high risk
disposable mailbox provider
One of the most-searched temp-mail brands, and a fleet operator: the same organisation runs a great many domains at once.
00000000.me
critical risk
malicious domain
Not disposable, malicious. It sits in our phishing dataset, which is a different and more serious verdict.
gmail.com
low risk
allowlisted major provider
Permanently allowlisted. No data source can ever push a major provider onto the disposable list.
protonmail.com
low risk
allowlisted major provider
A real privacy-focused mailbox, and a useful test: privacy is not disposability, and treating it as such rejects genuine customers.
Every verdict above was fetched from the engine when this page loaded. Nothing here is a screenshot or a stored example, so if a number looks surprising, that is what our data actually says right now.
Questions people ask
Is there a free temp mail detection API?
This one. A single unauthenticated POST to https://api.ffraud.com/public/email/check returns whether an address sits on a disposable provider, along with role-account, format, and known-spammer flags. There is no key to request and no signup gate in front of it.
Do I need an API key?
Not for the public endpoint. A free account exists and raises rate limits and enables batch calls of up to 100 addresses, but the basic check works with no credentials at all, which means you can integrate it and evaluate it before deciding whether you want an account.
How many disposable domains does it cover?
Over 219,000 in the current build, and the exact number is written into the repository's metadata.json on every rebuild rather than quoted from a page that might be out of date. It refreshes every 30 minutes, which matters because throwaway services register new domains constantly and a list that updates once a day is already behind.
How do you detect brand-new temp mail domains?
Confirmed listings are the base layer, but they are structurally late to a domain registered an hour ago. On top of them we run heuristic pattern detection for new burner services, our own honeypot sensors, and infrastructure analysis: throwaway operations tend to run large fleets of domains from shared mail infrastructure, so identifying the machine behind a fleet catches all of it at once rather than one domain at a time. When a verdict comes from a heuristic rather than a confirmed listing, detection_source says so.
Can I use this in a commercial product?
Yes. The API is free to call commercially and the datasets are MIT licensed, which explicitly permits commercial use, redistribution, and modification. Attribution is appreciated and never required.
Other free tools
Free email checker
Format, disposable providers, role accounts, phishing domains, and known spam addresses in one verdict.
Disposable email checker
Check whether an email domain hands out throwaway mailboxes, and whether to block it at signup.
Email blacklist check
Paste any email address. Disposable, phishing, role account, known spammer, and community reports, in one verdict.
Do it in code.
The same answer from a free API endpoint, or download the whole database and never call an API at all. No card, no quota, no expiry.