Blog

How to block disposable emails at signup

21 October 2026 · 7 min read · SignupVet team

A disposable email address comes from a service that hands out a working inbox for a few minutes or hours, with no account and no name. To block them at signup, compare the email's domain with a maintained list of throwaway providers, check that the domain can receive mail, and show a clear message when you reject an address.

This guide walks through those checks with copy-ready code, the edge cases that cause false blocks, and what a blocklist cannot tell you.

Why disposable emails are worth blocking

• They are the cheapest way to farm free credits and trials. A new inbox takes seconds, so one person can open many accounts.
• They hurt your email reputation. Throwaway inboxes expire. Your onboarding emails bounce or go unread, and inbox providers notice.
• They make your numbers lie. Signups that were never going to stay inflate your growth and lower your conversion rate.

If you want to put a price on it, the fake signup cost calculator takes about five minutes.

How to block disposable emails at signup in 5 steps

1. Check the domain against a maintained list

The most useful single check. The open-source disposable-email-domains list on GitHub is a good start. Load it once when your server starts and look up the domain of every new signup. Also check parent domains, because some services hand out addresses on subdomains.

// disposable: a Set of lowercase domains loaded from the list
function isDisposable(email, disposable) {
  const domain = email.trim().toLowerCase().split("@").pop();
  const labels = domain.split(".");
  for (let i = 0; i < labels.length - 1; i++) {
    if (disposable.has(labels.slice(i).join("."))) return true;
  }
  return false;
}

2. Keep the list up to date

New throwaway services appear every week. A list you copied a year ago misses many of them. Refresh it on a schedule, for example once a week in your deploy or a small cron job, and keep a short list of your own additions for domains you see in your signups.

3. Check that the domain can receive mail

Many fake signups use made-up domains. A quick DNS lookup tells you whether the domain exists and has a mail server (MX record). If there is none, the address cannot receive your confirmation email.

import { resolveMx } from "node:dns/promises";

async function canReceiveMail(domain) {
  try {
    const mx = await resolveMx(domain);
    // a single "." record (null MX) means: this domain accepts no mail
    return mx.some((r) => r.exchange && r.exchange !== ".");
  } catch {
    return false; // domain or mail server not found
  }
}

DNS can be slow or fail now and then. If the lookup times out, let the signup through and check it again later, instead of blocking a real user.

4. Suggest a fix for typos instead of blocking

Addresses like anna@gmial.com or anna@outlok.com are usually honest mistakes. Show "Did you mean gmail.com?" instead of an error. You keep a real user and get an address that works.

5. Show a clear message when you block

"Please use a permanent email address" works better than a generic error. A real person understands it and tries again with their normal inbox. A script gets nothing useful from it.

Common mistakes

• Blocking forwarding services like Apple's Hide My Email, DuckDuckGo or SimpleLogin. They deliver to a real inbox and are used by privacy-minded people. Review instead of block.
• Blocking shared mailboxes like info@ or team@. Small companies often sign up with them. They are a weak signal at most.
• Relying on a format check alone. A regular expression only tells you an address looks valid, not that anyone will ever read it.
• Never updating the list, see step 2.

What a blocklist cannot tell you

A domain check cannot tell whether random123@gmail.com is a real, used inbox. That needs a mailbox check with the provider, which is slower and not always reliable. For products that give away credits, it also helps to look beyond the email: many signups from one IP or network, or numbered address series like max1@, max2@, are strong signs of abuse even when every address is on a normal provider. Our guide on stopping free trial abuse covers those checks.

Doing it with one API call

If you would rather not maintain lists and DNS lookups yourself, SignupVet runs these checks in one request and returns allow, review or block with the reasons:

const res = await fetch("https://www.signupvet.com/verify/email", {
  method: "POST",
  headers: { Authorization: "Bearer " + process.env.SIGNUPVET_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({ email }),
});
const { recommendation } = await res.json();

if (recommendation === "block") return reject("Please use a permanent email address.");

You can test single addresses for free, without an account, with our disposable email checker. The documentation lists every reason code.

Frequently asked questions

Will blocking disposable emails turn away real users?

Rarely. People who want to keep using your product need a working inbox anyway, for password resets and receipts. If you are worried, show a clear message such as "Please use a permanent email address" so a real person can simply try again.

Is a forwarding address like Hide My Email the same as a disposable one?

No. Forwarding services hide the real address but deliver to a real inbox that keeps working. Many privacy-minded people use them. Treat them as a reason for a closer look or a smaller trial, not as a block.

How many disposable email domains are there?

Thousands, and new ones appear every week. The open-source list we use contained around 9,000 domains in October 2026. That is why a list you copied once and never update loses value quickly.

Can I just block all free providers like Gmail?

Only if you sell exclusively to companies and are happy to lose freelancers and early-stage founders. For most products with a free plan, blocking Gmail or Outlook turns away far more real users than bots.