A disposable check never needs the full address. Split at the @ sign and look up the domain in a list of throwaway providers. The open-source disposable-email-domains list on GitHub is the usual starting point, and you can load it into your signup code so nothing leaves your server. ZapBounce's own disposable flag reads that same list, merged with our additions and refreshed weekly.
Keep your copy fresh, since throwaway providers register new domains all the time. A weekly sync suits most signup forms. Our disposable domains page prints the domain count and the date of the last update, and the disposable email checker matches a domain against a list bundled into the page.
Knowing the mailbox exists is another matter. Only the receiving mail server can confirm it, at the RCPT TO step of an SMTP check, so someone has to contact that server. You can run the handshake from your own machines, but most residential ISPs and many cloud providers block port 25, and Gmail and Microsoft 365 block probes from cloud IPs.
When the check goes through a verifier, look at how the address travels and how long it stays. ZapBounce takes addresses by POST only, so they never land in a URL, an access log or browser history. Uploads and results are kept 30 days by default, and you set each API key's window from 0 (deleted on download) to 90 days. You can also delete a batch at once or erase one address across your account.
We never sell your addresses, add them to a shared database, contact anyone on your list or reuse a list to improve the product. ZapBounce is hosted in the United States, and a list leaves that region only for the SMTP probe to the receiving server. The API reference shows the POST call, and signup validation covers the form flow.
Related questions
Can I detect disposable emails without an API?
Yes. Load a disposable-domain list, such as the open-source disposable-email-domains list on GitHub, into your own code and match the domain after the @ sign. Refresh it weekly so new throwaway domains get caught.
Does an email verification API keep the addresses I send?
Each vendor sets its own retention, so read the terms before you integrate. ZapBounce keeps results 30 days by default, and you can set each API key anywhere from 0 to 90 days or delete a batch at once.
Why does ZapBounce only accept POST requests for verification?
An address in a query string ends up in access logs, proxy logs, browser history and analytics. Sending it in a POST body keeps it out of all four. ZapBounce has no GET route for verification.
Is a disposable check enough to stop fake signups?
A disposable check stops throwaway domains, not typos or dead mailboxes. Pair it with a real-time mailbox check at signup, which ZapBounce runs from $5 for 1,000 checks.