A disposable address comes from a throwaway inbox service. People use one to claim a free trial twice, grab a coupon or dodge your onboarding emails, and the inbox is gone within hours. Every one of those signups inflates your user count and bounces your first email. The disposable email entry covers how the services work.
Three fixes get tried first, and each one leaks. A regex only tests the shape, and a throwaway address has a perfectly normal shape. A JavaScript check in the browser can be switched off. A domain list pasted into your repo catches the services that existed the day you copied it, and new throwaway domains appear all the time.
Here's the server-side pattern that holds on any stack. In your signup handler, before you insert the user, send the address to POST /v1/verify with a timeout of a few seconds. ZapBounce returns a result (valid, invalid, catch_all or unknown) and a disposable flag. Reject the signup when disposable is true or the result is invalid, and create the account for everything else. Verification is POST-only, so the address never lands in a URL or an access log.
The same check drops into whatever you run. In Express or Next.js it goes in the route that handles the form. In Django or Flask it goes in the form's validation step. On Firebase it goes in a Cloud Function that runs before the user record is created. The Node.js, Python and Firebase pages show the request in each setting, and test keys that start zb_test_ never bill while you build.
ZapBounce reads its disposable list from the open-source disposable-email-domains project on GitHub, merged with our own additions and refreshed every week. You don't maintain a list at all. The disposable domains page prints the current domain count and the date of the last update, and one check returns the result plus every flag for one credit.
Related questions
What is the best way to block disposable email addresses?
Check the address on your server at signup with a verification API, and reject the signup when the disposable flag is true. A server check can't be bypassed from the browser, and a maintained list catches new throwaway domains that a hard-coded list misses.
Should I block disposable emails with a regex?
No. A regex only checks that the address looks like an email, and a throwaway address looks exactly like one. Blocking needs a lookup of the domain against a list of throwaway providers, which ZapBounce refreshes every week.
Will blocking disposable emails slow down my signup form?
One API call runs while your handler already waits on the database. Set a timeout of a few seconds, and if the call hasn't answered in time, create the account and verify the address later in a batch.
How much does it cost to check every signup?
ZapBounce charges $5 for 1,000 checks, and every account gets 100 free checks a month with no card. Unknown results are never billed, and credits never expire, so a slow month costs nothing.