Blocking throwaway addresses, and when that is the wrong call

Your free trials are being abused, or a discount code keeps getting claimed by the same person with different addresses. Both are real problems, and both have a cheaper fix than you'd expect.

Before blocking anything, work out what a throwaway signup actually costs you. If the answer is a row in a database, the cure costs you more than the disease.

The order the work happens in

  1. Decide what the abuse costs in money

    A repeated free trial that consumes compute is worth blocking. A newsletter signup from a burner address is worth nothing to anyone and harms nothing.

  2. Block at the form, not in the database

    Rejecting at signup gives the person a chance to use another address. Finding it later means you have already sent them things and stored a useless record.

  3. Accept that the list is always behind

    New disposable domains appear continuously. A lookup catches the known ones, which is most of the volume and none of the determined abuse.

  4. Pair it with a real control

    Require a confirmation click, a card, or a phone number where the abuse actually costs money. Those defeat throwaway addresses by design rather than by recognition.

  5. Log what you block and read it occasionally

    A blocked domain that turns out to be a legitimate privacy forwarding service is a customer you turned away, and you'll only find that by looking.

What each result means here

The same four results and their flags, read against this job. A catch-all worth keeping in one situation is one to exclude in another.

ResultWhat to do with it
ValidA disposable address usually is valid. The mailbox works, it just will not exist next week.
InvalidRemove, as with any dead address.
Catch-allSome disposable providers run catch-all domains, which is why both flags can appear on one address.
UnknownNo relationship to the disposable question. Handle separately.
Role flagRare on throwaway domains and not informative when it happens.
Disposable flagThe flag itself, from a domain list. Block at signup where abuse costs money, otherwise record it and move on.

How you know it is finished

Signups from known throwaway domains are refused at the form with a message that lets the person try again, and the abuse you were worried about has actually fallen rather than merely being harder to see.

What this does not fix

Like role detection, this is a lookup rather than an SMTP conversation and costs nothing extra on a check. The free disposable domain checker runs it without an account at all.

Questions people ask

Should I block disposable email addresses at signup?

Where a throwaway signup costs you money, such as a compute-heavy free trial, yes. For a mailing list it's rarely worth the legitimate users you turn away by accident.

How accurate is disposable detection?

As accurate as the domain list behind it, which is honest about known domains and blind to new ones. No vendor can do better, because there is nothing at the protocol level distinguishing a throwaway domain from any other.

Are privacy forwarding services disposable?

Usually not. Services people use as a permanent forwarding address behave like real mailboxes and belong to real customers, and blocking them is the most common expensive mistake here.

Try it on the file in front of you

100 free checks a month, no card. Addresses we could not get an answer on come back labeled as unknown, and those are not billed.