Sign-up hygiene
Blocking throwaway emails at sign-up, without maintaining a list yourself
Disposable inboxes cost you free-tier abuse and dead newsletter addresses. Here is how to stop most of them in one request, and where to stop trying.
Open any sign-up issue tracker and you will find the same ticket: "Add CAPTCHA, honeypot and a disposable-email block to sign-up." Someone noticed that a chunk of new accounts use addresses that self-destruct after ten minutes, usually to grab a free tier twice.
What a throwaway address costs you
- Free quotas claimed again and again by the same person.
- Bounces later, when you send a receipt or a newsletter to an inbox that no longer exists. Bounces hurt your sender reputation.
- Sign-up numbers that look better than the real ones.
The three usual approaches
- Keep a blocklist file. There are good open lists on GitHub, but new throwaway domains appear every week and someone has to keep pulling updates.
- Send a confirmation code. Still the strongest proof, because the person must read the inbox. It doesn't stop throwaway inboxes that do receive mail; it only proves the address works today.
- Check the address before you accept it. Look at the domain: is it a known throwaway service, does it have mail servers (MX), does it publish SPF and DMARC like a real organisation would?
Checking an address in one request
The email59 deep check does that third step for free, with no key: GET https://email59.com/v1/check?email=.... It returns a 0-99 score, a verdict and each check it ran. A throwaway domain fails straight away:
curl -s "https://email59.com/v1/check?email=signup-test@mailinator.com"
# {"verdict": "risky", "score": 30,
# "summary": "Throwaway email service: the inbox may vanish soon.", ...}In a sign-up handler, a reasonable rule: refuse when the check named disposable fails, ask for another address when there is no MX record, and let everything else through to your confirmation code.
Where to stop
- Don't block on a low score alone. Small companies with sloppy DNS are real customers.
- Don't probe mailboxes over SMTP. Big providers don't answer honestly and it can get your IP listed. Our check deliberately skips it.
- Pair it with rate limits per IP and a CAPTCHA if bots are the problem, not people.
The free check allows 100 lookups a day per IP; with an email59 key it's 1,000 a day per account.