Mailinator: what it is for, and should you block it

Two kinds of people search for this, and they want opposite things.

Developers want to know what it is for. Operators want to know whether to block it.

Both answers are here, and they turn out to be the same answer.

What it is for#

Testing. And that is a completely fair use.

If you build a signup form, you need a real inbox to get the confirmation email. Making a new one for every test is tedious. Using your own fills it with junk.

Mailinator gives you an inbox for any address, straight away, with no signup. Send mail to whatever-you-want@mailinator.com and it is sitting there.

So an automated test can register run-4471@mailinator.com, read the confirmation, click the link, check the account exists, and move on. Nothing to set up.

The catch: anyone can read it#

Public Mailinator inboxes have no password.

There is no account. Nothing protects an inbox except whether someone guesses the address. And the obvious ones get guessed constantly. Open test@mailinator.com right now and you will see whatever strangers had sent there in the last few minutes.

Messages also get deleted after a short while, so nothing sticks around.

Neither of these is a bug. They are the whole design, and they are why it is instant and free.

But it means one thing: anything you send there is basically public.

Never a password reset. Never an invoice. Never a login code for an account you care about. Not because the service is shady, but because the inbox is open by design.

That same openness is why it shows up in fraud. Someone farming signups needs somewhere to catch a confirmation link. They do not care that it is public, because they are throwing the identity away in an hour anyway.

Should you block it?#

Yes. It costs one lookup and it clears out a real slice of lazy abuse.

Now the honest part: it stops nobody who is trying.

Someone farming your signup bonus just moves to one of thousands of other throwaway domains, most of which are not on any list yet. Or they spend a few dollars on a normal-looking domain, point it at a catch-all, and make unlimited addresses that no blocklist will ever contain, because there is nothing to report.

We keep a list of 162,587 throwaway domains, refreshed every hour. It is the least interesting thing we do with email, for exactly this reason.

Blocking Mailinator raises the floor. It does not raise the ceiling.

The check that fails here#

The obvious way to catch throwaway domains without a list is to look at how old they are. New domain, high risk.

It sounds right. Here it is exactly wrong:

These are older than most real companies.

A domain age rule does not just miss them. It vouches for them, and then flags the new startup whose employee is signing up.

Here is what our checker returns for a few addresses:

Look at row three. A throwaway domain that cannot receive mail at all, still being accepted at signup forms everywhere.

The check that works#

Stop asking which domain the address is on. Ask what it really is.

Gmail ignores dots. Anything after a + is a label. googlemail.com is the same service. One inbox makes unlimited addresses that all look different and all deliver:

ada.lovelace@gmail.com            →  adalovelace@gmail.com
adalovelace+shop@gmail.com        →  adalovelace@gmail.com
adalovelace+shop2@googlemail.com  →  adalovelace@gmail.com

None of those is a throwaway. No blocklist would ever catch them. But to your database they are separate customers claiming separate bonuses.

That is the version that costs you money, and blocking Mailinator does nothing about it.

If you use it for testing#

Half the people reading this are developers, so one practical note.

The moment you add a throwaway-domain check to your own signup form, your tests will start failing. Mailinator is first on every list.

The fix is to allow your test addresses in staging, rather than weakening the check in production.

And keep the rule above: nothing private, ever, into a public inbox.

Run any address through the free email checker with no account. It tells you whether the domain is a known throwaway, whether it can receive mail, and what the address really resolves to.