Disposable email checker
Rate limited, no key required. Results appear inline.
What a disposable address is
A mailbox built to be abandoned. Temp-mail, 10-minute mail, burner and forwarding services all hand out an address that either expires on its own or was never tied to a person in the first place. Some are public inboxes anyone can read without a password; others are private relays that forward to a real account.
They exist for a good reason. Someone signing up for a download does not want a decade of marketing mail, and using a burner is a reasonable answer to that. Which is why a disposable address is a signal about the account, not a verdict on the person. Reject on it alone and you will turn away privacy-conscious customers who would have paid you.
Where it stops being harmless is volume. One person opening forty accounts on forty throwaway addresses to claim a signup bonus forty times is the pattern this check exists to surface, and it looks nothing like the customer who used a burner once.
The three families, and why the grouping matters
Classic temp-mail
Public inboxes anyone can open and read. No password, no ownership, expire on their own.
Mailinator · 10 Minute Mail · Guerrilla Mail · Temp-Mail · YOPmail · Maildrop · Dispostable · Mohmal
Private burners
Generate a throwaway address bound to a real inbox. Deliverable and private, so a delivery check passes them.
Burner Mail · AnonAddy / addy.io · SimpleLogin · Firefox Relay · DuckDuckGo Email Protection
Apple Hide My Email
Worth its own line. A burner by function, but it belongs to a paying Apple customer, so treating it as fraud blocks some of the best users you have.
icloud.com relay addresses
The honest limit
No published list is ever complete, and that is true of every checker including this one. Disposable services register new domains continuously, so a list shipped as a static file is already missing the domains being used this week. Refreshing hourly narrows the window. It does not close it.
Anyone selling you a disposable-email product that claims complete coverage is describing something that cannot exist.
The bigger hole: alias tricks
Disposable domains are the problem people look for. Aliases are the one that actually costs money.
alex+1@gmail.com and a.l.e.x@gmail.com are the same inbox. Both are real, both are deliverable, neither is disposable, and every email validation service on the market passes them. One person can open unlimited accounts this way without touching a temp-mail domain once.
ada.lovelace@gmail.comdotsa.d.a.lovelace@gmail.comdotsadalovelace+shop@gmail.complus tagadalovelace+shop2@googlemail.complus + domainAdaLovelace@Gmail.comcaseadalovelace@gmail.comthe actual inbox
adalovelace@gmail.comSix accounts that looked unrelated are one person.
This checker collapses plus-tags, Gmail dot tricks and provider aliases to a single identity key, so two different-looking addresses that reach one mailbox resolve to one person. If you are guarding a signup bonus or a free trial, that is the field to read.
Detecting it at signup
The check above is one endpoint of the Kaidn API. Call it from your server on submit:
curl -X POST https://api.kaidn.io/v1/check/email \ -H "x-api-key: $KAIDN_API_KEY" \ -H "content-type: application/json" \ -d '{"email":"newuser@mailinator.com"}' # { # "email": { # "fraud_score": 80, # "is_disposable": true, # "mx_valid": true, # "canonical": "newuser@mailinator.com", # "is_aliased": false # }, # "summary": "Disposable domain with valid MX. Treat as throwaway." # }
Read is_disposable for the single field, or fraud_score to have the address weighed against everything else known about it.
The stronger pattern is POST /v1/score, which takes the email alongside the IP and the device and returns one verdict with the reasons behind it. A disposable address on a residential connection with a first-seen device is a customer. The same address on a datacenter IP with a device already tied to four accounts is a ring. Only the second should cost you a signup.
Frequently asked questions
Frequently asked questions
What counts as a disposable email address?
Any mailbox designed to be thrown away: 10-minute mail, temp-mail, burner and forwarding services whose addresses expire or were never tied to a person. They are legitimate for avoiding marketing lists, which is why blocking them outright is a business decision rather than a security one.
How many domains do you check against?
Over 160,000 throwaway and temp-mail providers. The list refreshes hourly from several sources rather than shipping as a static file, because disposable providers register new domains constantly and a list that is a month old is already missing the ones being used today.
Is this free, and do you store the address?
Free, with no signup. The address is not stored. It is normalised, checked, and the result returned; nothing about the lookup is retained against you or the address.
Why does a real-looking address come back as disposable?
Many burner services run on ordinary-looking domains, and some run on subdomains of hosts that also carry real mail. The result also flags forwarding and alias providers, which are not throwaway but do let one person hold many addresses. Read the reason rather than the verdict.
Can a disposable address still receive mail?
Usually yes, and that is why a delivery check on its own does not catch them. A temp-mail domain has valid MX records and accepts mail perfectly well, so a verification service that only asks whether the mailbox exists will pass an address that expires in ten minutes.
What are alias tricks and why do they matter more than disposables?
Plus-tags and Gmail dot tricks turn one inbox into unlimited addresses that all pass validation and all reach the same person. For bonus abuse and trial abuse this is the bigger hole: the addresses are real, deliverable and not disposable at all. This checker collapses them to one identity key so you can see when two different-looking addresses are the same mailbox.
How do I block disposable emails at signup?
Call POST /v1/check/email from your server when the form is submitted and read is_disposable, or call POST /v1/score to weigh it against the IP, the device and the rest of the signal set instead of rejecting on one field. Blocking on disposable alone will cost you real users; scoring it will not.
Should I block them at all?
Rarely outright. A disposable address at signup on a residential connection with a fresh device is usually a privacy-conscious customer. The same address on a datacenter IP with a device already tied to four accounts is a fraud pattern. It is a signal to weigh, not a verdict.
Run this on every signup
The check above is one endpoint. The same engine scores a whole event, the address, the connection and the device together, and returns one verdict with the reasons behind it.