Glossary
What is a disposable email address?
A disposable email address is a temporary mailbox from a service that hands addresses to anyone, typically to get past a signup form. It may accept mail today and be gone next week — real mail while it lasts, not a durable contact.
Also known as Burner address · Throwaway email · Temporary email address
How they work
A disposable-mail service runs a domain with a catch-all mailbox and a web page that shows whatever arrives. There is no signup and no password; the address is the credential. Some expire after minutes, some persist until the service rotates the domain, and many services run dozens of domains at once precisely so that blocking one achieves little.
Nothing about that is technically unusual. A disposable address has a valid domain, real MX records and a mailbox that answers — which is why the address itself is indistinguishable from an ordinary one at the protocol level. It is identified by the domain, not by the probe.
Why people use them, which is worth understanding before blocking them
To read a gated PDF without joining a mailing list. To test their own signup flow. To avoid handing a real address to a service they do not yet trust. To evade a ban or farm free trials. The first three are ordinary caution; the last is abuse. The address does not tell you which.
That matters because the response is different. A signup form defending a free tier has a good reason to refuse them. A newsletter has less to gain, and refusing them silently loses readers who would have converted later.
How VerifyInbox handles it
Disposable domains are matched against a vendored blocklist — 8,714 domains, refreshed weekly — and reported as a flag, not a verdict. If the mailbox accepts mail the result is deliverable with disposable: true and mailboxType: "disposable", because it is a real mailbox and saying otherwise would be false. If the mailbox does not exist, the hard SMTP rejection wins and the result is undeliverable — a definitive rejection outranks every classifier. The same list gates signup here, on both password and OAuth routes.
| Situation | Result |
|---|---|
| The disposable mailbox accepts mail | deliverable / mailbox_exists, with disposable: true and mailboxType: "disposable" |
| The disposable mailbox does not exist | undeliverable / mailbox_not_found — the rejection outranks the classifier |
| The domain is on the blocklist but never probed | The flag is still set; the verdict is not |
Any static list is stale within weeks
This is the honest limitation and it applies to every vendor, including this one. New disposable domains appear constantly, and a service whose business is being reachable will register more the moment the current ones stop working. A list refreshed weekly is a good list; it is not a complete one, and nobody has a complete one.
So treat the flag as a signal with a known false-negative rate rather than a gate with a guarantee. If your defence depends on catching every burner address, the list is the wrong control — confirm the address instead, which costs the attacker a working mailbox they have to keep.
Deciding what to do with one
For a signup form protecting something costly, refusing them is reasonable — say so in the error rather than failing silently, because a legitimate user with an unusual domain will otherwise think your form is broken.
For a contact list, flag and segment rather than delete. The address accepts mail today; it simply has a short expected life, and mixing it into a metric about list quality distorts the metric. The disposable email checker tells you which is which.
Tell a throwaway address from a real one before it reaches your list. No account, and it runs now: Disposable email checker