How to Detect Disposable Emails With an API

Disposable email addresses are the throwaway inboxes people use to pass verification once and then abandon: perfect for claiming a free trial ten times, farming referral credits, or spinning up fake accounts. The fastest, most reliable way to catch them at signup is an API call that scores the address in real time. This guide walks through what a disposable email detection API checks, how to integrate one in a few lines of code, and how to turn the result into a decision.

Why use an API instead of a blocklist

The obvious first instinct is to keep a list of known temp-mail domains and reject them. It works for a day. The problem is that disposable providers rotate domains constantly, register new ones in bulk, and spin up lookalikes faster than any static list can track. A hardcoded blocklist is always out of date, and maintaining it becomes a second job.

• Fresh coverage: an API scores brand-new disposable domains a blocklist has never seen.
• Signal, not just yes/no: you get domain age, deliverability and catch-all data to weigh, not a blunt binary.
• No maintenance: the provider keeps intelligence current so you don't babysit a list.

What a disposable email detection API checks

Rather than matching a name against a list, a good API infers disposability from the domain's characteristics. The tell-tale pattern is a domain that has mail infrastructure but none of the signs of a real, lasting business:

• Domain age: disposable domains are usually days or weeks old, not years.
• Mail and web presence: MX records but no website is a classic throwaway signature.
• Catch-all: the domain accepts mail for any local part, so unlimited addresses can be invented on it.
• Deliverability: whether the specific mailbox actually accepts mail.
• Reputation: the provider's history of abuse.

Detecting disposable emails in three steps

1. Get an API key (RiskUnified's free tier includes 100 checks a month).
2. POST the email address to the endpoint at signup, before you create the account.
3. Read the returned risk level and signals, then allow, challenge, or block.

curl -X POST https://api.riskunified.com/email_risk \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "signup@tempmail-vault.io"}'

const res = await fetch("https://api.riskunified.com/email_risk", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.RISKUNIFIED_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ email }),
});
const report = await res.json();
const disposable = report.risk.signals.includes("disposable_domain");

import os, requests

report = requests.post(
    "https://api.riskunified.com/email_risk",
    headers={"Authorization": f"Bearer {os.environ['RISKUNIFIED_KEY']}"},
    json={"email": email},
    timeout=30,
).json()

disposable = "disposable_domain" in report["risk"]["signals"]

Reading the response

A high-risk disposable address comes back with a young domain age, no website, and a risk.level of high. The named signals tell you exactly why, so you can log a clear reason for every decision.

{
  "email": "signup@tempmail-vault.io",
  "email_features": {
    "email_deliverable": false,
    "catch_all": true,
    "email_history_count": 0
  },
  "domain_features": {
    "domain": "tempmail-vault.io",
    "domain_risk": "high",
    "domain_age_days": 12,
    "has_website": false,
    "has_mailserver": true
  },
  "risk": { "level": "high", "signals": ["disposable_domain", "email_not_deliverable"] }
}

Turning the result into a decision

Resist the urge to hard-block on a single flag. The strongest setups map the risk level to graduated friction, so real users sail through and only the clearly-disposable get stopped:

• Low: allow the signup normally.
• Medium: allow, but add a verification step or hold value (bonuses, payouts) until later.
• High: block, or route to manual review, on high-value actions like trials and referrals.