Syntax-valid, MX-record-valid, and still worthless for your product: that's a disposable email address from 10minutemail, guerrillamail, mailinator, or one of several hundred similar throwaway-inbox services. If you're not filtering these, a meaningful slice of your "verified" signups are addresses nobody will ever check twice.
Here's why this is a genuinely different problem from syntax or MX validation, and how to actually solve it.
Why there's no algorithmic tell. A disposable-mail domain looks completely normal — valid syntax, real MX records, sometimes even a legitimate-looking domain name. There's no structural pattern that distinguishes mailinator.com from gmail.com at the protocol level. The only reliable signal is a maintained list of known disposable domains, checked against the domain part of the address:
function isDisposable(email, disposableDomainSet) {
const domain = email.split("@")[1]?.toLowerCase();
return disposableDomainSet.has(domain);
}
The catch: the list has to stay current. New disposable-mail domains spin up constantly — some services rotate domains specifically to dodge blocklists. A list you snapshot once and never update degrades within weeks. The community-run with a synced domain list, if you'd rather not own the re-sync process yourself. Sibling APIs on the same account: .
SOCIAL SHARE CARD GENERATOR