How Weak Disposable Email Detection Leaves Online Services Vulnerable to Abuse

Over the past few weeks, I conducted an extensive test of several well-known email verification platforms to evaluate how effectively they detect disposable email address (DEA) providers.

The results were surprising.

While these platforms generally perform well at verifying whether an email address exists, detecting catch-all domains, identifying role-based addresses, and validating MX records, many of them struggled to accurately identify disposable email domains.


We tested domains from about 90 disposable email providers, representing several hundred disposable domains. Many of the providers included in our testing had been launched only a few days or months earlier, while others had been operating for several years.

None of the newly launched or recently established providers were identified as disposable by the email verification platforms we tested. Instead, their domains were typically classified as valid or risky. We also found that many domains belonging to long-established disposable email providers were misclassified as valid or risky, although a significant number of domains from these older providers were correctly identified as disposable.

As a result, hundreds of disposable email addresses were able to pass verification undetected, highlighting significant gaps in disposable email detection across multiple email verification platforms.

One possible explanation is that many email verification services appear to rely heavily on third-party disposable domain lists instead of using a robust API-based disposable email detection service or maintaining their own detection systems with continuous research into new providers. Because new disposable email services emerge every few days and many frequently add or rotate domains, static domain lists can quickly become outdated, making it difficult to keep pace with the constantly evolving disposable email landscape.


This issue doesn't affect only email verification providers. During our testing, we also found that many online services offering free trials and protecting their signup forms from disposable email addresses rely on third-party email verification services with inadequate disposable email address detection. As a result, a large number of disposable email addresses were able to bypass their registration checks.


This leaves these platforms vulnerable to free-trial abuse, fake account creation, referral fraud, and other forms of platform abuse. It can also negatively impact email deliverability over time, as emails sent to disposable addresses are unlikely to reach real users, potentially increasing bounce rates and reducing the quality of their mailing lists.

As part of this research, below is a list of some disposable email providers that were not detected by several major email verification platforms during our testing. The purpose of sharing these examples is to illustrate the current detection gaps and help email verification providers and SaaS companies improve their disposable email detection capabilities.

If you're an email verification provider, SaaS owner, or developer conducting legitimate research, feel free to reply to this thread or send me a private message if you'd like additional disposable email providers for testing purposes. I'd be happy to share more examples to help you evaluate and improve your disposable email detection capabilities.