Blocking Disposable Emails at Signup: A Practical API Guide
Throwaway inboxes wreck your activation metrics and your free tier. Here is how to detect disposable email domains at signup with one API call, plus the failure modes to avoid.
Blocking Disposable Emails at Signup: A Practical API Guide
Every product with a free tier eventually meets the same problem: a meaningful slice of signups come from throwaway inboxes. Mailinator, 10minutemail, guerrillamail and thousands of rotating clones exist specifically so a user can take your free credits, never see your onboarding email, and disappear.
The cost is not just abuse. It is measurement. If 20% of your signups are disposable, every activation, retention and conversion number you look at is wrong.
What a disposable email check actually does
It answers one question: is this domain a known throwaway provider?
That is a domain-level lookup against a maintained blocklist, not a mailbox verification. It will not tell you whether ahmed@company.com exists — it tells you whether the domain behind the @ is a burner service.
curl -X POST https://theglitchstore.com/api/email-disposable-check \
-H "x-api-key: $GLITCH_KEY" \
-H "content-type: application/json" \
-d '{"email": "test@mailinator.com"}'
You get back a boolean plus the matched domain, and you decide what to do with it.
Where to put the check
Three placements, in order of how much they help:
1. At signup, before you create the account. Cheapest place to stop abuse. One call per signup — your volume here is tiny compared to your API traffic.
2. Before granting free credits or a trial. If you allow the signup but gate the free tier, you keep top-of-funnel numbers intact while protecting the thing that costs you money.
3. At payment/refund risk scoring. A disposable domain on a chargeback-prone order is a strong signal.
The failure modes nobody warns you about
Do not hard-block silently. Users on legitimate but obscure domains get caught occasionally. Return a clear message ("please use a permanent email address") rather than a generic error, or you will lose real customers to a mystery failure.
Do not treat it as email validation. Syntax validity, MX presence and disposability are three different checks. Disposable detection answers only the third.
Fail open, not closed. If the check times out, let the signup through and flag the account for review. A signup flow that breaks when a third-party call hiccups is worse than a few burner accounts.
Cache by domain. The answer for @mailinator.com does not change minute to minute. A 24-hour domain-level cache collapses your call volume enormously if you have signup spikes.
Pattern: soft gate instead of hard block
The approach that works best in practice is a soft gate. Allow the account, but:
- skip the free credit grant
- require email confirmation before any billable action
- flag the row so support can see why the user is limited
You keep the funnel open, you stop the leakage, and you avoid false-positive rage.
Cost model
Disposable checks are a per-signup cost, not a per-request cost. Even at aggressive growth you are making a few thousand calls a month. Pay-per-call pricing suits this shape far better than a monthly subscription tier you will never fill — that is exactly why The Glitch Store bills disposable checks out of the same prepaid credit balance as every other API in the catalog. No separate plan, no minimum, no seat.
Try it
The Disposable Email Checker runs on the same key as the other eight APIs in the catalog — DNS lookup, IP geolocation, hashing, web-to-markdown, weather, FX and crypto rates. One key, one balance, pay per call.