One possible explanation for some of the gaps we observed is that email verification services may rely heavily on third-party disposable-domain lists. Maintaining a robust detection system requires continuously researching new disposable email providers and tracking domains as they appear, change, or rotate.
New disposable email services and domains appear regularly, and some providers frequently change the domains they use. This can make static or infrequently updated domain lists difficult to keep current.
During our testing, we also found many disposable addresses that were able to pass signup checks on online services offering free trials or attempting to prevent disposable email registrations. In some cases, those services appeared to rely on third-party email verification platforms with limited disposable email detection.
The practical problem is that missed disposable addresses can contribute to free-trial abuse, fake account creation, referral abuse, and other forms of signup abuse. They can also affect the quality of email lists when temporary addresses are collected instead of addresses belonging to users who intend to receive future communications.
That's what led me to build StopReg.
StopReg provides an API for validating email addresses and domains and classifying addresses as disposable, temporary, throwaway, relay, alias, role-based, public, EDU, ISP, and other categories.
It also includes Form Abuse Shield, which is designed to help applications protect signup and lead-generation forms from unwanted or abusive submissions using email and domain validation signals.
The enforcement layer lets an application decide what to do with a validation result:
BLOCK an address WARN and allow the submission ALLOW the address
I also built a free Disposable Email Checker so developers can test addresses without integrating the API:
https://stopreg.com/check-disposable-email
Feel free to request samples of temporary email providers to test against your current validation system for detecting temporary and disposable emails.
I'm interested in feedback from developers who have dealt with disposable email, fake signups, form abuse, or maintaining disposable-domain lists themselves.
In particular, I'm curious about what approaches you've found reliable for detecting new disposable email providers and how you handle false positives.