Disposable Email API Validation Explained
Disposable email validation is the process of checking whether an email address belongs to a temporary or throwaway provider, usually alongside checks that the address is well formed and that its domain can actually receive mail. A good disposable email API runs these as separate layers so you can see what failed and decide how strict to be.
The three layers of email validation
ipto's email checker validates an address in order of cost. First comes syntax: does the string look like a valid address, with a local part, an at sign and a plausible domain. This catches the typos that cause most bounces, such as a missing dot or a doubled at sign, and it needs no network access.
Second comes the domain check. The checker performs a real DNS query for the domain's mail exchanger (MX) records. A domain with no MX records, and no fallback address record that could accept mail, cannot receive messages, so an address on it will bounce no matter how clean the syntax. This is also where misspelled domains such as a transposed letter in a popular provider's name are caught.
Third comes the disposable check: does the domain belong to a provider of temporary inboxes, the kind that give out an address for ten minutes or a day with no account. ipto compares the domain to a disposable-domain list that is synchronized on a daily schedule, and the result reports each check separately, so a response tells you which layer failed rather than returning a single opaque verdict.
Why disposable domains matter
People use throwaway addresses for legitimate reasons, including avoiding newsletters, but they are also the standard tool for abusing free trials, creating duplicate accounts, farming referral credits and registering bots. For a product with a free tier or a signup bonus, a disposable address is often the cheapest way to get a fresh identity. For a mailing list, they are a deliverability problem: the mailbox disappears, the message bounces, and a high bounce rate harms your sender reputation with receiving providers.
The weakness of any list-based approach is that new disposable providers appear continually, and some operate across many rotating domains. A list that is refreshed regularly will catch the large, established services and most of the long tail, but it will always lag the newest ones. That is a reason to treat the disposable flag as a strong signal, not a certainty, and to combine it with other evidence.
What a passing result does and does not mean
Passing syntax, MX and disposable checks means the address is well formed, the domain can receive mail, and the domain is not a known throwaway provider. It does not prove that a specific mailbox exists, because many mail servers accept all recipients and bounce later, and it does not prove the person is who they claim to be. Definitive mailbox verification without sending a message is not possible in general. Where available, the checker can add a live mailbox verification pass, but the result of such a pass is still a probability, not a guarantee. The reliable proof of ownership is still a confirmation link sent to the address.
Using the result in practice
A sensible policy is graduated rather than binary. Reject syntax failures and domains with no mail servers immediately, with a friendly "did you mean" message for likely typos. For disposable domains, decide by context: block them for trial signups, allow them for reading a public article behind a gate, or let them through but require extra verification. Log the layer that failed so you can tune the policy from real data.
Email is only one signal. Combine it with network and device evidence for better decisions: check the signup IP with the VPN and proxy checker for VPN, Tor and datacenter hosting, and the phone checker for number format and line type. The fraud score checker does this in one step, rolling disposable-email detection with IP, phone and User-Agent signals into a 0 to 100 score with a breakdown of what contributed. For related reading on combining these signals, see IP, phone and email fraud scoring.
To try it, enter an address in the email checker page, or call the email endpoint described in the API documentation. Free usage is 1,000 requests per day with no signup, which is enough to test the checks against a sample of your own sign-up data before wiring them into a form.