We block 130-odd disposable-email providers by default. New ones appear every week; old ones quietly die. Over the last two years I've kept a hand-curated list and it's taught me more about the open internet than I expected.
There are roughly four classes of disposable email, and each one needs a different mitigation. Lumping them all together — as most public blocklists do — is the reason public blocklists have a false-positive rate that makes them unusable for transactional email.
The four classes
- Burner inboxes. tempmail, guerrillamail, mailinator. Anyone can read the inbox without authentication. Block these unconditionally.
- Alias forwarders. SimpleLogin, AnonAddy, Apple Hide My Email. Forward to a real inbox. Risky to block — many real users rely on them for privacy.
- Plus-tricks. you+something@gmail.com. Same inbox, different alias. Don't block; deduplicate on the canonical address.
- Catch-all domains. anything@yourcompany.com goes to one inbox. Useful for legitimate businesses; abused by spammers who buy expired domains. Block only if the domain is on a known-abusive list.
What surprised us
The half-life of a burner-inbox service is shorter than you'd guess — about 14 months for the median provider in our data. The exceptions are extreme: 10minutemail, mailinator, and yopmail have been running for over a decade and show no signs of stopping. We give those services a separate weight in our scoring.
If you maintain a disposable-email blocklist, the most useful thing you can do is split it by class. Don't ship one big regex. Ship four lists, each maintained by a different policy. Your false-positive rate will thank you.