How we verify domains

Why we take verification seriously

Our customers decide whether to accept a sign-up based on our answer. A wrong verdict either turns away a real user or lets abuse through, so we are extra careful and put a large amount of effort and resources into verifying domains. Human evaluation still plays a big role in that work, backed by automated and AI-assisted verification infrastructure that does the heavy lifting.

What we check

We evaluate every domain against its actual mail infrastructure, not just its name. For each domain we resolve and store its MX hosts, the IP addresses those hosts resolve to, the domain's own A/AAAA records, and where its website redirects. Then we evaluate these signals:

Mail servers shared with known disposable email services
Membership in the domain pool of a disposable email provider we track
Credible reports of spam or abusive sign-ups
Use as a source of spam
Typosquatting: a domain registered to look like a well-known email brand, such as hiotmail.com instead of hotmail.com, so that addresses on it pass a quick glance as genuine
Email alias and forwarding services that hide the real address behind a throwaway one
Fake, parked or malicious websites

New domains reach us continuously: from our own research, from the providers we track, from our customers' reports, and from external signals such as public blocklists, spam and abuse reports, and records of malicious activity.

Where the evidence is clear, our automation decides. We don't block on a score threshold: if automation can't reach a confident verdict, a person reviews the domain. Signs of abusive behavior send any domain to manual review, whatever its other signals look like. We also review fresh domains by hand on an ongoing basis to spot suspicious ones early.

Once we block a domain, we re-check it on a rolling schedule. Its domain detail page shows the DNS records as of its "Last verified" date.

Beyond disposable email

Disposable email rarely travels alone. The same domains, mail servers and operators turn up in spam, scams and fraud, so our work reaches well beyond throwaway inboxes and into email security. This is where the topics meet:

Typosquatting. Lookalikes of real email providers are a classic phishing and impersonation tool. An address on hiotmail.com passes as a Hotmail user at a glance.
Fake education domains. Some temporary email services hand out addresses on domains that look like a school or university, built to claim student discounts, free licenses and other offers reserved for students.
Spam. Some domains are used to send spam, not just to receive throwaway mail.
Fake and malicious websites. A fake or malicious site behind a domain often points to a scam or to malware.
Account fraud. Disposable addresses are the raw material for fake accounts, free-tier and promo abuse, ban evasion and accounts created for resale.

That's why we also block domains that aren't classic temporary inboxes when the evidence ties them to spam, scams or fraud. For our customers, blocking disposable email also keeps out a share of fraudulent sign-ups.

"First identified" and "Last verified"

First identified: The date we added the domain to our records. This is not the domain's registration date — it is the moment the domain entered our verification pipeline.
Last verified: The last time a re-check confirmed the domain's DNS records. We re-check blocked domains on a rolling schedule; if a domain stops resolving, this date stays at the last time we saw its records. It tells you how current the evidence is.

The pair is the point: static blocklists go stale, and a domain that changed hands years ago can stay wrongly listed forever. We re-verify continuously to avoid that.

To see all of this on a real record, open the domain detail page of zoomugo.com, a recent temp-mail.org domain. Every domain detail page shows the same evidence, dates and dispute path. Provider pages like temp-mail.org list the domains in a provider's pool.

Is your domain wrongly listed?

If we list your domain by mistake, use the dispute form on its domain detail page or email us at support@istempmail.com. A person reviews every request. Most corrections involve domains that expired or changed owners and no longer route mail through disposable infrastructure.

It speeds things up if you include proof that you own the domain or may act on its behalf, for example by writing to us from an address on that domain. We unblock wrongly listed domains without it too, but it takes longer.

Accuracy and limitations

We have been detecting disposable email domains since 2015, and our accuracy is industry-leading. We usually block a new disposable domain the moment we first encounter it, or within minutes.

No method catches everything. These are the limits we know of:

Personal domains. Anyone can register a domain for their own use and point it at a throwaway inbox. We detect some of these from their infrastructure; others look like any private domain and pass every filter until they are used in an abusive pattern.
Patterns that emerge over time. Some domains look harmless at first, and only later does it become clear which provider uses them. We re-verify domains continuously to catch these as early as possible.
Changing DNS. DNS records change constantly. A domain detail page shows them as of its "Last verified" date, and a domain can change between checks.

Frequently asked questions

What is a disposable email address?

A disposable (or temporary, throwaway, burner) email address is an inbox created for single or short-term use, usually without registration, that expires after minutes to days. Disposable addresses are used to pass email verification without giving a real, reachable address — which is why services that give value in exchange for a working email address block them at sign-up.

Are disposable email addresses illegal?

No. Using a disposable email address is legal essentially everywhere, and there are legitimate privacy reasons to use one. Blocking them is equally legitimate: a service is free to require a reachable address at sign-up. The legal questions only start where disposable addresses are used for fraud — fake accounts, abuse of free tiers, evading bans — and then the problem is the fraud, not the inbox.