Where should disposable email blocking happen?

Blocking should happen before account creation in a server route, authentication hook, or database policy. Browser validation is only a user-experience aid.

Open source developer protection · dataset v2026.08.27.1

Disposable Email Domain Blocklist

Q: What is a disposable email domain blocklist?

It is a maintained set of email domains associated with temporary mailboxes, used to stop disposable email signups at a server or database boundary.

Q: Does this block Gmail or Yahoo?

No. Gmail, Yahoo, ordinary free providers, aliases, and unknown domains are allowed by default. Only active disposable records with medium or high confidence are blocked.

Stop throwaway signups at the boundary that matters. Use evidence-backed domain records, a network-free TypeScript matcher, a CLI, and safe Supabase SQL generation.

Short answer: block only active disposable domains with medium or high confidence, keep an explicit allowlist for reviewed exceptions, and enforce the decision on the server before creating the user.

View the source on GitHub → Check a domain →

What developers get

Evidence, not mystery strings

Every active disposable record carries a source URL, evidence note, provider attribution when known, and verification dates.

Server-side by default

Use the same policy in Node, Next.js, or a Supabase Before User Created Hook. Client checks never replace enforcement.

False positives are a policy choice

Alias, role, free-provider, low-confidence, disputed, and unknown records are not blocked by default.

60-second quickstart

pnpm install
pnpm check
node cli/dist/bin.js check user@vtmpj.com
node cli/dist/bin.js check user@gmail.com --json

The current seed blocks vtmpj.com and its subdomains. An unlisted gmail.com result is allowed. See the checker guide for the stable JSON contract.

Which disposable email domains are blocked?

Current verified blocklist: 33 active domains are blocked exactly and for all subdomains. For example, mail.vtmpj.com is blocked because vtmpj.com has block_subdomains=true.

10minutemail.com · 10minutemail.one · cazlp.com · crazymailing.com · dustbin.one · emailnator.com · gonrr.net · guerrillamail.com · guerrillamail.de · guerrillamail.net · guerrillamail.org · guerrillamailblock.com · jbsze.com · jbsze.net · jetable.org · jjk.app · kjkpc.net · kuku.lu · lisemala.com · mailinator.com · moakt.com · mohmal.com · nicemail.cc · onldm.net · snaper24.com · temp-mail.io · temp-mail.org · temp-mail.sh · tempo.mintraccoon.com · vtmpj.com · vtmpj.net · with.lt · yopmail.com

Each active record has a source URL and evidence note in domains.json. vhm.cc and imail7.net remain disputed review candidates and are not blocked. Wildcards such as guerrillamail.* are represented as explicit, evidenced hostnames rather than an unsafe blanket wildcard. The canonical machine-readable list is domains.txt.

Integration guides

Supabase disposable email blocker

Preview a private-schema, RLS-protected Before User Created migration. No remote database is changed by the generator.

Next.js disposable email validation

Put the matcher in a route handler or server action, then return a stable public error code.

AI coding agent workflow

Install the same server-boundary and approval rules for Codex, Claude Code, and Cursor.

Frequently asked questions

What is a disposable email domain blocklist?

It is a maintained set of domains associated with temporary mailboxes, used to stop disposable email signups before an account is created.

Does this block Gmail or Yahoo?

No. Ordinary free providers, aliases, and unknown domains are allowed by default. Only active disposable records with medium/high confidence are blocked.

Where should blocking happen?

At a server route, auth hook, or database boundary. Browser validation is useful feedback but is not a security boundary.

Data freshness

Dataset version 2026.08.27.2 · last verified 2026-08-27 · 33 evidence-backed active records.