Spot throwaway emails
Free trials, referral programs and one-per-user discounts all quietly assume one thing: one person equals one email address. Disposable inboxes break that assumption in seconds, letting a single person cycle through dozens of accounts. This API flags addresses from known temporary-email domains before they ever make it past your signup form.
Run it online
Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.
The abuse pattern behind this
Temporary email services exist for a legitimate reason — avoiding spam when signing up for something you'll use once — but that same convenience is exactly what makes them a favorite tool for trial abuse, referral fraud and fake account creation at scale. A user who wants to claim a promo three times, or a bot farming referral bonuses, doesn't need real inboxes; a throwaway domain that self-destructs in an hour is enough, and it's indistinguishable from a legitimate address by syntax alone.
How detection actually works
The check runs the domain of a submitted email against a maintained list of known disposable and temporary-email providers — the mailinator-style services and their many lookalike clones — and returns whether it matches. This is fundamentally a domain reputation lookup, not a mailbox test, so it's fast and doesn't depend on the target server responding to anything.
Why this list needs upkeep
New disposable-email domains appear constantly, often as small variations or entirely new services, which is why a static blocklist written once quickly goes stale. Treating this as a maintained service rather than a one-time hardcoded list is what keeps the detection useful six months from now instead of only on the day it was written.
What it's not meant to catch
This endpoint identifies known disposable domains — it doesn't verify whether a non-disposable address is syntactically valid or whether its domain can actually receive mail. Pair it with syntax validation and MX-record checking when you need a complete picture, and use this one specifically as the layer that stops the 'sign up, abuse, discard' pattern.
Fitting it into a signup flow
Because it's a single fast lookup, it belongs early in registration — right alongside or immediately after basic format validation, before an account or trial entitlement is ever created, so the block happens at the cheapest possible point rather than after damage is already done. Run it before provisioning any resource tied to a new signup — storage quota, a trial API key, a referral credit — since reversing those grants after the fact is far messier than declining the registration up front.
What you can do with it
Free trial and freemium signups
Block registrations from known disposable domains to stop the same person from claiming a trial repeatedly under different throwaway addresses.
Referral and promo programs
Prevent referral bonuses or one-time discount codes from being farmed through dozens of temporary-email accounts.
Community and forum registration
Reduce low-effort spam and sockpuppet accounts by refusing signups from addresses tied to disposable-email services.
Lead form quality control
Filter out contact form submissions using throwaway addresses, which rarely represent a genuine prospect worth following up with.
FAQ
What counts as a disposable email domain?
Domains belonging to known temporary or throwaway email services — providers designed for short-lived, often single-use inboxes.
Does the disposable email checker API verify if the mailbox is real?
No, it checks whether the domain matches a known disposable-email provider; combine it with syntax and MX checks for a full validity picture.
Is this disposable email checker API free to use?
There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.
How much does each check cost?
$0.002 per request, billed only on successful completion of the task.
How current is the list of disposable domains?
It's actively maintained, since new temporary-email services and domain variants appear regularly and a stale list quickly loses effectiveness.
How do I receive the result?
The check runs asynchronously: a task_id is returned immediately, and the result follows via a signed webhook or a signed link valid for 24 hours.
Can this run on every signup in real time?
Yes, it's a single fast lookup designed to sit directly in the registration flow before an account is created.
Will it flag legitimate business email addresses as disposable?
No — it matches only against domains known to be temporary-email services, not ordinary business or personal domains.
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/verify/email-disposable \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"items":["valor-1","valor-2"]}'const res = await fetch("https://api.kit.forhosting.com/verify/email-disposable", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"items": [
"valor-1",
"valor-2"
]
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/verify/email-disposable",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"items": [
"valor-1",
"valor-2"
]
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/verify/email-disposable", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"items":["valor-1","valor-2"]}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/verify/email-disposable", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"items": [
"valor-1",
"valor-2"
]
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "verify.email_disposable",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |