Updated · Volt Ghost team
Why sites check at all
Most sites don't mind privacy. What they want to avoid is abuse at scale: thousands of fake accounts created to claim sign-up bonuses, spam comment sections, or skew reviews. Throwaway domains are an easy signal to start with, so many sign-up forms filter them, sometimes bluntly.
1. Domain blocklists
The most common method. The site keeps a list of domains known to belong to temporary email services and rejects any address on it. Community lists on GitHub track thousands of domains; the open disposable-email-domains list, which our own checker uses, holds just under ten thousand at the moment.
- Strengths: fast, free, no network calls at sign-up time.
- Weaknesses: lists go stale. New services aren't on them yet, and some entries are false positives (a small company's real domain listed by mistake).
We're upfront about this one: our domains, mailghost.cyou and mailghost.cfd, are on our own checker's list on purpose, and any site whose blocklist includes them will refuse them. Realistic-looking names help with other checks, not this one.
2. MX record lookups
Every domain that receives mail publishes MX records saying which servers accept it. A site can look these up and flag domains whose mail goes to servers known to host disposable services. This catches services that rotate through many new domains, because the domains change but the mail servers often don't. It needs a DNS lookup during sign-up, and it can misfire when legitimate domains use the same big email providers.
3. Domain age and reputation
Domains registered a few days ago are more often used for abuse, so some fraud tools treat very young domains as risky. Reputation services also score domains by the behaviour they've seen across many sites. This is more of a weighting than a hard block.
4. Address patterns
Random strings like x7kq2vb9@… look machine-made. Some filters score the local part (before the @) for randomness, digit runs and keyboard patterns. This is the check our Realistic style was built for, since emma.johnson92 reads like a person. It's also the least reliable check, because real people choose odd usernames too.
5. Behaviour and IP signals
Many sites care less about the address than about what happens around it: dozens of sign-ups from one IP address, data-centre or VPN ranges, the same device fingerprint behind many accounts, or forms filled in faster than a human types. These signals catch bots whether or not they use temporary email.
6. Verification itself
Sending a confirmation link proves the inbox can receive mail right now. It doesn't prove the inbox will exist next week, which is why some services re-verify later or ask for a phone number for higher-risk actions.
For site owners: blocking well
- Block where abuse actually costs you, such as free credits or trials, rather than on newsletters or one-off downloads.
- Say why in the error message, so honest users know what to do instead.
- Keep lists updated and allow a way to appeal false positives.
- Combine signals instead of trusting one. Rate limits and a bot check stop more abuse than a blocklist alone.
- Test your filter with a real disposable inbox, for example one from our testing page.
For users: if your address is refused
Don't keep trying different temporary domains on a site that clearly doesn't want them. If you'll use the account again, an email alias is the respectful middle ground: it's a lasting address that still hides your real one. Our temp mail vs alias guide explains the difference.