How Disposable Email Detection Works

In short. Detection almost never looks at your address. It looks at the domain after the at sign, and it does so in layers, from a cheap list lookup to an expensive behavioural score. Knowing which layer refused you explains why the same address sails through one site and bounces off the next.

Why the check is about the domain, not the address

Nothing on a signup form can tell that k7t2q@example.com is temporary by looking at k7t2q. Real people pick strange names, and throwaway services hand out perfectly ordinary ones. So every practical check works on the part after the at sign instead.

This single fact explains most of what follows. It is why a service like this one runs many domains rather than one. It is why a domain that gets flagged takes every address on it down at once, no matter how careful the individual user was. And it is why the fix, from the operator's side, is never clever naming: it is having somewhere else to move.

What the six layers actually are

Detection is not one test. In rising order of cost to the site running it:

A list of known domains. A text file of a few thousand names, checked against the part after the at sign. Instant, free, and by far the most common implementation.

An MX lookup. Does the domain have mail servers at all? A domain with no MX record cannot receive mail, so an address on it is either a typo or a joke.

An SMTP probe. The site opens a conversation with the receiving mail server and asks whether that specific mailbox exists, without sending anything.

Domain age and registration data. A domain registered eleven days ago with privacy protection and no website behaves differently from one that has existed for nine years. Age is one of the strongest signals available and one of the hardest to fake, because the only way to have an old domain is to have waited.

Sending reputation. Large validation vendors see mail flowing across many customers. A domain that receives thousands of one-time codes and never sends anything back has an obvious shape. The same vendors watch which abandoned mailboxes turn into traps that punish the sender, which is where most of the hostility to throwaway domains actually comes from.

Behavioural scoring on the form itself. Not the address at all: how fast the form was filled, whether the fields were pasted or typed, whether the same IP opened forty accounts this week. The email is one input among twenty.

What each layer catches and what it misses

The list layer catches the well known services and misses everything new. Its weakness is structural: a list can only contain what someone has already added.

The MX layer catches nonsense and nothing else. Any working service has MX records, because receiving mail is the entire point.

The SMTP probe catches addresses that genuinely do not exist. It is also the layer that produces the most wrong answers, which is worth its own section.

Domain age catches new operations and punishes the innocent along with them. Every legitimate company that registers a domain and starts hiring immediately looks exactly like a throwaway service for its first few months.

Reputation catches established services accurately and needs commercial data to work at all, so it appears mostly in paid validation products.

Behavioural scoring catches abuse rather than disposability. It is the only layer that measures the thing sites actually care about, which is why serious operations lean on it and treat the email domain as a minor input.

Why the SMTP probe lies so often

Three common configurations make the answer meaningless.

A catch-all domain accepts mail for every possible address, so the probe is told that anything@company.com exists. Plenty of small businesses run this way, and the probe reports a valid mailbox for names nobody has ever used.

Greylisting answers the first attempt from an unknown sender with a temporary failure by design, expecting a legitimate server to retry. A validation probe that does not retry reads this as a rejection.

Large providers deliberately answer identically for existing and non-existing mailboxes, because honest answers would turn every mail server into a directory of its users. Against those providers the probe returns nothing useful at all.

The result is that a check meant to confirm reality regularly produces the opposite, and forms built on it reject real customers. That failure mode is common enough to be worth its own discussion.

What this looks like from our side

We run this service, so we watch the cycle from the inside, and it is the same every time.

A domain enters rotation and passes essentially everywhere. Nothing distinguishes it yet. Over weeks, sites that check lists start refusing it, one at a time, which users experience as randomness. Then refusals go from occasional to routine, usually after the domain appears in one of the widely copied public lists, because the lists copy from each other. At that point the domain is spent for signup purposes.

None of this is guesswork or a theory about how detection might work. It is the observable lifecycle of every public domain in this category, ours included, which is why we describe domains as stock that burns rather than pretending they are permanent.

Why an undetectable public service cannot exist

Every service in this category has to publish its domains, because users have to pick one. A page that lists domains for a human reader lists them just as clearly for a script that visits daily and adds anything new to a blocklist.

There is no way around this that keeps the service usable. Hiding domains behind a login shrinks the audience to people who already signed up. Rotating faster burns supply faster. The only real mitigation is not publishing every domain publicly, which is why some are reserved for signed in users: an unpublished domain reaches the scrapers later, not never.

Anyone advertising undetectable disposable addresses is either selling private domains that will be detected once enough people use them, or not telling the truth.

What "your domain was not accepted" actually means

It means one specific site consulted one specific source and found the domain there. It does not mean the domain is broken, that mail to it fails, or that every other site will refuse it. Mail keeps arriving normally; a form simply declined to accept it as a contact address.

Practically, the same address will keep working on sites that use a different list or no list at all, and switching to another domain usually resolves it in seconds. What will not help is asking for removal from a blocklist. The entry is accurate, the maintainer knows it is accurate, and the request is refused politely if it is answered at all.