Disposable email detection for every signup.

ShieldMX tells you whether a signup email comes from a disposable provider. You send one address and get back JSON with a recommendation of ALLOW or REJECT, the domain, and the reason.

One HTTPS request. Nothing to install or host.

Live signup check
Loading list
Pipeline
Syntax (RFC 5322)—
Domain—
Blocklist lookup—
—
Response

          
AddressMatched onResult
  1. Checks appear here as they run.
Checked 0 · Rejected 0 Same rules and list as the API, run in your browser

Built for signup and trial flows

RFC 5322 syntaxExact domain matchRefreshed dailyJSON responses9,900+ disposable domains

Find the fake, then stop it at signup.

Every address goes through the same three steps. Select a step to see what it does.

  • Syntax check

    Input is trimmed and lowercased, then matched against an RFC 5322 pattern. Malformed input returns a 400 with an error code.

  • Domain isolation

    The part after the @ is taken as the domain and matched exactly. A listed parent domain does not cover its subdomains.

  • Blocklist lookup

    The domain is checked against the disposable list. The response carries ALLOW or REJECT, and your code decides what happens next.

Input
Someone@TempMail.ninja
Trim and lowercasedone
RFC 5322 patternvalid

One domain, every alias.

Throwaway providers hand out endless addresses on one domain. Matching the domain catches all of them, including the ones nobody has seen yet.

someone@mailinator.com
test123@mailinator.com
new.user@mailinator.com

Blocked by domain

A single entry rejects every address on the provider, not just one.

lead@example.com
sales@example.com
ops@acme-logistics.io

Real domains pass

Addresses on domains that are not listed go through with an ALLOW.

503 check did not run
retry then decide

Never a silent allow

If a check cannot run, the API says so. Your flow retries instead of letting the address through.

How it works

From request to decision in four steps.

01

Request

Your backend posts the address with its bearer key.

02

Authenticate

The key is verified and cached for a few minutes.

03

Check

Syntax, domain and list are checked, in that order.

04

Decide

ALLOW or REJECT returns in one JSON response.

Developers

Call it from your server before the account exists.

Send one request, branch on one field. Keep the key on the server.

Request
# Check one address
curl -X POST https://shieldmx-core-api.slotboard-v.workers.dev/v1/verify \
  -H "Authorization: Bearer $SHIELDMX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "someone@mailinator.com"}'
ResponseREJECT
{
  "valid_syntax": true,
  "email": "someone@mailinator.com",
  "domain": "mailinator.com",
  "disposable": true,
  "recommendation": "REJECT",
  "evaluated_at": 1792848000
}
ResponseALLOW
{
  "valid_syntax": true,
  "email": "lead@example.com",
  "domain": "example.com",
  "disposable": false,
  "recommendation": "ALLOW",
  "evaluated_at": 1792848000
}

Pricing

Start free. Pay when signups grow.

FreePlanned
$0/ month

For side projects and early launches.

  • 500 requests a month
  • Full disposable domain detection
  • Daily list refresh
Start free

Planned launch pricing. It may change before general availability.

FAQ

Questions, answered.

What is a disposable email address?

A disposable email address is a temporary inbox from a provider that issues addresses on demand and discards them after a short time. People use them to sign up for free trials and free tiers without giving a real address.

How does ShieldMX detect a disposable email?

ShieldMX checks the address syntax against an RFC 5322 pattern, takes the part after the @ as the domain, and matches that domain exactly against a list of known disposable providers. The result is returned as ALLOW or REJECT.

How current is the disposable domain list?

It is refreshed once a day from a public upstream source. Between refreshes the service keeps serving the last good copy.

Does a listed domain block its subdomains?

Not yet. Matching is exact, so only the listed domain is caught. Subdomain matching is planned.

What happens if ShieldMX cannot check an address?

It returns 503 with an error code instead of allowing the address. Your flow can retry, or fall back to its own rules.

Are the addresses I check stored?

The verify endpoint does not write the address to storage. The stored data is the blocklist.

How do API keys work?

API keys are issued and verified by ShieldMX. Revoking a key stops it working on the next check.

Stop paying for fake signups.

Get early access and start checking addresses in your signup flow.

heysharad@proton.me