Disposable email detection for every signup.
ShieldMX tells you whether a signup email comes from a disposable provider. You send one address and get back JSON with a recommendation of ALLOW or REJECT, the domain, and the reason.
One HTTPS request. Nothing to install or host.
- Checks appear here as they run.
Built for signup and trial flows
Find the fake, then stop it at signup.
Every address goes through the same three steps. Select a step to see what it does.
-
Syntax check
Input is trimmed and lowercased, then matched against an RFC 5322 pattern. Malformed input returns a 400 with an error code.
-
Domain isolation
The part after the @ is taken as the domain and matched exactly. A listed parent domain does not cover its subdomains.
-
Blocklist lookup
The domain is checked against the disposable list. The response carries ALLOW or REJECT, and your code decides what happens next.
One domain, every alias.
Throwaway providers hand out endless addresses on one domain. Matching the domain catches all of them, including the ones nobody has seen yet.
Blocked by domain
A single entry rejects every address on the provider, not just one.
Real domains pass
Addresses on domains that are not listed go through with an ALLOW.
Never a silent allow
If a check cannot run, the API says so. Your flow retries instead of letting the address through.
How it works
From request to decision in four steps.
Request
Your backend posts the address with its bearer key.
Authenticate
The key is verified and cached for a few minutes.
Check
Syntax, domain and list are checked, in that order.
Decide
ALLOW or REJECT returns in one JSON response.
Developers
Call it from your server before the account exists.
Send one request, branch on one field. Keep the key on the server.
# Check one address
curl -X POST https://shieldmx-core-api.slotboard-v.workers.dev/v1/verify \
-H "Authorization: Bearer $SHIELDMX_API_KEY" \
-H "Content-Type: application/json" \
-d '{"email": "someone@mailinator.com"}'
// Node 18 or later
const res = await fetch("https://shieldmx-core-api.slotboard-v.workers.dev/v1/verify", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.SHIELDMX_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({ email }),
});
const result = await res.json();
if (result.recommendation === "REJECT") {
// Refuse the signup, or ask for another address
}
# pip install requests
import os
import requests
res = requests.post(
"https://shieldmx-core-api.slotboard-v.workers.dev/v1/verify",
headers={"Authorization": f"Bearer {os.environ['SHIELDMX_API_KEY']}"},
json={"email": email},
timeout=5,
)
res.raise_for_status()
if res.json()["recommendation"] == "REJECT":
... # Refuse the signup, or ask for another address
{
"valid_syntax": true,
"email": "someone@mailinator.com",
"domain": "mailinator.com",
"disposable": true,
"recommendation": "REJECT",
"evaluated_at": 1792848000
}
{
"valid_syntax": true,
"email": "lead@example.com",
"domain": "example.com",
"disposable": false,
"recommendation": "ALLOW",
"evaluated_at": 1792848000
}
Pricing
Start free. Pay when signups grow.
For side projects and early launches.
- 500 requests a month
- Full disposable domain detection
- Daily list refresh
For products with steady signup volume.
- 50,000 requests a month
- Same endpoint and response as Free
- Daily list refresh
Planned launch pricing. It may change before general availability.
FAQ
Questions, answered.
What is a disposable email address?
A disposable email address is a temporary inbox from a provider that issues addresses on demand and discards them after a short time. People use them to sign up for free trials and free tiers without giving a real address.
How does ShieldMX detect a disposable email?
ShieldMX checks the address syntax against an RFC 5322 pattern, takes the part after the @ as the domain, and matches that domain exactly against a list of known disposable providers. The result is returned as ALLOW or REJECT.
How current is the disposable domain list?
It is refreshed once a day from a public upstream source. Between refreshes the service keeps serving the last good copy.
Does a listed domain block its subdomains?
Not yet. Matching is exact, so only the listed domain is caught. Subdomain matching is planned.
What happens if ShieldMX cannot check an address?
It returns 503 with an error code instead of allowing the address. Your flow can retry, or fall back to its own rules.
Are the addresses I check stored?
The verify endpoint does not write the address to storage. The stored data is the blocklist.
How do API keys work?
API keys are issued and verified by ShieldMX. Revoking a key stops it working on the next check.
Stop paying for fake signups.
Get early access and start checking addresses in your signup flow.
heysharad@proton.me