You offer a free guide, a discount or a waitlist spot in exchange for an email address, and a good share of what comes back is xk2j9@10minutemail.com: an inbox that will be gone before your first email arrives.
This guide explains how to block disposable email addresses in your forms, why a verification code doesn't do it on its own, and which “anonymous” addresses you should still accept.
What is a disposable email address?
A disposable (or temporary, or throwaway) email is an inbox created in one click on a site such as 10minutemail, Mailinator or Guerrilla Mail. It receives mail for minutes or hours, needs no sign-up and is often readable by anyone who knows the address.
People use them for understandable reasons: to grab a download without joining a mailing list, to try a product without the follow-up emails. Bots use them because they're free and endless.
What they cost you
- Leads you can't reach. The address works for the download link, then disappears.
- Bounces. Mail to dead inboxes bounces, and a high bounce rate hurts how inbox providers treat everything else you send.
- Inflated numbers. Waitlists and sign-up counts look bigger than the audience really is.
- Offer abuse. One person claims a first-order discount or free trial many times over.
Why a verification code alone isn't enough
A one-time code proves the person can read the inbox they typed. A throwaway inbox can read it too: the code arrives on the temporary site, they copy it, and the form accepts it. Codes are still worth using, because they stop typos and made-up addresses, but they don't tell you the address will exist tomorrow. You need both.
| Check | Stops typos | Stops made-up addresses | Stops disposable inboxes |
|---|---|---|---|
| Format check (has an @ and a domain) | Some | No | No |
| Email code or Google sign-in | Yes | Yes | No |
| Disposable domain blocklist | No | No | Yes |
| Code + blocklist | Yes | Yes | Yes |
How to block them
Check the domain on the server, at submit
Take everything after the @ and compare it with a list of disposable email services. Check parent domains too: abc.10minutemail.com belongs to 10minutemail. Do it on the server when the response arrives, since a check that only runs in the browser can be skipped.
Use a list someone maintains
New throwaway domains appear every week. A hand-kept list of the big services plus a community-maintained list (thousands of domains) catches far more than anything you write down yourself, as long as it's updated.
Refuse with a message, not silently
Accept the response and quietly drop it, or show a generic error.
Refuse it on the email question: “Temporary email addresses aren’t accepted. Use an address you check.”
Many people use a throwaway address out of habit and will happily switch when asked. A specific message gets you their real address; a silent drop gets you nothing and an annoyed visitor.
What not to block
Forwarding and alias services such as Apple's Hide My Email, Firefox Relay and SimpleLogin give people a private address that forwards to their real inbox. Mail you send them reaches a person who chose to protect their privacy, often your most careful customers. Blocking them costs you real sign-ups, so leave them off the blocklist.
Equally, don't block Gmail, Outlook or Yahoo on a consumer form: that's where most real people have their address.
Business emails only (for B2B forms)
If you sell to companies, a work address tells you who the lead works for and that they're asking on the company's behalf. Refusing the big free providers on demo, quote and trial forms is a strong filter. Say so in the message (“Use your work email address”) and expect fewer, better leads. Don't use it where freelancers and very small businesses are your buyers; many of them run on Gmail.
In Tapzy
- Block temporary email addresses is on for every Email question unless you switch it off. Over 9,000 throwaway email services are refused, with a message on the question so people can correct it.
- Business emails only refuses Gmail, Outlook and the other big free providers with “Use your work email address”.
- Both match the domain and every domain above it, and both are checked on the server when the response is sent.
- Forwarding services like Hide My Email, Firefox Relay and SimpleLogin are left out on purpose.
- Add an email code or Google sign-in to stop typos and made-up addresses too.
- Block a specific sender or domain from any response in one click; those are kept quietly as spam.
More on the rest of the filter in spam protection, or read how to stop bot sign-ups.