Disposable email domain detection

Disposable email addresses (mailinator.com, 10minutemail.com, guerrillamail.com) are created solely to bypass signup requirements and are abandoned immediately after use. Contacts from these domains never open, never click, and frequently expire — sending to them raises complaint rates and depresses engagement signals that ISPs use to classify your reputation. CWE-20 applies: accepting input you know to be functionally invalid is an input validation failure. High-volume disposable-address lists also skew A/B test results, distort open-rate reporting, and inflate subscription counts that feed into billing tiers or investor metrics.

Add a disposable domain check at the ingest point using the disposable-email-domains npm package as a baseline, supplemented by an API service for real-time coverage:

import disposableDomains from 'disposable-email-domains'

function isDisposable(email: string): boolean {
  const domain = email.split('@')[1]?.toLowerCase()
  return domain ? disposableDomains.includes(domain) : false
}

// In your ingest handler:
if (isDisposable(email)) {
  return res.status(422).json({ error: 'Disposable email addresses are not accepted' })
}

The disposable-email-domains package covers ~10,000 domains but is updated only at npm release cadence. For production lists above 10k contacts/month, complement it with ZeroBounce or Kickbox API calls that maintain real-time lists. Reject at signup rather than quarantining — quarantine segments require ongoing maintenance and often go unsuppressed.