10minemail How disposable-email blocklists work
When a form says your address is invalid, it often did not parse the string. It asked a list. Disposable-email blocklists are databases of domains (and sometimes MX hosts) that someone decided are throwaway. This page explains how those lists tend to work. It is not a guide to getting off them, staying off them, or sneaking around them.
I run a disposable domain. I have opinions. I also have a line: documenting evasion helps abusers more than it helps people avoiding newsletters.
What a list actually stores
The cheap lists are domain strings: example-temp.com, mailinator.com, and thousands of cousins. The check is: take everything after @, lowercase it, see if it is in a hash set. That is fast enough to run on every signup.
Better lists add:
- MX hostnames (where the mail would land)
- known IP ranges of temp-mail hosts
- wildcards and catch-all patterns
- “this domain was seen in a burst of fraudulent signups this week”
Once a domain is in the set, jane.morris@ and x9k2@ fail the same way. Our professional-looking names are for filters that never got as far as a list.
How domains get on a list
Self-identification. If your website is named 10 minute mail and you publish a public inbox, researchers will add you. That is fair.
MX clustering. If twenty “unique” domains all point mail at the same handful of hosts, listing the hosts catches the next domain you register tomorrow. This is why domain rotation is a weak strategy.
Signup telemetry. A company that got burned by trial abuse will list whatever domain showed up in the fake accounts. They may share that with a vendor. You will never see a ticket.
Public research dumps. People scrape temp-mail homepages and dump the domain list on GitHub. Those dumps are messy (they include dead domains and innocent lookalikes) and they propagate forever.
Paid intelligence. Commercial APIs sell “is this disposable?” as a yes/no with a confidence score. The customer does not maintain the list. They just call the API.
False positives are part of the design
University alumni domains, small company domains, and new providers get listed by accident. The vendor would rather block a few innocents than miss a temp-mail host. If you run a real mailbox on a new domain, you already know this pain. Disposable mail users meet the same machinery from the other side.
Appeals exist for real businesses. They do not exist for a 10-minute inbox. I will not pretend we can “whitelist” you at Netflix.
What 10minemail chooses not to do
We do not rotate profemail.co.uk every week. Rotation is how you end up in every dump at once and look like a fraud toolkit.
We do not publish which sites currently accept the domain. That list becomes a targeting guide and it is stale by Thursday.
We do not mix in unrelated catch-all domains to confuse MX checks. Catch-all vs temp mail explains why those are different products — and why mixing them is a red flag.
We do not offer an API for bulk generating addresses. Bulk generation is how blocklists get their burst signal.
What you can do as a user
Use a throwaway where lists are unlikely: small sites, PDF gates, hobby forums that have not bought an API.
Use a real mailbox where lists are certain: banks, big SaaS, anything with a fraud team.
If a mid-size site blocks you, believe them. New address once. Then stop. The rest is why sites block disposable email.
If you run a website and you are thinking of blocking us: block the domain, not a regex that catches every .co.uk address. Crude regexes hurt ordinary people and miss the next hex domain anyway.
Lists are a policy instrument
A blocklist is not a law of physics. It is a company deciding that a class of users is not worth the abuse. You can disagree. You cannot force the enqueue.
I built 10minemail to make the remaining honest use — one-off codes, spam avoidance — less painful on sites that still allow it. I did not build it to win an arms race. Arms races end with everyone in a list and a worse internet.
Living with a listed domain
profemail.co.uk will be listed in some places and not in others. That split will change without notice. I will not chase every list. I will keep the product useful on sites that still allow ordinary one-off mail, and I will keep the “no” cases documented so people do not treat a red form error as a puzzle.
If you run a small site and you are blocking disposable mail with a regex you found on a blog in 2019, consider whether you are blocking .online domains, plus signs, or actual abuse. Crude rules have a body count. A maintained domain list plus velocity checks is usually enough.
If our domain is being used to attack someone, email hello@10minemail.online with headers. That is a list I will act on.