DEV Community: Twinkal

How to Block Disposable Emails at Signup (Free Temp Email Checker)

Twinkal — Mon, 21 Sep 2026 10:53:16 +0000

Stop throwaway signups before they bounce, burn free trials, and tank sender reputation.

Temporary inboxes are useful for privacy. They are expensive for anyone who sends email for a living.

A disposable address often dies within an hour. Every message you send after that is a hard bounce. Sustained bounce rates are how mailbox providers decide your domain belongs in spam — for every recipient, not just the throwaway ones.

If you run a SaaS free tier, a newsletter, or a product waitlist, disposable signups also inflate your metrics and farm your credits. The fix is simple: check the address at signup, before it lands in your database.

This guide covers when to block temporary emails, how a temp email checker works, and how to wire Reloop’s free public API into a registration flow.

What a temp email checker actually checks

A temp email checker (also called a disposable email detector) answers one question: is this address from a known throwaway provider?

Reloop’s free Temp Email Checker does more than a domain string match. On each request it:

Parses RFC syntax — malformed input never reaches the catalogue or DNS.
Matches ~210,000 disposable providers — including Mailinator, Yopmail, Temp-Mail, Guerrilla Mail, and 10MinuteMail, plus wildcard suffixes for providers that mint endless subdomains.
Flags role prefixes — info@, billing@, support@ are shared inboxes, not burners. They are reported separately so you can apply your own policy.
Looks up MX records — confirms the domain publishes a mail exchanger. That is routing evidence, not proof the mailbox exists.
Never opens an SMTP session — no mailbox probe, no stored addresses, no account required.

A disposable verdict means the domain is on the catalogue. A clear verdict means “not currently known to be disposable” — new temp-mail services appear constantly, so treat the check as a strong signal, not a lifetime guarantee.

For a deeper walkthrough of detection methods, see how to check if an email is disposable.

Why disposable emails damage deliverability

Mailbox providers track bounce rate as a core reputation signal. Industry guidance keeps hard bounces well under ~2%. Throwaway inboxes make that threshold easy to miss:

The mailbox is deleted minutes or hours after signup.
Your welcome email, password reset, or drip sequence hard-bounces.
Those failures are scored against your sending domain and IP.
Reputation damage spreads to legitimate recipients — password resets and receipts start landing in spam.

That is the same chain that ends with emails in the spam folder. Authentication (SPF, DKIM, DMARC) and IP warming matter — but none of them fix a list full of dead temporary addresses.

Prevention sits in front of bounce handling. Validate at signup, then suppress hard bounces immediately so dead temporary addresses never get a second send.

Signup abuse patterns a checker stops

Deliverability is one reason to block. Product abuse is the other.

Free trial farming

Without a check: unlimited throwaway accounts, unlimited trials.

With a checker: block at registration when isDisposable is true.

Coupon / referral fraud

Without a check: the same offer claimed with a new burner each time.

With a checker: reject or flag before the promotion is applied.

Waitlist inflation

Without a check: fake demand and useless launch emails.

With a checker: keep the list honest before you send.

Newsletter padding

Without a check: open rates collapse and engagement signals look terrible.

With a checker: suppress burners before the first campaign.

Multi-account bots

Without a check: shared disposable domains scale abuse cheaply.

With a checker: catch the domain family, including wildcard providers.

Role addresses (admin@, sales@) are a different problem: they are real and persistent, but shared. Reloop flags them separately so you can require a personal inbox without treating Gmail or Outlook as disposable.

When to block vs when to flag

Blocking every temporary email is not always the right product decision.

Block at signup when:

You offer a free trial, freemium tier, or usage credits
You run new-customer discounts or referral rewards
Fake accounts distort activation or retention metrics
You send transactional email and cannot afford bounce spikes

Flag or allow when:

Privacy-sensitive audiences expect anonymous access
The flow is feedback, bug reports, or one-off downloads
You will suppress later rather than reject at the door

A practical middle path: block disposable domains on paid or trial signup, and on newsletter forms either soft-warn or accept then suppress before campaigns. Pair the check with email confirmation and CAPTCHA so you are not relying on a single signal.

How to check an address with Reloop (free)

Option 1 — Use the web tool

Paste an address into the Reloop Temp Email Checker. You get a verdict, disposable match details, role and free-provider flags, MX hosts, confidence, and risk score — instantly, with no signup.

Examples:

alex@gmail.com — deliverable consumer mailbox (free provider, not disposable)
you@mailinator.com — disposable
demo@yopmail.com — disposable

Option 2 — Call the public API at signup

The checker is a thin wrapper over one public endpoint. No API key. No account. Rate limited per IP — keep it to signup-time checks, not bulk scrubbing.

POST https://reloop.sh/api/tools/v1/temp-email-checker

cURL

curl -X POST https://reloop.sh/api/tools/v1/temp-email-checker \
  -H "Content-Type: application/json" \
  -d '{"email": "you@mailinator.com"}'

JavaScript

// No SDK, no API key — it is a plain POST.
const res = await fetch(
  "https://reloop.sh/api/tools/v1/temp-email-checker",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ email: "you@mailinator.com" }),
  },
);

const result = await res.json();

Python

# pip install requests
import requests

result = requests.post(
    "https://reloop.sh/api/tools/v1/temp-email-checker",
    json={"email": "you@mailinator.com"},
).json()

A throwaway mailbox returns "verdict": "disposable" and "isDisposable": true:

{
  "input": "you@mailinator.com",
  "kind": "email",
  "domain": "mailinator.com",
  "verdict": "disposable",
  "isValidSyntax": true,
  "isDisposable": true,
  "disposableMatch": {
    "kind": "exact",
    "domain": "mailinator.com"
  },
  "isAllowlisted": false,
  "isRoleAddress": false,
  "isFreeProvider": false,
  "signals": {
    "syntax": "pass",
    "disposable": "fail",
    "role": "pass",
    "freeProvider": "pass"
  },
  "mxRecords": ["spool.mailinator.com"],
  "confidence": 0.99,
  "riskScore": 0.95,
  "flags": ["DISPOSABLE_DOMAIN", "PUBLIC_INBOX_DETECTED"]
}

Reject or challenge the signup when isDisposable is true. Optionally treat high riskScore or role addresses as soft warnings.

Need to clean an existing list rather than gate one registration? Use Reloop’s free email validator for syntax, disposable detection, live MX, and CSV cleaning (up to 1,000 rows) in one pass. For production volume and policy controls, see email validation on Reloop.

Layer checks that protect reputation end to end

Disposable detection is one layer. Strong signup hygiene stacks several:

Temp / disposable check — Temp Email Checker at account creation
List hygiene before campaigns — Email Validator
Authentication health — SPF, DKIM & DMARC checker and the setup guide
Inbox placement tests — Deliverability tester
Blocklist monitoring — IP & domain blocklist checker
Transactional quality — keep password resets and receipts on a dedicated subdomain with proper auth so the mail you do send deserves the inbox

Reloop is open-source email infrastructure. You can use the hosted tools, call the public checker API, or run Reloop yourself when you want the same checks on your own servers.

Frequently asked questions

Is blocking disposable emails legal?

Yes. Temporary email services are legal for users. Choosing not to accept them on your product is a normal terms-of-service and fraud-prevention decision — the same category as blocking known bot ASNs or requiring phone verification.

Will a temp email checker catch brand-new throwaway domains?

List-based detection only knows what is on the catalogue. Reloop resyncs roughly every two hours across ~210,000 providers, which catches most new services quickly, but a brand-new domain can slip through until it is listed. Combine the check with confirmation email and rate limits.

Does Reloop prove the mailbox exists?

No. MX lookup shows mail can be routed to the domain. Reloop never probes the mailbox over SMTP. That keeps the tool fast, privacy-friendly, and suitable for a public endpoint.

Is Gmail or Outlook disposable?

No. Free consumer providers are persistent. Reloop may flag them as free providers so you can apply your own rules; they are not treated as throwaway.

Temp email checker vs email validator — which should I use?

Use the temp email checker to block burners at signup (single address, public API). Use the email validator when you need bulk CSV cleaning, fuller health scoring, and export for campaign hygiene.

Next step

Run a known throwaway address through the free Temp Email Checker, then wire the same check into your registration handler with the public API above.

If you are already sending through Reloop — or evaluating open-source transactional email — start free at reloop.sh and keep disposable addresses out of the path that builds your sender reputation.

Originally published on the Reloop blog.

I Let My AI Assistant Read and Reply to My Emails for a Week. Here’s What Actually Happened.

Twinkal — Thu, 23 Jul 2026 09:15:51 +0000

An AI can write a perfect email in seconds. Having a real back-and-forth conversation is much harder.

Sarah runs a salon. She has an AI assistant that emails her customers when a slot opens up.

Last Friday, a customer canceled his booking. The assistant sent an email: "We have an opening tomorrow at 2 PM. Want it?"

The customer replied in a minute: "Yes, book it!"

The assistant never saw that reply. The slot stayed open. The customer never got a confirmation.

This happens more than people realise — not because it's hard to receive email, but because most setups were never wired to close the loop.

Sending is easy. Wiring the whole loop isn't.

To be fair, receiving and parsing email isn't some unsolved problem — providers like SendGrid, Mailgun, and Postmark have offered inbound email parsing for years. Point your domain at them, and they'll hand you the clean message.

But those webhooks only push the message once. There's no inbox to check back later, and no built-in way to link a reply to the right conversation. You have to build that part yourself — and you still can't run any of it on your own servers.

There's a second issue too. AI assistants sometimes send a slightly odd reply — nothing harmful, just a little off. Many managed email providers watch for exactly that pattern, and can suspend an account fast. One strange sentence, and Sarah's whole booking system could go dark with no warning.

What a real AI assistant needs

For an assistant like Sarah's to actually hold a conversation, a few things need to work together:

Replies need to land somewhere the AI can read them
They need to arrive clean, not messy
They need to stay linked to the right conversation
The AI needs to reply back from the same email address
All of it needs to run on infrastructure you control, not three different vendors

This is what we built Reloop for

Reloop puts that whole loop in one place, self-hosted.

When Sarah's customer replied "Yes, book it!", Reloop caught the reply, cleaned it up, and kept it linked to the right conversation. Sarah's assistant read it, checked the calendar, and sent back a confirmation — from the same salon email, so it felt like one normal conversation.

Reloop doesn't write anything itself. It just makes sure a reply doesn't disappear, and that a response can go out without a compliance system flagging it by mistake.

One honest note: right now, Sarah's assistant checks in for new replies rather than getting notified the instant one arrives — established providers like SendGrid already push replies via webhook. A push-based version for Reloop is coming next.

Owning it means watching it

None of this makes an AI assistant automatically safe.

If it ever sends something odd at scale, big providers like Gmail can still block the domain — that risk doesn't go away just because you self-host. What changes is who's responsible for catching it. You decide which addresses it can email, how many it can send per hour, and when a human needs to approve something before it goes out.

That's the real trade. Not "nothing can go wrong" — just "you're the one deciding what's allowed."

The takeaway

The AI writing a good reply was never the hard part. Holding a real, two-way conversation is.

If you're building something like Sarah's assistant, that's the part to get right first.

Check out Reloop on GitHub — it's open source and free to try.

The Hidden Cost of Saving $1000/Month: Our AWS SES Migration Story

Twinkal — Sat, 18 Jul 2026 06:02:03 +0000

4:00 PM on a Friday, a ticket came in from our highest-paying customer:

"None of our staff are receiving your system alerts."

I opened the AWS SES console expecting a quick answer.

Instead: no dashboard, no way to search admin@enterprise-client.com, just a line graph showing 14,000 emails sent, 200 bounced.

No idea which 200, or why.

The cause turned out to be an SPF record that no longer matched our sending setup after a domain migration weeks earlier. Nothing alerted us—we found it by opening bounces one at a time and reading raw headers in the console.

That afternoon is when it clicked:

SES is a sending engine, not a platform.

The cheap price tag doesn't include visibility.

You have to build that yourself.

What SES actually gave us

SES did exactly what it's designed to do.

It accepted mail, attempted delivery, and charged roughly $1 per 10,000 emails.

Against providers like SendGrid or Resend, that can easily look like hundreds of dollars per month saved.

What it didn't give us out of the box:

A way to look up one recipient and see what happened to their message.
Bounce reasons in a form support could use without reading SMTP headers.
Events we could act on without wiring AWS plumbing first.

Bounce and complaint data exists in SES—but it shows up as notifications you route through SNS, often into SQS, then into a Lambda (or similar) before you have anything resembling a searchable delivery log.

Want support to answer:

"Did this email bounce?"

You'll need to build an internal UI on top of that pipeline.

That's real engineering time spent recreating a feature most email products ship by default.

None of this makes SES a bad product.

It makes it a different product than the one we thought we were buying when we optimized for the invoice line.

The middle option isn't free either

Managed providers like SendGrid, Postmark, Loops, or Resend solve the Friday afternoon problem.

You can:

Search a recipient
Open a message
See a bounce reason
Subscribe to webhooks

...without standing up an event bus inside your AWS account.

They also come with two trade-offs that mattered for us:

Pricing that scales with volume—fine early, painful when send volume is part of the product.
Your users' email data lives on someone else's servers—acceptable for many apps, but a real constraint in healthcare, finance, or anywhere with data-residency requirements.

We didn't want "cheaper SES."

We wanted the investigation experience of a managed provider on infrastructure we controlled.

That's what Reloop is built to be.

What that Friday actually taught us

It's tempting to rewrite this story as:

"If only we'd had better monitoring, the SPF drift would never have hurt a customer."

That's not quite true.

And it's not a claim we'll make about Reloop either.

DNS changes are an operations problem.

After a migration, someone has to re-check that:

SPF
DKIM
DMARC

still match.

No platform pages you the week that drifts on its own.

The honest lesson from that Friday was narrower—and more useful.

When delivery fails, you should find out why in a few clicks—not spend an hour digging through AWS consoles.

We needed to:

Search a recipient
Open the message
Read a clear bounce reason
Move on to the DNS fix

SES made the first half of that afternoon expensive.

The SPF mismatch was the root cause.

The missing platform layer is what turned it into a fire drill.

What we built

That gap is why we built Reloop—open-source email infrastructure you can self-host with Docker or Kubernetes, or run with us.

For the SES pain specifically, Reloop gives you:

Delivery logs you can actually use—open a message, see status, bounce classification, and headers without digging through AWS consoles.
Recipient and contact activity—answer "What happened for this address?" without writing a custom lookup service.
HTTP webhooks for sent, delivered, bounced, delayed, and complained—one endpoint instead of SNS → SQS → Lambda.
Domain DNS setup and verification for SPF, DKIM, and DMARC, so after a migration you can quickly re-check the records that broke us.
Your data on your servers when you self-host—the same product shape, without a third-party mailbox for transactional content.

We're not claiming Reloop would have magically prevented that customer's outage.

We're claiming the investigation shouldn't have required raw header archaeology.

Owning the stack shouldn't mean rebuilding a dashboard from scratch.

The trade-off

SES is cheap and opaque until you build the missing pieces.

Managed providers are visible and convenient until volume pricing or data residency gets in the way.

Self-hosting trades the per-email bill for operational ownership.

You're on call for your own email infrastructure.

Queues
DNS
Deliverability
Upgrades

Those become yours.

If that trade fits your team, check out the Reloop GitHub repository setup docs.

If it doesn't, use a managed provider.

The Friday ticket is still a useful warning either way.

Optimize for the invoice, and you may end up paying in engineering hours and customer trust instead.

Go on, send that email.

→ Try Reloop