Which Disposable Email Domains Are Actually Blocked? We Measured 64,609 of Them

Anyone who has used a temporary email address has met the same wall: you paste the address into a signup form, and the site answers "please enter a valid email address." The address is perfectly valid. It simply appears on a list somewhere.

Those lists are public, and they can be measured. So we did. On 23 September 2026 we downloaded four of the most widely used disposable-email blocklists, queried the Kickbox public API, and checked ten temporary email domains against all of them — including our own.

The results were not what we expected. The lists disagree with each other far more than they agree.

What we measured, and how

We used four blocklists that are freely available and widely embedded in signup-validation code, plus one commercial API with a free public endpoint.

The raw sum is 79,005 entries, but that overstates the real coverage. Two findings shrink it:

The martenson list is an exact mirror. Its 8,966 entries are byte-for-byte the same set as disposable-email-domains. Anyone counting it as an independent source is counting the same list twice — which, given how often both are cited side by side, probably happens a lot.

After removing duplicates, 64,609 unique domains remain. And of those, only 324 domains appear on all four lists — around half of one percent.

That last number is the interesting one. It means there is no such thing as the disposable email blocklist. A site that blocks you is blocking you according to one particular list, and a different site using a different list may let the same address through without complaint.

The results

Each domain checked against every source. "—" means absent from that list.

Every established service is on at least four of the five. The five oldest and best known — Temp Mail, Guerrilla Mail, Sharklasers, Mailinator and YOPmail — are on all of them, without exception.

Why we are not on any of them

We are going to be direct about this, because the honest explanation matters more than the flattering one.

ghostmails.cc is absent from every list primarily because it is new and small. These lists grow by observation: maintainers spot a domain being used at scale for throwaway signups, someone opens a pull request, and the domain is added. A service that has existed for a few months, on a single domain, with modest traffic, has not yet triggered that process.

This has a practical consequence today. A Ghostmails address passes signup forms that reject @mailinator.com or @temp-mail.org outright, because the form is consulting a list our domain is not on. If you have been bounced off a registration page by a disposable-address check, that is a real, measurable difference — not a marketing claim.

It also has an expiry date. If the service keeps growing, ghostmails.cc will eventually be listed, exactly as every service in the table above was. We would rather tell you that now than have you discover it later. We will re-run this measurement and update this page, so the table reflects reality rather than the day we happened to publish it.

How blocklists actually decide

Understanding the mechanism explains the disagreement.

Community submission. Most public lists are GitHub repositories accepting pull requests. A domain lands there because a person noticed it. This is why coverage is uneven: it tracks visibility, not behaviour.

MX record inspection. Some validators look at where a domain's mail is routed. Many disposable services point thousands of throwaway domains at the same mail servers, which makes them detectable in bulk. This catches domain farms and misses single-domain services.

Heuristics and commercial scoring. Paid APIs combine lists with signals such as domain age, traffic patterns and registration data, then return a risk score rather than a yes/no. This is why a domain can be absent from every public list and still be flagged by a vendor — and why our disposable: false result from Kickbox is a data point, not a guarantee.

Private in-house lists. Large platforms maintain their own, informed by what they actually observe on their signup forms. These are invisible from the outside and are not represented in our measurement at all.

What to do when an address is rejected

If a form refuses a temporary address, the block is on the domain, not on you, and there is no trick that fixes it honestly. Your options are to use a real address for that service, or to decide the service is not worth the registration.

That second option is more often the right one than people assume. A site that requires an email address, refuses disposable ones, and offers nothing you need in return has told you something about how it intends to use the address.

What we would ask you not to do is treat blocklist evasion as the goal. Services block disposable addresses for reasons that are sometimes legitimate — abuse, trial farming, fraud. Ghostmails is receive-only and cannot send mail precisely so that it cannot become a tool for that kind of thing.

Limits of this study

Stating these plainly, because a measurement without its caveats is just an advertisement.

• Public lists are not every list. Large platforms use private ones we cannot see. Absence from all four public lists does not mean a domain is universally accepted.
• One commercial API, not all of them. Kickbox is one vendor among several. Others may classify differently.
• A snapshot, not a trend. These lists change continuously. Everything here reflects 23 September 2026.
• Presence on a list is not the same as being blocked. It means sites using that list can block you. Many integrate a list and never enable it.

Reproducing this

The measurement is four HTTP requests and a set intersection. Anyone can check our numbers, and we would rather they did:

import subprocess

LISTS = {
    "disposable-email-domains": "https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/master/disposable_email_blocklist.conf",
    "mailchecker": "https://raw.githubusercontent.com/FGRibreau/mailchecker/master/list.txt",
    "martenson": "https://raw.githubusercontent.com/martenson/disposable-email-domains/master/disposable_email_blocklist.conf",
    "fakefilter": "https://raw.githubusercontent.com/7c/fakefilter/main/txt/data.txt",
}

def fetch(url):
    out = subprocess.run(["curl", "-sS", url], capture_output=True, text=True)
    return {line.strip().strip('",').lower() for line in out.stdout.splitlines()
            if line.strip() and not line.startswith("#")}

lists = {name: fetch(url) for name, url in LISTS.items()}
domain = "ghostmails.cc"
for name, entries in lists.items():
    print(name, len(entries), domain in entries)
print("unique:", len(set().union(*lists.values())))
print("on all four:", len(set.intersection(*lists.values())))

The Kickbox lookup is a single request: https://open.kickbox.com/v1/disposable/<domain>.

The takeaway

Disposable email blocking is far less coordinated than it looks from the outside. Four widely used lists share only 324 domains out of 64,609. One of the four is a copy of another. A domain's presence depends mostly on whether a maintainer noticed it.

If you want to understand what a temporary address can and cannot do, are temporary emails safe covers the security side, and how it works explains what happens to a message after it reaches a Ghostmails address.

Measured 23 September 2026. We intend to re-run this and update the table; if the numbers here are stale, tell us.