Endpoint

GET https://emaildomaincheck.com/api/email-domain/{domain}

Example

curl https://emaildomaincheck.com/api/email-domain/mailinator.com

{
  "domain": "mailinator.com",
  "disposable": "confirmed",
  "blocklists": ["disposable-email-domains blocklist", "disposable/disposable daily aggregate", "FGRibreau/mailchecker"],
  "blocklists_tracked": 4,
  "free_provider": false,
  "checked_at": "2026-09-13T09:00:00+00:00"
}

Integration snippets

// Express signup middleware
app.post('/signup', async (req, res, next) => {
  const domain = String(req.body.email).split('@').pop().toLowerCase();
  const v = await fetch('https://emaildomaincheck.com/api/email-domain/' + domain).then(r => r.json());
  if (v.disposable === 'confirmed') {
    return res.status(422).json({ error: 'Please use a permanent email address.' });
  }
  req.requireEmailConfirmation = v.disposable === 'reported';
  next();
});

Prefer zero network calls? Ship the list with your app instead; it is free for commercial use. Time your cache: the dataset rebuilds daily.

Fields

FieldMeaning
disposableconfirmed (vetted list or 2+ sources), reported (single list - soft-verify, don't hard-block), or no
blocklistsNames of the community lists carrying the domain, out of 4 tracked
free_providertrue for personal-mailbox providers like gmail.com - real users, not disposable
matched_domainThe listed domain that matched - equals the parent when you query a subdomain of a listed service (x.mailinator.com matches mailinator.com)
first_seenDate the domain entered our dataset, when it appeared after tracking began (null for long-established entries) - fresh domains are the highest-risk ones
mx_activeWhether the domain could receive mail at our last DNS sample (MX, or A/AAAA implicit-MX fallback). null = not yet sampled. Our own rolling verification, not part of any upstream list

Privacy contract

Send only the part after the @. If a full address reaches the endpoint anyway, everything before the @ is discarded before processing; requests are answered with no-store and inputs are never logged. For zero-network checking, download the list (rebuilt daily, free for commercial use) or use the browser-side bulk checker.

Limits

30 requests/minute and 500/day per IP, no key needed. That comfortably covers signup-form validation for most sites; if you need more, the downloadable list removes the network call entirely.