Endpoint

GET https://emaildomaincheck.com/api/email-domain/{domain}
MethodEndpointAuth
GET /api/email-domain/{domain} None required for the free per-IP allowance. An IPNOVA API key (free account at api.ipnova.com) applies your plan allowance instead: send it as the X-Api-Key header or the ?key= query parameter. Keyed responses carry X-Credits-Remaining and X-Credits-Used.
GET /openapi.json Machine-readable spec: /openapi.json

Plans

One key. Twelve APIs.

A free IPNOVA API account gives you 5,000 lookups a month across every API below, 60 a minute, no card, for evaluation and small projects. Paid plans from $19 a month for production volumes, with a commercial licence and a hard cap instead of overage billing.

Card BINVINSWIFT/BICIBANHS tariffDisposable emailIP dataPhoneHolidaysMAC vendorPostal codeAirport
Create your free key

Takes a minute. Send it as X-Api-Key or ?key=.

Without a key this API answers 100 requests a day per IP address, for evaluation and personal use. Try it: curl https://emaildomaincheck.com/api/email-domain/mailinator.com

Example

curl https://emaildomaincheck.com/api/email-domain/mailinator.com

{
  "success": true,
  "domain": "mailinator.com",
  "disposable": "confirmed",
  "matched_domain": "mailinator.com",
  "blocklists": ["disposable-email-domains blocklist", "disposable/disposable daily aggregate", "FGRibreau/mailchecker"],
  "blocklists_tracked": 4,
  "free_provider": false,
  "first_seen": null,
  "mx_active": null,
  "checked_at": "2026-09-16T06:24:49+00:00",
  "docs": "https://emaildomaincheck.com/email-api"
}

Integration snippets

// Express signup middleware
app.post('/signup', async (req, res, next) => {
  const domain = String(req.body.email).split('@').pop().toLowerCase();
  const v = await fetch('https://emaildomaincheck.com/api/email-domain/' + domain).then(r => r.json());
  if (v.disposable === 'confirmed') {
    return res.status(422).json({ error: 'Please use a permanent email address.' });
  }
  req.requireEmailConfirmation = v.disposable === 'reported';
  next();
});

Prefer zero network calls? Ship the list with your app instead; it is free for commercial use. Time your cache: the dataset rebuilds daily.

Fields

FieldMeaning
disposableconfirmed (vetted list or 2+ sources), reported (single list - soft-verify, don't hard-block), or no
blocklistsNames of the community lists carrying the domain, out of 4 tracked
free_providertrue for personal-mailbox providers like gmail.com - real users, not disposable
matched_domainThe listed domain that matched - equals the parent when you query a subdomain of a listed service (x.mailinator.com matches mailinator.com)
first_seenDate the domain entered our dataset, when it appeared after tracking began (null for long-established entries) - fresh domains are the highest-risk ones
mx_activeWhether the domain could receive mail at our last DNS sample (MX, or A/AAAA implicit-MX fallback). null = not yet sampled. Our own rolling verification, not part of any upstream list

Privacy contract

Send only the part after the @. If a full address reaches the endpoint anyway, everything before the @ is discarded before processing; requests are answered with no-store and inputs are never logged. For zero-network checking, download the list (rebuilt daily, free for commercial use) or use the browser-side bulk checker.

Status codes

Every non-200 response uses the same envelope: success: false, an error flag, a machine-readable reason, a human message, and a docs link back to this page.

CodeReasonMeaning
400invalid_inputMissing or not a valid domain: call /api/email-domain/{domain} with a domain in the path.
401invalid_keyThe supplied API key is unknown or revoked.
429rate_limitToo many requests in the last minute (Retry-After: 60).
429daily_limitKeyless per-IP daily cap reached.
429credits_exhaustedKeyed monthly allowance used up.

Example, an invalid domain:

{"success": false, "error": true, "reason": "invalid_input", "message": "Provide a valid domain.", "docs": "https://emaildomaincheck.com/email-api"}

Limits

100 requests a day and 30 a minute, per IP, no key needed. That comfortably covers signup-form validation for most sites; if you need more, the downloadable list removes the network call entirely.