Endpoint
GET https://emaildomaincheck.com/api/email-domain/{domain}
Example
curl https://emaildomaincheck.com/api/email-domain/mailinator.com
{
"domain": "mailinator.com",
"disposable": "confirmed",
"blocklists": ["disposable-email-domains blocklist", "disposable/disposable daily aggregate", "FGRibreau/mailchecker"],
"blocklists_tracked": 4,
"free_provider": false,
"checked_at": "2026-09-13T09:00:00+00:00"
}
Integration snippets
// Express signup middleware
app.post('/signup', async (req, res, next) => {
const domain = String(req.body.email).split('@').pop().toLowerCase();
const v = await fetch('https://emaildomaincheck.com/api/email-domain/' + domain).then(r => r.json());
if (v.disposable === 'confirmed') {
return res.status(422).json({ error: 'Please use a permanent email address.' });
}
req.requireEmailConfirmation = v.disposable === 'reported';
next();
});
Prefer zero network calls? Ship the list with your app instead; it is free for commercial use. Time your cache: the dataset rebuilds daily.
Fields
| Field | Meaning |
|---|---|
| disposable | confirmed (vetted list or 2+ sources), reported (single list - soft-verify, don't hard-block), or no |
| blocklists | Names of the community lists carrying the domain, out of 4 tracked |
| free_provider | true for personal-mailbox providers like gmail.com - real users, not disposable |
| matched_domain | The listed domain that matched - equals the parent when you query a subdomain of a listed service (x.mailinator.com matches mailinator.com) |
| first_seen | Date the domain entered our dataset, when it appeared after tracking began (null for long-established entries) - fresh domains are the highest-risk ones |
| mx_active | Whether the domain could receive mail at our last DNS sample (MX, or A/AAAA implicit-MX fallback). null = not yet sampled. Our own rolling verification, not part of any upstream list |
Privacy contract
Send only the part after the @. If a full address reaches the endpoint anyway, everything before the @ is discarded before processing; requests are answered with no-store and inputs are never logged. For zero-network checking, download the list (rebuilt daily, free for commercial use) or use the browser-side bulk checker.
Limits
30 requests/minute and 500/day per IP, no key needed. That comfortably covers signup-form validation for most sites; if you need more, the downloadable list removes the network call entirely.