Endpoint
GET https://emaildomaincheck.com/api/email-domain/{domain}
| Method | Endpoint | Auth |
|---|---|---|
| GET | /api/email-domain/{domain} | None required for the free per-IP allowance. An IPNOVA API key (free account at api.ipnova.com) applies your plan allowance instead: send it as the X-Api-Key header or the ?key= query parameter. Keyed responses carry X-Credits-Remaining and X-Credits-Used. |
| GET | /openapi.json | Machine-readable spec: /openapi.json |
Plans
One key. Twelve APIs.
A free IPNOVA API account gives you 5,000 lookups a month across every API below, 60 a minute, no card, for evaluation and small projects. Paid plans from $19 a month for production volumes, with a commercial licence and a hard cap instead of overage billing.
Takes a minute. Send it as X-Api-Key or ?key=.
Without a key this API answers 100 requests a day per IP address, for evaluation and personal use. Try it: curl https://emaildomaincheck.com/api/email-domain/mailinator.com
Example
curl https://emaildomaincheck.com/api/email-domain/mailinator.com
{
"success": true,
"domain": "mailinator.com",
"disposable": "confirmed",
"matched_domain": "mailinator.com",
"blocklists": ["disposable-email-domains blocklist", "disposable/disposable daily aggregate", "FGRibreau/mailchecker"],
"blocklists_tracked": 4,
"free_provider": false,
"first_seen": null,
"mx_active": null,
"checked_at": "2026-09-16T06:24:49+00:00",
"docs": "https://emaildomaincheck.com/email-api"
}
Integration snippets
// Express signup middleware
app.post('/signup', async (req, res, next) => {
const domain = String(req.body.email).split('@').pop().toLowerCase();
const v = await fetch('https://emaildomaincheck.com/api/email-domain/' + domain).then(r => r.json());
if (v.disposable === 'confirmed') {
return res.status(422).json({ error: 'Please use a permanent email address.' });
}
req.requireEmailConfirmation = v.disposable === 'reported';
next();
});
Prefer zero network calls? Ship the list with your app instead; it is free for commercial use. Time your cache: the dataset rebuilds daily.
Fields
| Field | Meaning |
|---|---|
| disposable | confirmed (vetted list or 2+ sources), reported (single list - soft-verify, don't hard-block), or no |
| blocklists | Names of the community lists carrying the domain, out of 4 tracked |
| free_provider | true for personal-mailbox providers like gmail.com - real users, not disposable |
| matched_domain | The listed domain that matched - equals the parent when you query a subdomain of a listed service (x.mailinator.com matches mailinator.com) |
| first_seen | Date the domain entered our dataset, when it appeared after tracking began (null for long-established entries) - fresh domains are the highest-risk ones |
| mx_active | Whether the domain could receive mail at our last DNS sample (MX, or A/AAAA implicit-MX fallback). null = not yet sampled. Our own rolling verification, not part of any upstream list |
Privacy contract
Send only the part after the @. If a full address reaches the endpoint anyway, everything before the @ is discarded before processing; requests are answered with no-store and inputs are never logged. For zero-network checking, download the list (rebuilt daily, free for commercial use) or use the browser-side bulk checker.
Status codes
Every non-200 response uses the same envelope: success: false, an error flag, a machine-readable reason, a human message, and a docs link back to this page.
| Code | Reason | Meaning |
|---|---|---|
| 400 | invalid_input | Missing or not a valid domain: call /api/email-domain/{domain} with a domain in the path. |
| 401 | invalid_key | The supplied API key is unknown or revoked. |
| 429 | rate_limit | Too many requests in the last minute (Retry-After: 60). |
| 429 | daily_limit | Keyless per-IP daily cap reached. |
| 429 | credits_exhausted | Keyed monthly allowance used up. |
Example, an invalid domain:
{"success": false, "error": true, "reason": "invalid_input", "message": "Provide a valid domain.", "docs": "https://emaildomaincheck.com/email-api"}
Limits
100 requests a day and 30 a minute, per IP, no key needed. That comfortably covers signup-form validation for most sites; if you need more, the downloadable list removes the network call entirely.