Disposable Domains

Disposable email services hand out addresses that work for a few minutes or hours and are then abandoned. Anyone can get one without creating an account, receive a confirmation link, and never return. disposable is true when the checked domain or address belongs to one of these services.

The field is returned by the domain and email endpoints, and is available in Gates as domain.disposable and email.disposable.

Disposable means confirmed, not suspected

A domain is not flagged as disposable on suspicion. disposable: true means the domain has been confirmed to belong to a temporary email service, not that it looked suspicious.

A domain that is clearly being abused but has not been confirmed as part of a disposable service yet is usually flagged as spam instead, and can move to disposable later once the service is confirmed. If you are looking for a domain you expected to be disposable and finding false, check spam on the same response before concluding it is unknown.

Disposable addresses on ordinary domains

An address can be disposable while its domain is not. Public mailbox providers such as Gmail and Outlook are themselves used to run throwaway addresses, so an individual address can be identified as disposable while the domain it sits on stays an ordinary public provider. The address is matched in its normalized form, so a subaddress tag or a provider's ignored characters do not change the result. See Email Normalization.

The two endpoints handle this differently:

• The email endpoint returns a single disposable field that is true in either case, whether the domain is a disposable service or the specific address is a throwaway on an ordinary domain.
• The domain endpoint only ever answers the domain-level question, so it returns false for a domain like gmail.com regardless of which addresses exist on it.

Gates adds the domain-level flag on its own: domain.disposable answers only the domain-level question, while email.disposable matches the email endpoint's combined field and is true in either case.

Disposable providers

A domain flagged as disposable usually gives no hint of which service is behind it. disposable_provider fills that in: it names the service operating the domain, giving you the context to verify the classification yourself.

The value is normally the service's primary domain. Some disposable services are mobile apps rather than websites, and those are identified by their app store URL instead, so treat the field as an opaque identifier for the operator rather than as something that is always a domain.

The field is only present when the domain is disposable, is null when the operator has not been identified, and is returned on Pro plans. Gates exposes it as domain.disposable_provider.

For a walkthrough of the options for acting on this signal, see How to Block Disposable Email Addresses.