Disposable email address

A disposable address comes from a service that hands out a working mailbox for a few minutes or hours and then discards it. People use them to get past a signup wall — to reach content, claim a trial, or avoid a mailing list — and the address genuinely works while they are using it.

That is what makes them awkward to verify. At the moment of the check a disposable address is fully deliverable: the domain resolves, the mail server accepts, a message would arrive. Judged on the protocol alone there is nothing wrong with it at all. The problem is entirely about what happens next — within the hour the mailbox is gone, and every later message bounces.

So a disposable address is identified by its domain rather than by its behaviour. The signal is a list of the services that provide them, which is a maintenance commitment rather than a clever algorithm: new domains appear constantly, and a list nobody is updating quietly stops working.

DISPOSABLE_DOMAIN is reported as risky, and what to do with it depends on what you are protecting. For a free trial it is usually a reason to ask for something more. For a paying customer who happened to use one, it is not. The result says what was found; the policy is yours.