GitHub Disposable Email Lists Are Blocking Real Companies

When SaaS teams want to stop free-trial abuse, the fastest fix is usually npm install disposable-email-domains or dropping a GitHub domains.txt file into signup validation. It is free, takes five minutes to ship, and nobody questions what is actually inside the file.

We checked the 5 most downloaded GitHub disposable email lists against the Tranco Top 100,000 domains and live DNS MX records. If you ship one of these lists in production today, your signup form is rejecting employees at ASICS, Coty Inc., Namecheap, Angi, Railway, Cafe24, 24 Hour Fitness, major telecom ISPs, and real education portals as “burner emails.”

What We Checked

We pulled the current master branch of the five open-source repositories behind most npm, PyPI, Packagist, and Go disposable-email packages, and matched every entry against the Tranco Top 100K and live corporate MX records:

18 Real Companies Blocked as “Burner” Domains

Here is a sample of real companies, SaaS platforms, and registrars currently sitting inside those GitHub blocklists, along with the corporate mail servers they run today:

When a buyer at Coty Inc. (@cotyinc.com), a merchant on Salla (@salla.dev), or an engineer at Railway (@railway.com) hits your signup form and sees “Disposable email addresses are not allowed,” they do not open a support ticket to tell you. They close the tab.

ISPs, Privacy Aliases, and Country Suffixes Also Blocked

Company domains are only part of the problem. Three other groups of legitimate users get rejected by these lists every day:

Consumer ISPs and Telecom Providers

• sohu.com (Tranco #559, NASDAQ: SOHU): One of China’s largest consumer webmail portals—blocked in wesbos/burner-email-providers.
• 21cn.com (Tranco #13,332): China Telecom’s consumer and corporate mail provider—blocked in both disposable-email-domains (9.8k★) and ivolo/disposable-email-domains (npm).
• uqmobile.jp (Tranco #22,739) & odn.ad.jp (Tranco #36,283): Japanese carrier and ISP email domains operated by KDDI (mx01.au.com) and SoftBank (Trend Micro Email Security)—blocked in disposable/disposable.
• freemail.hu (Tranco #39,330), sify.com (Tranco #53,147, Microsoft 365), & wo.com.cn (China Unicom): National webmail providers in Hungary, India, and China listed alongside 10-minute burner sites.

DuckDuckGo and Addy.io Privacy Aliases

Many developers and CTOs use forwarding aliases that route straight to their primary Gmail, Fastmail, or work inbox. Yet wesbos/burner-email-providers blocks both duck.com (DuckDuckGo Email Protection) and anonaddy.com (Addy.io). A verification API should separate privacy forwarding relays (is_forwarding: true, which deliver to a real inbox) from throwaway burner domains (status: "DISPOSABLE").

Education Portals and Country Registry Suffixes

• Education Portals vs. Fake .edu.* Burners: On one hand, wesbos and disposable/disposable block legitimate education portals like californiacolleges.edu (California’s official state college planning platform on Barracuda Email Security), blackpoolsixth.ac.uk (Blackpool Sixth Form College on Google Workspace), and grad.bryant.edu (Bryant University). On the other hand, teams that try to fix this by blindly whitelisting every .edu.* or .ac.* suffix end up letting through hundreds of expired regional academic domains that were bought at auction and pointed to disposable temp-mail servers.
• Country & Registry Suffixes: Several lists contain bare public suffixes like pp.ua (Tranco #4,994, an official Ukrainian registry used by hundreds of thousands of businesses and individuals), it.com (#970), za.com (#25,747), and msk.ru (#6,030). Any code that does suffix matching against the list ends up blocking every domain under those registries.

Why Static GitHub Lists Go Stale

1. Unchecked Pull Requests: Contributors frequently dump scraped domain lists or keyword matches into PRs without checking DNS MX records. Germany’s federal consumer foundation website (test.de) was added simply because the domain is the word “test,” and asics.com, cotyinc.com, and mailinblack.com (an enterprise email security vendor) were merged despite running Mimecast, Proofpoint, and Microsoft 365 gateways.
2. Expired Domains Bought by Real Startups: A domain used for a side-project temp-mail script in 2017 often expires and gets bought years later by a real company running Google Workspace or Microsoft 365. Static text files never re-check old entries against live MX records.
3. Daily Burner Domain Rotation: Disposable mail services register new custom domains every day. By the time someone opens a GitHub PR weeks later, the burner service has already moved on to fresh domains.

Checking Signups in Real Time Instead

Instead of rejecting @asics.com, @namecheap.com, or @railway.com with a static file—or letting new custom burner domains slip past—you can check signups at the edge or in your API route with the MailVeri Verification API:

// app/api/signup/route.ts
// Replace static GitHub blocklist arrays with real-time MailVeri verification ($0.0002 - $0.0009/check)
import { NextResponse } from 'next/server';

const MAILVERI_API_KEY = process.env.MAILVERI_API_KEY!;

export async function POST(req: Request) {
  const { email } = await req.json();

  const verifyRes = await fetch('https://api.mailveri.com/v1/verify-mail/', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${MAILVERI_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ email }),
  });

  const verdict = await verifyRes.json();

  // 1. Block confirmed disposable burner domains (without rejecting @asics.com or @namecheap.com)
  if (verdict.status === 'DISPOSABLE') {
    return NextResponse.json(
      { error: 'Please use a permanent work or personal email address to sign up.' },
      { status: 403 }
    );
  }

  // 2. Reject undeliverable typos and full mailboxes before sending welcome emails
  if (verdict.status?.startsWith('INVALID') || verdict.status === 'FULL_INBOX') {
    return NextResponse.json(
      { error: 'This email address cannot receive messages. Please check for typos.' },
      { status: 422 }
    );
  }

  // 3. Optional: allow privacy forwarding relays (duck.com, addy.io) on paid plans,
  // or require a work email only when claiming free trial compute credits
  const isPrivacyRelay = Boolean(verdict.is_forwarding);

  return NextResponse.json({
    allowed: true,
    canonicalEmail: verdict.mail,
    isPrivacyRelay,
  });
}

{
  "error": 0,
  "message": "Verified [email protected] successfully",
  "status": "VALID",
  "email": "[email protected]",
  "mail": "[email protected]",
  "is_disposable": false,
  "is_forwarding": false,
  "is_catch_all": false,
  "balance": 9999
}

{
  "error": 0,
  "message": "Verified [email protected] successfully",
  "status": "DISPOSABLE",
  "email": "[email protected]",
  "mail": "[email protected]",
  "is_disposable": true,
  "is_forwarding": false,
  "balance": 9998
}

Ready to stop blocking real customers while locking out trial abusers? Check out our step-by-step guides on Blocking Disposable Emails in Supabase, Clerk & Next.js and Stopping Disposable Emails from Draining AI SaaS Credits, test any domain live in our free Email Verifier Tool, or claim 1,000 free verification credits on MailVeri Pricing.