How to Block Disposable Emails & Prevent Free Trial Abuse in SaaS (Next.js & Python API Guide)

In traditional B2B SaaS, a fake free-trial signup was a minor database nuisance: an extra row in PostgreSQL that cost $0.00 in marginal compute. In an AI SaaS application—whether you wrap OpenAI, Anthropic Claude, ElevenLabs voice synthesis, or dedicated GPU inference—every free trial carries a direct, immediate cash cost.

When you offer 50 free AI generations or $5 in starter credits to reduce signup friction, automated scripts and repeat abusers immediately target your registration form using disposable burner emails. Within hours, a single abuser rotating through temporary inbox providers can drain hundreds of dollars in LLM API tokens without ever intending to convert.

In this technical guide, we break down why static npm blocklists fail against modern burner domains, the unit economics of real-time signup verification, and how to integrate MailVeri’s real-time verification API in Next.js and Python to protect your AI compute budget.

1. Why Static Disposable Email Blocklists Fail Against Free Trial Abuse

Open-source npm and PyPI disposable email packages typically track only 3,000 to 5,000 legacy domains and only update when a volunteer merges a pull request. Modern trial abusers easily bypass static arrays using three techniques:

• Rotating Custom Burner Domains: Public temporary inbox services register dozens of cheap new domains every week and point their MX records to centralized burner mail servers. A domain registered this morning will never appear in a static JSON file bundled in your last deployment.
• Wildcard & Subdomain Aliasing: Many burner gateways accept mail across arbitrary subdomains (e.g., [email protected]), defeating exact-match domain lookups.
• Dead & Bogus Work Domains: If your signup form doesn’t enforce synchronous verification before granting starter credits, bots submit syntactically valid addresses on dead or non-existent domains.

2. Disposable Email Detection API Economics: $0.0002 vs. $2.00 in Stolen AI Tokens

A single real-time email verification check on MailVeri costs between $0.0002 and $0.00059, whereas a single fraudulent AI trial signup typically drains $1.00 to $5.00 in LLM or GPU compute. Blocking just one repeat token farmer pays for up to 10,000 legitimate user signup checks.

https://app.mailveri.com/verify/single/

1600 × 1000 • Retina 2x

Beyond saving direct API costs, blocking disposable and invalid emails at the perimeter protects your transactional email sender reputation (Postmark, Resend, AWS SES, or SendGrid). When fake users trigger welcome and onboarding emails to dead addresses, the resulting hard bounces can get your transactional domain suspended.

3. How to Block Disposable Emails in Next.js & Python FastAPI

Integrating MailVeri into your signup API takes a single HTTP POST request to https://api.mailveri.com/v1/verify-mail/ with your Bearer API key. Below are production-ready implementations for both TypeScript (Next.js App Router) and Python (FastAPI).

Option A: Next.js App Router Signup Guard

// app/api/auth/register/route.ts — Block burner emails before granting AI trial credits
export async function POST(req: Request) {
  const { email } = await req.json();

  const verifyRes = await fetch('https://api.mailveri.com/v1/verify-mail/', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.MAILVERI_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ email }),
  });

  const verification = await verifyRes.json();

  // Block disposable burner domains and invalid mailboxes at the perimeter
  if (verification.status === 'DISPOSABLE' || verification.status === 'INVALID') {
    return Response.json(
      { error: 'Please sign up with a valid work or personal email address.' },
      { status: 400 }
    );
  }

  // Safe to create user and provision free LLM / GPU trial credits
  return Response.json({ ok: true, status: verification.status });
}

Option B: Python FastAPI Signup Guard

import os
import httpx
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel

app = FastAPI()
MAILVERI_API_KEY = os.environ["MAILVERI_API_KEY"]

class SignupRequest(BaseModel):
    email: str
    password: str

@app.post("/api/v1/signup")
async def register_user(payload: SignupRequest):
    async with httpx.AsyncClient(timeout=10.0) as client:
        res = await client.post(
            "https://api.mailveri.com/v1/verify-mail/",
            headers={"Authorization": f"Bearer {MAILVERI_API_KEY}"},
            json={"email": payload.email},
        )
        verdict = res.json()

    status = verdict.get("status")

    # Block disposable burner emails and invalid addresses before granting trial tokens
    if status in ("DISPOSABLE", "INVALID", "FULL_INBOX"):
        raise HTTPException(
            status_code=400,
            detail="Please register with an active work or personal email address.",
        )

    # Provision user account and allocate free AI trial credits
    return {"created": True, "verification_status": status}

JSON Response Payload

{
  "error": 0,
  "message": "Verified [email protected] successfully",
  "status": "DISPOSABLE",
  "email": "[email protected]",
  "is_disposable": true,
  "is_catch_all": false,
  "balance": 49991
}

4. SaaS Signup Email Verification Policy Matrix (Valid, Catch-All & Role Accounts)

Not every non-standard email status should be blocked at signup; B2B buyers frequently register with role accounts or corporate catch-all domains. Use this decision matrix to maximize genuine conversions while eliminating abuse:

5. How to Stop Gmail Plus-Addressing & Dot Alias Trial Abuse

Even when you block disposable domains, savvy abusers use a single legitimate Gmail or ProtonMail inbox to register dozens of trial accounts by inserting random dots ([email protected]) or plus tags ([email protected]).

MailVeri automatically normalizes provider-specific aliases and returns the canonical address in the mail field of the JSON response. By storing a unique constraint on the normalized address in your database, you stop one Gmail account from claiming 50 free trials—while keeping your AI SaaS unit economics healthy from day one. Using managed auth? See our specific implementation guide on How to Block Disposable Emails in Supabase, Clerk & Next.js Auth.

Frequently Asked Questions