# How to Block Disposable Emails & Prevent Free Trial Abuse in SaaS (Next.js & Python API Guide)

> Learn how to block 100,000+ disposable email domains, stop Gmail alias abuse, and prevent free trial abuse from draining your AI SaaS credits with Next.js and FastAPI.

- **Author**: Alex, Co-Founder
- **Published**: 2026-08-20 (Updated: 2026-11-01)
- **Source**: https://mailveri.com/blog/stop-disposable-emails-draining-ai-saas-credits
- **AI Reference**: https://mailveri.com/llms-full.txt

---

In traditional B2B SaaS, a fake free-trial signup was a minor database nuisance: an extra row in PostgreSQL that cost $0.00 in marginal compute. In an **AI SaaS application**—whether you wrap OpenAI, Anthropic Claude, ElevenLabs voice synthesis, or dedicated GPU inference—every free trial carries a direct, immediate cash cost.

When you offer 50 free AI generations or $5 in starter credits to reduce signup friction, automated scripts and repeat abusers immediately target your registration form using **disposable burner emails**. Within hours, a single abuser rotating through temporary inbox providers can drain hundreds of dollars in LLM API tokens without ever intending to convert.

In this technical guide, we break down why static npm blocklists fail against modern burner domains, the unit economics of real-time signup verification, and how to integrate [MailVeri’s real-time verification API](https://mailveri.com/industries/ai-startups) in Next.js and Python to protect your AI compute budget.

Inbound Token Protection

Spend $0.0002 to Save $2.00+ in Stolen AI Compute

Block 100,000+ disposable and temporary mail providers at registration with a single REST API call. Credits never expire and inconclusive checks are 100% free.

[Get Free API Key (1,000 Credits)→](https://app.mailveri.com/accounts/signup/)

## 1. Why Static Disposable Email Blocklists Fail Against Free Trial Abuse

**Open-source npm and PyPI disposable email packages typically track only 3,000 to 5,000 legacy domains and only update when a volunteer merges a pull request.** Modern trial abusers easily bypass static arrays using three techniques:

- **Rotating Custom Burner Domains:** Public temporary inbox services register dozens of cheap new domains every week and point their MX records to centralized burner mail servers. A domain registered this morning will never appear in a static JSON file bundled in your last deployment.
- **Wildcard & Subdomain Aliasing:** Many burner gateways accept mail across arbitrary subdomains (e.g., `user@mail14.temp-domain.net`), defeating exact-match domain lookups.
- **Dead & Bogus Work Domains:** If your signup form doesn’t enforce synchronous verification before granting starter credits, bots submit syntactically valid addresses on dead or non-existent domains.

| Protection Layer | Static npm / PyPI Blocklist | MailVeri Real-Time Signup API |
| --- | --- | --- |
| Tracked Disposable Domains | ~3,000 static domains | 100,000+ continuously updated domains |
| Live DNS & MX Inspection | No (Offline string match only) | Yes (Detects custom domains on burner MX) |
| Mailbox Existence Check | No | Yes (Flags INVALID & FULL_INBOX) |
| Provider Alias Normalization | No | Yes (Canonicalizes Gmail/Proton dot & plus tricks) |

## 2. Disposable Email Detection API Economics: $0.0002 vs. $2.00 in Stolen AI Tokens

**A single real-time email verification check on MailVeri costs between $0.0002 and $0.00059, whereas a single fraudulent AI trial signup typically drains $1.00 to $5.00 in LLM or GPU compute.** Blocking just one repeat token farmer pays for up to 10,000 legitimate user signup checks.

![MailVeri Real-Time Single Email Verifier inspecting MX records, disposable status, and mailbox deliverability](https://mailveri.com/images/product/mailveri-single-email-verifier.png)

***Figure 1:** Real-time single email inspection inside the MailVeri dashboard and REST API.*

Beyond saving direct API costs, blocking [disposable and invalid emails](https://mailveri.com/blog/disposable-vs-role-based-emails) at the perimeter protects your transactional email sender reputation (Postmark, Resend, AWS SES, or SendGrid). When fake users trigger welcome and onboarding emails to dead addresses, the resulting hard bounces can get your transactional domain suspended.

## 3. How to Block Disposable Emails in Next.js & Python FastAPI

**Integrating MailVeri into your signup API takes a single HTTP POST request to `https://api.mailveri.com/v1/verify-mail/` with your Bearer API key.** Below are production-ready implementations for both TypeScript (Next.js App Router) and Python (FastAPI).

### Option A: Next.js App Router Signup Guard

```typescript
// app/api/auth/register/route.ts — Block burner emails before granting AI trial credits
export async function POST(req: Request) {
  const { email } = await req.json();

  const verifyRes = await fetch('https://api.mailveri.com/v1/verify-mail/', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.MAILVERI_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ email }),
  });

  const verification = await verifyRes.json();

  // Block disposable burner domains and invalid mailboxes at the perimeter
  if (verification.status === 'DISPOSABLE' || verification.status === 'INVALID') {
    return Response.json(
      { error: 'Please sign up with a valid work or personal email address.' },
      { status: 400 }
    );
  }

  // Safe to create user and provision free LLM / GPU trial credits
  return Response.json({ ok: true, status: verification.status });
}
```

### Option B: Python FastAPI Signup Guard

```python
import os
import httpx
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel

app = FastAPI()
MAILVERI_API_KEY = os.environ["MAILVERI_API_KEY"]

class SignupRequest(BaseModel):
    email: str
    password: str

@app.post("/api/v1/signup")
async def register_user(payload: SignupRequest):
    async with httpx.AsyncClient(timeout=10.0) as client:
        res = await client.post(
            "https://api.mailveri.com/v1/verify-mail/",
            headers={"Authorization": f"Bearer {MAILVERI_API_KEY}"},
            json={"email": payload.email},
        )
        verdict = res.json()

    status = verdict.get("status")

    # Block disposable burner emails and invalid addresses before granting trial tokens
    if status in ("DISPOSABLE", "INVALID", "FULL_INBOX"):
        raise HTTPException(
            status_code=400,
            detail="Please register with an active work or personal email address.",
        )

    # Provision user account and allocate free AI trial credits
    return {"created": True, "verification_status": status}
```

### JSON Response Payload

```json
{
  "error": 0,
  "message": "Verified burner.trial42@guerrillamail.com successfully",
  "status": "DISPOSABLE",
  "email": "burner.trial42@guerrillamail.com",
  "is_disposable": true,
  "is_catch_all": false,
  "balance": 49991
}
```

## 4. SaaS Signup Email Verification Policy Matrix (Valid, Catch-All & Role Accounts)

**Not every non-standard email status should be blocked at signup; B2B buyers frequently register with role accounts or corporate catch-all domains.** Use this decision matrix to maximize genuine conversions while eliminating abuse:

| MailVeri Status | Recommended Signup Action | Free-Trial Token Policy |
| --- | --- | --- |
| VALID | Approve registration immediately | Grant full starter AI credits after email confirmation |
| DISPOSABLE | Block registration at form level | 0 credits — prompt user for a work or personal email |
| INVALID | Block registration (catch typos) | 0 credits — ask user to fix typo in their email address |
| CATCH_ALL | Allow registration (common for B2B enterprises) | Grant credits only after user clicks confirmation link |
| ROLE_ACCOUNT | Allow registration (e.g., `ai@company.com`, `dev@`) | Grant standard credits after email confirmation |
| UNKNOWN | Allow with mandatory confirmation link | Hold trial credits until email confirmation link click |

## 5. How to Stop Gmail Plus-Addressing & Dot Alias Trial Abuse

Even when you block disposable domains, savvy abusers use a single legitimate Gmail or ProtonMail inbox to register dozens of trial accounts by inserting random dots (`j.o.h.n@gmail.com`) or plus tags (`john+trial19@gmail.com`).

MailVeri automatically normalizes provider-specific aliases and returns the canonical address in the `mail` field of the JSON response. By storing a unique constraint on the normalized address in your database, you stop one Gmail account from claiming 50 free trials—while keeping your [AI SaaS unit economics](https://mailveri.com/blog/ai-saas-distribution-bottleneck-cold-email-economics) healthy from day one. Using managed auth? See our specific implementation guide on [How to Block Disposable Emails in Supabase, Clerk & Next.js Auth](https://mailveri.com/blog/how-to-block-disposable-emails-supabase-clerk-nextjs).

## Frequently Asked Questions

### Why do static open-source disposable email blocklists miss modern trial abuse?

Burner providers register hundreds of fresh throwaway domains on low-cost TLDs every week and route them through wildcard MX hosts, allowing abusers to bypass static GitHub JSON lists within hours and drain free AI SaaS credits.

### How do AI SaaS teams stop both burner domains and Gmail +alias farming?

Combine real-time MailVeri API verification on signup (blocking DISPOSABLE and INVALID addresses across 100,000+ continuously updated burner domains) with canonical email deduplication so john.doe+1@gmail.com maps back to johndoe@gmail.com.

### What is the ROI of verifying AI SaaS free-trial signups via API?

Each real-time verification check costs $0.0002 to $0.0009 in non-expiring Universal Credits ($9/10K to $999/5M), preventing $1 to $10+ in stolen LLM tokens, GPU compute, and transactional email reputation damage per blocked bot.