How to detect disposable email signups before account creation

Disposable email addresses are common in fake signups, free trial abuse, coupon abuse, and low-quality account creation. Blocking every unfamiliar domain is too blunt, but ignoring disposable inboxes lets attackers create accounts cheaply.

The right move is to score the email before account creation and combine it with IP, device, and behavior context.

Why email checks alone are not enough

An email domain can look new, obscure, or technically valid without being trustworthy. A signup can also use a normal-looking mailbox from a suspicious network or repeated device.

RequestGuard works best when email risk is part of the full signup decision.

const assessment = await requestGuard.assess({
  ip,
  email,
  domain: email.split("@")[1],
  userAgent,
  event: "signup",
  sessionId,
});

What to do with the result

• Allow normal accounts when email and network context look low risk.
• Challenge disposable or uncertain signups with verification.
• Review accounts that request high-value access immediately.
• Block obvious abuse when disposable identity, suspicious IP, and repeated behavior combine.

Signals to watch

• Disposable email domain.
• Suspicious or newly observed domain.
• Domain that cannot receive mail reliably.
• VPN, proxy, Tor, or datacenter traffic.
• Repeated signups from the same session, subnet, or device.
• Claimed company domain mismatch.

A better signup policy

Do not make the email check your only rule. Use it to decide the next step. A disposable email from a suspicious network trying to create API keys deserves a different response than a new domain from a normal business connection.

RequestGuard turns those signals into an action your backend can enforce before the account exists.