Email domain risk: how to score new, disposable, and suspicious domains
Use email domain risk signals to catch disposable identities, suspicious domains, and fake signup patterns before account creation.
Email domain risk is one of the fastest ways to improve signup quality. Attackers can rotate inboxes cheaply, but the domain, mail setup, and surrounding request context often reveal useful risk.
What makes a domain risky?
Risk can come from several patterns:
- Disposable or temporary email service.
- Newly observed or suspicious domain.
- Domain with weak or unusual mail infrastructure.
- Free-provider email used for high-value B2B actions.
- Claimed company domain mismatch.
- Domain paired with suspicious IP or device context.
Score domain risk in context
Do not judge the domain alone. A new domain may be legitimate. A free email may be acceptable for a small trial. The risk changes with the event.
const assessment = await requestGuard.assess({
ip,
email,
domain: email.split("@")[1],
event: "signup",
metadata: {
claimed_company_domain: companyDomain,
requested_plan: plan,
},
});Good actions
- Allow normal domains for low-risk flows.
- Challenge disposable domains before account creation.
- Review high-value B2B trials with mismatched domains.
- Block domains that combine disposable identity, suspicious network, and repeated behavior.
Why this beats blocklists alone
Blocklists miss context. Risk scoring lets your backend consider the domain, IP, device, session, and business event together.
That is the difference between “this domain is unknown” and “this signup should be challenged before receiving product value.”