We tested 7 disposable email lists for false positives

The results

Tested on October 17, 2026. For each list we checked 28 mainstream mailbox providers (Gmail, Outlook, Hotmail, Yahoo, iCloud, Proton, Tuta, GMX, QQ and others) and 14 privacy relays (Apple Hide My Email, DuckDuckGo, Firefox Relay, SimpleLogin, Proton Pass, addy.io and others). A listed domain means anyone blocking signups with that list rejects those users.

Why false positives cost more than they save

A throwaway signup costs you a few cents of compute and a skewed metric. A real person turned away costs you the customer, and you never find out: they see an error, shrug and leave. Outlook and Hotmail alone are a large share of consumer signups in most markets, so one bad entry outweighs thousands of obscure throwaway domains caught.

Privacy relays are the subtle case. Apple Hide My Email, DuckDuckGo Email Protection and Firefox Relay give each site its own forwarding address. Mail reaches a real, reachable inbox, and these users are often exactly the careful, technical buyers a SaaS wants. Treat them as real and tag them if you want visibility.

How to use any list safely

1. Add an allowlist step. Remove known providers and relays before you block anything:

// Before you block anything with a public list, remove known real providers
// and privacy relays (forwarding addresses that reach a real person).
const NEVER_BLOCK = new Set([
  'gmail.com', 'outlook.com', 'hotmail.com', 'live.com', 'msn.com', 'yahoo.com', 'aol.com', 'icloud.com', 'me.com', 'proton.me', 'protonmail.com', 'pm.me', 'tutanota.com', 'tuta.io', 'fastmail.com', 'hey.com', 'mailbox.org', 'posteo.de', 'gmx.com', 'gmx.de', 'web.de', 'mail.com', 'zoho.com', 'yandex.com', 'mail.ru', 'qq.com', '163.com', 'naver.com',
  'privaterelay.appleid.com', 'duck.com', 'mozmail.com', 'relay.firefox.com', 'simplelogin.com', 'simplelogin.co', 'slmail.me', 'aleeas.com', 'passmail.net', 'passinbox.com', 'addy.io', 'anonaddy.com', 'anonaddy.me', '33mail.com',
]);

export function cleanList(domains) {
  return domains.filter((d) => !NEVER_BLOCK.has(d.trim().toLowerCase()));
}

2. Check the mail server, not just the name. A domain with no MX or A record cannot receive your confirmation email, whatever any list says. Test one in the disposable email checker.
3. Warn before you block. For typos (jane@gmial.com) offer a fix instead of an error; see the email typo checker.
4. Re-test after every update. Scraped lists change every few days. Run the same check in CI so a bad entry never reaches production.

Our list: 9,222 domains, zero false positives in this test

Vetto's own disposable email domains list is free and public domain (CC0), with TXT and JSON downloads. It is smaller on purpose: every entry is a throwaway service, relays are explicitly excluded, and the engine checks the mail server live for domains the list does not know. You can look up any single domain on the email domain index, for example outlook.com or duck.com.

Method

• Each list was downloaded from its repository's default branch on October 17, 2026. JSON lists were read as arrays or keys; text lists one domain per line, ignoring comments.
• We checked exact matches for these real providers: gmail.com, outlook.com, hotmail.com, live.com, msn.com, yahoo.com, aol.com, icloud.com, me.com, proton.me, protonmail.com, pm.me, tutanota.com, tuta.io, fastmail.com, hey.com, mailbox.org, posteo.de, gmx.com, gmx.de, web.de, mail.com, zoho.com, yandex.com, mail.ru, qq.com, 163.com, naver.com.
• And these privacy relays: privaterelay.appleid.com, duck.com, mozmail.com, relay.firefox.com, simplelogin.com, simplelogin.co, slmail.me, aleeas.com, passmail.net, passinbox.com, addy.io, anonaddy.com, anonaddy.me, 33mail.com.
• Lists change often. If a maintainer fixes an entry, the next run of our test will show it, and we will update this page.
• The script, the raw results and CC0 allowlists of relays and providers are on GitHub: disposable-list-audit. It re-runs every Monday.

Want to know how many of your own signups are junk? Paste your last 10 signups on the homepage and see in seconds, or read how to detect fake signups.