tmailrPrivacy
Why sites block disposable email, and where an alias differs
2 August 2026 · 3 min read · TMailr
You paste an address into a signup form and it refuses it: this email provider is not allowed. The form has decided your address is disposable and would rather have none than that. It is worth knowing how it decided, because the answer is less clever than the rejection makes it look.
How a form decides your address is disposable
Almost always, a list. There are public lists of a few thousand known throwaway domains, kept on GitHub and copied into half the signup forms on the internet, and paid services that sell a bigger one behind an API call. The form takes the part after the @, checks it against the list, and refuses a match. That is the whole mechanism most of the time.
A few go further and look at the domain rather than its name: a brand-new registration, an MX record pointing at a provider already known for throwaways, a site with no real content behind it. These are heuristics, and heuristics guess. None of them read your mail or prove anything about whether a person is on the other end.
What they are actually trying to stop
One person signing up as a hundred. Free-trial abuse, one vote per account turned into a thousand, a referral bonus farmed, a comment section flooded by what looks like a crowd. The address is a cheap identity, and a throwaway one is cheaper still, so blocking the obvious throwaways raises the cost of pretending to be many people. That is a real problem and a reasonable thing to defend against.
Where it goes wrong
The list is never complete and never only correct. Never complete, because a new disposable domain can be registered faster than any list is updated, so the abuse it exists to stop walks straight through. Never only correct, because the same net catches small mail providers, privacy forwarders and anyone whose domain a stranger once added to a list by hand. So the determined get in and the ordinary get turned away, which is the opposite of what was wanted.
And the people most likely to be blocked are the ones being careful on purpose. Using a different address per site is exactly the behaviour a blocklist reads as suspicious, so good hygiene and bad intent look the same from the form’s side. That is the cost nobody building one of these accounts for.
Where a masked alias is different, and where it is not
A throwaway inbox is meant to be forgotten: it exists for one code, then it is gone, and a form that guesses that is guessing right. A masked alias is not that. It forwards to your real mailbox and keeps working until you switch it off, so it is a reachable address a person actually reads, which is the thing the form was trying to insist on in the first place.
That is a real difference in kind, and it is not a promise that every form will accept it. A domain used for masking can land on an aggressive list too; the arms race does not make exceptions for good reasons. So the honest claim is smaller than the marketing on some sites: an alias is a working address you can revoke, not a guaranteed way past a wall somebody else built.
So: the wall is a blunt instrument aimed at abuse, and it misses the abuse and hits the careful. Worth understanding, not worth taking personally.
More on privacy
