Disposable email addresses explained
A disposable email address is a throwaway inbox that anyone can open in seconds, without an account, and that is usually abandoned soon after: often once a sign-up link or a download has been received. People use them to keep their real address private and to avoid mail they never asked for. For a sender, the problem is what happens next: the inbox stops existing or stops being read, so later mail bounces or goes nowhere. Privacy relays such as Apple's Hide My Email, Firefox Relay and DuckDuckGo Email Protection are a different thing: they forward to an inbox the person keeps and reads.
What a disposable address is
A disposable inbox service hands out addresses on demand. You open a web page, an address appears, and messages sent to it show up on that page. There is usually no password and no sign-up, and many of these inboxes expire after minutes or hours, or can be opened by anyone who knows the address (the disposable status). Our glossary describes them the same way: an address from a throwaway inbox service, usually abandoned within hours or days.
That openness has a security side as well. A measurement study of seven popular disposable services, presented at the IEEE Symposium on Security and Privacy in 2019, collected about 2.3 million messages over three months and found that online accounts registered with disposable addresses can be easily hijacked, risking information leakage and financial loss (Hu, Peng and Wang: Characterizing Pixel Tracking through the Lens of Disposable Email Services). If the inbox is readable by others, so is the password reset link you send to it.
Why people use them
The reasons are mostly reasonable ones:
- Privacy. The person does not want a site they do not yet trust to know their real address, or to pass it on.
- Avoiding unwanted mail. A one-time download or a coupon should not turn into years of newsletters.
- Testing. Developers and QA teams create throwaway accounts to try a sign-up flow.
Some uses are less benign: opening many accounts to repeat a free trial, claiming a sign-up reward again and again, or creating accounts nobody will ever answer for. The address alone does not tell you which of these you are looking at, which is why the handling below avoids treating every such sign-up as abuse.
Privacy relays are not disposable
Several large companies offer forwarding addresses that hide a person's real address but deliver to an inbox they keep. These are designed for long-lived relationships with a site, not for one-time use.
Apple Hide My Email
Hide My Email creates unique, random addresses that forward to the person's own inbox, and replies go out from the random address too (Apple: What you can do with iCloud and Hide My Email). It is offered when someone creates an account with Sign in with Apple (Apple: Hide My Email), and iCloud+ subscribers can also create addresses themselves, for example in Safari when filling in a web form or in Mail on iCloud.com. A person can stop using an address at any time; Apple says mail sent to it afterwards is returned to the sender, and the address can be reactivated later (Apple: Stop using or reactivate a Hide My Email address).
If your app or site uses Sign in with Apple, Apple's developer documentation matters to you as a sender. Its relay addresses end in @private.icloud.com, @privaterelay.appleid.com or @icloud.com, and you must register your outbound email domains or addresses and authenticate them with SPF, DKIM or both before mail reaches the person (Apple Developer: Communicating using the private email relay service; Configuring your environment for Sign in with Apple). The same page sets a daily limit of 100 emails per relay address, and says that when a person stops receiving mail from your app, the relay rejects everything you send to that address from then on. Check your records with the SPF checker and the DKIM checker.
Firefox Relay
Mozilla describes Relay's email masks as private addresses that forward messages to the person's true address (Firefox Relay: FAQ). The person can turn forwarding off or block a single mask, and premium users can reply to forwarded mail within three months of receiving it.
DuckDuckGo Email Protection
DuckDuckGo's free service forwards mail to the person's existing inbox, removes hidden trackers, and lets them create private Duck Addresses on the fly (DuckDuckGo: What is Email Protection?). Its help pages say these addresses do not expire: mail keeps forwarding as long as the account is active and the address has not been deactivated, which the person can do, and undo (Do private Duck Addresses expire?; How do I deactivate private Duck Addresses?).
What the difference means for you
| Item | Disposable inbox | Privacy relay |
|---|---|---|
| Where mail goes | A public or short-lived web inbox | The person's own mailbox |
| How long it lasts | Minutes to days, often | Until the person turns it off |
| Who can read it | Often anyone with the address | Only the person |
| What turning it off says | Nothing: it just lapses | The person no longer wants your mail |
A relay address that stops accepting your mail is a clear signal, much like an unsubscribe, and you should stop mailing it. A person who chose a relay is still a reader you can keep, as long as your mail stays wanted. A related pattern, the +tag some mailbox providers support, is covered in the plus addressing guide.
What disposable addresses cost a sender
- Bounces after the inbox expires. Mail to an address that no longer exists comes back as a hard bounce, such as 550 5.1.1, and a pattern of hard bounces counts against your sender reputation.
- Mail nobody reads. Where the inbox lives on, your messages land somewhere nobody looks. They count in your sends but never in your opens or clicks.
- Free-trial and reward abuse. An inbox that costs nothing to create makes it cheap to sign up again and again.
- Lost contact for real customers. Receipts, sign-in codes and security notices sent to a throwaway inbox never reach the person, and they cannot recover their account later.
- Exposure of account mail. Where others can open the inbox, anything you send there is effectively public, as the study above shows.
How to handle them at sign-up
- Check the address when the form is submitted, from your server, as our sign-up form validation guide describes.
- Ask for a permanent address when the status is
disposable, if your product needs one. Explain why in one sentence: "Please use an email address you will keep: we send your receipts and sign-in codes there." - Do not shame the person. Avoid copy that calls the address fake or suspicious. Someone with a throwaway inbox may simply have been spammed after signing up somewhere else; a calm explanation keeps them on your page.
- Accept privacy relays. A forwarding address that delivers to the person is not a throwaway inbox. Blocking it turns away people who chose privacy, not one-time use.
- Confirm the address. Double opt-in proves the person controls the mailbox, whatever kind it is.
- Decide where a permanent address matters. A newsletter, a one-time download and a paid account can have different rules. You might accept a throwaway inbox for a trial and ask for a permanent address at checkout. A B2B form has a related choice about free mail addresses: see free vs business email.
Typos are the other common sign-up problem, with their own handling: see the email typos guide.
What our disposable status means
The status disposable means the address comes from a throwaway mail service whose inboxes are soon abandoned, so remove it. Its action is remove, and its one reason, disposable, means the inboxes are usually abandoned quickly. The validate API also returns a disposable flag, and our sign-up recipe checks both the status and the flag.
On a list you already have, remove these addresses or add them to your suppression list, so a later import cannot bring them back. When a check finds that an address forwards to another mailbox and mail sent to it is delivered, the result is valid with the reason alias and the action send. Follow the action field in every case.
No list of throwaway domains is ever complete, because new services and domains appear all the time. Treat the check as a strong filter, not a guarantee, and keep confirming new sign-ups.
Questions
Is Hide My Email a disposable address?
No. Apple's Hide My Email forwards to the person's own inbox and lasts until they turn the address off. If your app uses Sign in with Apple, register your sending domains with Apple so your mail reaches these addresses.
Should I block disposable addresses at sign-up?
Ask for a permanent address when the status is disposable and your product needs to reach the person later. For a one-time download you may decide to accept it and simply never add it to your marketing list.
Do disposable addresses bounce?
Often, once the inbox expires or the service drops the address. Some stay open and accept mail nobody reads, which does not bounce but does not help you either.
Try it
Try an address in the free email checker, or check a whole list with bulk email verification and filter on the action remove.
Related
- The disposable status
- Validate sign-up forms
- Glossary: disposable email address
- Glossary: alias address
Related guides
- Email typos and did you mean suggestions
- Double opt-in (confirmed opt-in)
- Plus addressing explained
- How to clean an email list
- What is email verification?
- All guides
Sources
- Apple: Hide My Email: how Hide My Email works with Sign in with Apple and forwards to the person's address.
- Apple: What you can do with iCloud and Hide My Email: iCloud+ addresses, replies from the random address.
- Apple: Stop using or reactivate a Hide My Email address: mail to a deactivated address is returned to the sender; reactivation.
- Apple Developer: Communicating using the private email relay service: relay domains, sender registration, daily limit, rejection after the person opts out.
- Apple Developer: Configuring your environment for Sign in with Apple: SPF and DKIM for registered email sources.
- Firefox Relay: FAQ: email masks, blocking and turning off forwarding, replies.
- DuckDuckGo: What is Email Protection?: forwarding, tracker removal, private addresses.
- DuckDuckGo: Do private Duck Addresses expire? and How do I deactivate private Duck Addresses?: lifetime and deactivation.
- Hu, Peng and Wang: Characterizing Pixel Tracking through the Lens of Disposable Email Services (IEEE Symposium on Security and Privacy, 2019): study size and the account takeover finding.
How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.