# Disposable Email Addresses: What They Are and What to Do

URL: https://email-validation.org/guides/disposable-email-addresses/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

A disposable email address is a throwaway inbox that anyone can open in seconds, without an account, and that is
usually abandoned soon after: often once a sign-up link or a download has been received. People use them to keep
their real address private and to avoid mail they never asked for. For a sender, the problem is what happens next:
the inbox stops existing or stops being read, so later mail bounces or goes nowhere. Privacy relays such as Apple's
Hide My Email, Firefox Relay and DuckDuckGo Email Protection are a different thing: they forward to an inbox the
person keeps and reads.

## What a disposable address is

A disposable inbox service hands out addresses on demand. You open a web page, an address appears, and messages sent
to it show up on that page. There is usually no password and no sign-up, and many of these inboxes expire after
minutes or hours, or can be opened by anyone who knows the address
([the disposable status](https://email-validation.org/docs/statuses/disposable/#why-remove)). Our [glossary](https://email-validation.org/glossary/#disposable-email)
describes them the same way: an address from a throwaway inbox service, usually abandoned within hours or days.

That openness has a security side as well. A measurement study of seven popular disposable services, presented at the
IEEE Symposium on Security and Privacy in 2019, collected about 2.3 million messages over three months and found that
online accounts registered with disposable addresses can be easily hijacked, risking information leakage and
financial loss
([Hu, Peng and Wang: Characterizing Pixel Tracking through the Lens of Disposable Email Services](https://experts.illinois.edu/en/publications/characterizing-pixel-tracking-through-the-lens-of-disposable-emai/)).
If the inbox is readable by others, so is the password reset link you send to it.

## Why people use them

The reasons are mostly reasonable ones:

- **Privacy.** The person does not want a site they do not yet trust to know their real address, or to pass it on.
- **Avoiding unwanted mail.** A one-time download or a coupon should not turn into years of newsletters.
- **Testing.** Developers and QA teams create throwaway accounts to try a sign-up flow.

Some uses are less benign: opening many accounts to repeat a free trial, claiming a sign-up reward again and again,
or creating accounts nobody will ever answer for. The address alone does not tell you which of these you are looking
at, which is why the handling below avoids treating every such sign-up as abuse.

## Privacy relays are not disposable

Several large companies offer forwarding addresses that hide a person's real address but deliver to an inbox they
keep. These are designed for long-lived relationships with a site, not for one-time use.

### Apple Hide My Email

Hide My Email creates unique, random addresses that forward to the person's own inbox, and replies go out from the
random address too ([Apple: What you can do with iCloud and Hide My Email](https://support.apple.com/guide/icloud/what-you-can-do-with-icloud-and-hide-my-email-mme38e1602db/icloud)).
It is offered when someone creates an account with Sign in with Apple
([Apple: Hide My Email](https://support.apple.com/en-us/105078)), and iCloud+ subscribers can also create addresses
themselves, for example in Safari when filling in a web form or in Mail on iCloud.com. A person can stop using an
address at any time; Apple says mail sent to it afterwards is returned to the sender, and the address can be
reactivated later
([Apple: Stop using or reactivate a Hide My Email address](https://support.apple.com/en-ca/guide/icloud/mm3adb030cbf)).

If your app or site uses Sign in with Apple, Apple's developer documentation matters to you as a sender. Its relay
addresses end in `@private.icloud.com`, `@privaterelay.appleid.com` or `@icloud.com`, and you must register your
outbound email domains or addresses and authenticate them with SPF, DKIM or both before mail reaches the person
([Apple Developer: Communicating using the private email relay service](https://developer.apple.com/documentation/signinwithapple/communicating-using-the-private-email-relay-service);
[Configuring your environment for Sign in with Apple](https://developer.apple.com/documentation/signinwithapple/configuring-your-environment-for-sign-in-with-apple)).
The same page sets a daily limit of 100 emails per relay address, and says that when a person stops receiving mail
from your app, the relay rejects everything you send to that address from then on. Check your records with the
[SPF checker](https://email-validation.org/tools/spf-checker/) and the [DKIM checker](https://email-validation.org/tools/dkim-checker/).

### Firefox Relay

Mozilla describes Relay's email masks as private addresses that forward messages to the person's true address
([Firefox Relay: FAQ](https://relay.firefox.com/faq/)). The person can turn forwarding off or block a single mask, and
premium users can reply to forwarded mail within three months of receiving it.

### DuckDuckGo Email Protection

DuckDuckGo's free service forwards mail to the person's existing inbox, removes hidden trackers, and lets them create
private Duck Addresses on the fly
([DuckDuckGo: What is Email Protection?](https://duckduckgo.com/duckduckgo-help-pages/email-protection/what-is-duckduckgo-email-protection)).
Its help pages say these addresses do not expire: mail keeps forwarding as long as the account is active and the
address has not been deactivated, which the person can do, and undo
([Do private Duck Addresses expire?](https://duckduckgo.com/duckduckgo-help-pages/email-protection/duck-addresses/do-private-duck-addresses-expire);
[How do I deactivate private Duck Addresses?](https://duckduckgo.com/duckduckgo-help-pages/email-protection/duck-addresses/how-do-i-deactivate-private-duck-addresses/)).

### What the difference means for you

| | Disposable inbox | Privacy relay |
|---|---|---|
| Where mail goes | A public or short-lived web inbox | The person's own mailbox |
| How long it lasts | Minutes to days, often | Until the person turns it off |
| Who can read it | Often anyone with the address | Only the person |
| What turning it off says | Nothing: it just lapses | The person no longer wants your mail |

A relay address that stops accepting your mail is a clear signal, much like an unsubscribe, and you should stop
mailing it. A person who chose a relay is still a reader you can keep, as long as your mail stays wanted. A related
pattern, the `+tag` some mailbox providers support, is covered in the [plus addressing guide](https://email-validation.org/guides/plus-addressing/).

## What disposable addresses cost a sender

- **Bounces after the inbox expires.** Mail to an address that no longer exists comes back as a hard bounce, such as
  [550 5.1.1](https://email-validation.org/bounce-codes/550-5-1-1/), and a pattern of hard bounces counts against your
  [sender reputation](https://email-validation.org/guides/sender-reputation/).
- **Mail nobody reads.** Where the inbox lives on, your messages land somewhere nobody looks. They count in your
  sends but never in your opens or clicks.
- **Free-trial and reward abuse.** An inbox that costs nothing to create makes it cheap to sign up again and again.
- **Lost contact for real customers.** Receipts, sign-in codes and security notices sent to a throwaway inbox never
  reach the person, and they cannot recover their account later.
- **Exposure of account mail.** Where others can open the inbox, anything you send there is effectively public, as
  the study above shows.

## How to handle them at sign-up

1. **Check the address when the form is submitted,** from your server, as our
   [sign-up form validation guide](https://email-validation.org/docs/guides/signup-form-validation/) describes.
2. **Ask for a permanent address when the status is `disposable`,** if your product needs one. Explain why in one
   sentence: "Please use an email address you will keep: we send your receipts and sign-in codes there."
3. **Do not shame the person.** Avoid copy that calls the address fake or suspicious. Someone with a throwaway inbox
   may simply have been spammed after signing up somewhere else; a calm explanation keeps them on your page.
4. **Accept privacy relays.** A forwarding address that delivers to the person is not a throwaway inbox. Blocking
   it turns away people who chose privacy, not one-time use.
5. **Confirm the address.** [Double opt-in](https://email-validation.org/guides/double-opt-in/) proves the person controls the mailbox, whatever
   kind it is.
6. **Decide where a permanent address matters.** A newsletter, a one-time download and a paid account can have
   different rules. You might accept a throwaway inbox for a trial and ask for a permanent address at checkout. A
   B2B form has a related choice about free mail addresses: see
   [free vs business email](https://email-validation.org/guides/free-vs-business-email/).

Typos are the other common sign-up problem, with their own handling: see the [email typos guide](https://email-validation.org/guides/email-typos/).

## What our disposable status means

The status `disposable` means the address comes from a throwaway mail service whose inboxes are soon abandoned, so
remove it. Its action is `remove`, and its one reason, [`disposable`](https://email-validation.org/docs/statuses/disposable/#disposable), means
the inboxes are usually abandoned quickly. The [validate API](https://email-validation.org/docs/api/validate/) also returns a `disposable` flag,
and our sign-up recipe checks both the status and the flag.

On a list you already have, remove these addresses or add them to your suppression list, so a later import cannot
bring them back. When a check finds that an address forwards to another mailbox and mail sent to it is delivered,
the result is `valid` with the reason [`alias`](https://email-validation.org/docs/statuses/valid/#alias) and the action `send`. Follow the
`action` field in every case.

No list of throwaway domains is ever complete, because new services and domains appear all the time. Treat the check
as a strong filter, not a guarantee, and keep confirming new sign-ups.

## Questions

### Is Hide My Email a disposable address?

No. Apple's Hide My Email forwards to the person's own inbox and lasts until they turn the address off. If your app
uses Sign in with Apple, register your sending domains with Apple so your mail reaches these addresses.

### Should I block disposable addresses at sign-up?

Ask for a permanent address when the status is `disposable` and your product needs to reach the person later. For a
one-time download you may decide to accept it and simply never add it to your marketing list.

### Do disposable addresses bounce?

Often, once the inbox expires or the service drops the address. Some stay open and accept mail nobody reads, which
does not bounce but does not help you either.

## Try it

Try an address in the free [email checker](https://email-validation.org/email-checker/), or check a whole list with
[bulk email verification](https://email-validation.org/bulk-email-verification/) and filter on the action `remove`.

## Related

- [The disposable status](https://email-validation.org/docs/statuses/disposable/)
- [Validate sign-up forms](https://email-validation.org/docs/guides/signup-form-validation/)
- [Glossary: disposable email address](https://email-validation.org/glossary/#disposable-email)
- [Glossary: alias address](https://email-validation.org/glossary/#alias-address)

## Related guides

- [Email typos and did you mean suggestions](https://email-validation.org/guides/email-typos/)
- [Double opt-in (confirmed opt-in)](https://email-validation.org/guides/double-opt-in/)
- [Plus addressing explained](https://email-validation.org/guides/plus-addressing/)
- [How to clean an email list](https://email-validation.org/guides/email-list-cleaning/)
- [What is email verification?](https://email-validation.org/guides/what-is-email-verification/)
- [All guides](https://email-validation.org/guides/)

## Sources

- [Apple: Hide My Email](https://support.apple.com/en-us/105078): how Hide My Email works with Sign in with Apple and
  forwards to the person's address.
- [Apple: What you can do with iCloud and Hide My Email](https://support.apple.com/guide/icloud/what-you-can-do-with-icloud-and-hide-my-email-mme38e1602db/icloud):
  iCloud+ addresses, replies from the random address.
- [Apple: Stop using or reactivate a Hide My Email address](https://support.apple.com/en-ca/guide/icloud/mm3adb030cbf):
  mail to a deactivated address is returned to the sender; reactivation.
- [Apple Developer: Communicating using the private email relay service](https://developer.apple.com/documentation/signinwithapple/communicating-using-the-private-email-relay-service):
  relay domains, sender registration, daily limit, rejection after the person opts out.
- [Apple Developer: Configuring your environment for Sign in with Apple](https://developer.apple.com/documentation/signinwithapple/configuring-your-environment-for-sign-in-with-apple):
  SPF and DKIM for registered email sources.
- [Firefox Relay: FAQ](https://relay.firefox.com/faq/): email masks, blocking and turning off forwarding, replies.
- [DuckDuckGo: What is Email Protection?](https://duckduckgo.com/duckduckgo-help-pages/email-protection/what-is-duckduckgo-email-protection):
  forwarding, tracker removal, private addresses.
- [DuckDuckGo: Do private Duck Addresses expire?](https://duckduckgo.com/duckduckgo-help-pages/email-protection/duck-addresses/do-private-duck-addresses-expire)
  and [How do I deactivate private Duck Addresses?](https://duckduckgo.com/duckduckgo-help-pages/email-protection/duck-addresses/how-do-i-deactivate-private-duck-addresses/):
  lifetime and deactivation.
- [Hu, Peng and Wang: Characterizing Pixel Tracking through the Lens of Disposable Email Services](https://experts.illinois.edu/en/publications/characterizing-pixel-tracking-through-the-lens-of-disposable-emai/)
  (IEEE Symposium on Security and Privacy, 2019): study size and the account takeover finding.

## Get up to 500 free credits. No card needed.

New accounts get 500 free credits (100 when you sign up with a free email provider such as Gmail, Outlook or Yahoo, or another personal mailbox such as a paid one like Fastmail or one from your internet provider). Try it on your own list before you buy. [Create your account](https://email-validation.org/signin/?new=1) or [open the free email checker](https://email-validation.org/email-checker/).