My form lets through disposable emails

If your form is allowing disposable email addresses, the fix is usually to add a domain-based disposable email check during validation.

Here’s a practical approach:

1) Validate against a disposable email list

Check the email’s domain against a known list of disposable domains, such as:

• mailinator.com
• 10minutemail.com
• tempmail.com
• guerrillamail.com

2) Normalize the email first

Before checking:

• lowercase the domain
• trim whitespace
• optionally strip plus addressing for your own logic

3) Block at both frontend and backend

Frontend validation improves UX, but backend enforcement is essential so users can’t bypass it.

4) Use a third-party API or maintained blocklist

Disposable domains change often, so a maintained service is better than a hardcoded list.

Example logic

function isDisposableEmail(email) {
  const disposableDomains = new Set([
    'mailinator.com',
    '10minutemail.com',
    'tempmail.com',
    'guerrillamail.com',
  ]);

  const domain = email.trim().toLowerCase().split('@')[1];
  return disposableDomains.has(domain);
}

5) Consider edge cases

Some disposable providers use multiple subdomains, so a suffix match may be needed:

• abc.mailinator.com
• user@mailinator.co

Example:

function isDisposableEmail(email) {
  const disposableDomains = [
    'mailinator.com',
    '10minutemail.com',
    'tempmail.com',
    'guerrillamail.com',
  ];

  const domain = email.trim().toLowerCase().split('@')[1];
  return disposableDomains.some(d => domain === d || domain.endsWith('.' + d));
}

6) Add rate limiting / CAPTCHA if needed

If the issue is spam rather than just disposable emails, combine email checks with:

• CAPTCHA
• rate limiting
• honeypot fields
• IP/device fingerprinting

If you want, I can help you implement this in your stack (React, Node, PHP, Laravel, Python, etc.).