How the data is built

Domains by source

• At least two of four open lists62,902Four larger open lists hold real sites by mistake, so a domain needs two of them to agree. Popular sites are filtered out.
• The disposable-email-domains list10,143A hand-maintained open list (CC0), and our starting point.
• A report we reviewed and accepted1Someone reported it, or our bot saw one temp-mail service offer it, and we accepted it after a review. The verdict is risky.

Each domain is counted under one source, even when more than one list has it. Every /is page and GET /v1/domain answer names the source behind it.

How a domain gets in, and out

Once a day we download the lists. A list that looks broken, because it’s too short or shrank too much overnight, is refused and yesterday’s data stays.

A domain that leaves a list leaves our data at that refresh, and shows in /v1/domains/removed. Sites in the top 100,000 of the Tranco popularity ranking are filtered out of the looser lists.

We also collect domains ourselves. MailVetBot reads the domains temp-mail services publish on their own pages. A domain gets in by itself only when at least two different services on our fixed list offered it in the last 7 days, across two runs. It also has to have mail servers, none of them a general provider’s like Google Workspace or Microsoft, and it can’t be a popular site, a free provider, a private relay or on an allowlist. It stays when the services stop offering it, and its last-seen date says when that was.

Part of this collection comes from the public API of mail.tm.

A domain only one service offers doesn’t get in by itself. It waits until we’ve reviewed it, and goes in as a report if we accept. If we take a domain off, it stays off this collection, and GET /v1/domains/removed tells anyone keeping a copy.

We sample the mail servers of listed domains. When a checked domain receives mail on a server that at least 5 listed domains use, and that isn’t a general provider or shared host, it’s flagged suspect. That’s a signal. It doesn’t change the verdict, and it clears when the servers change.

Anyone can report a domain. A report changes nothing until we’ve reviewed and accepted it, and big providers can’t be reported. An accepted report makes the verdict risky, and stays through refreshes unless we take it back.