email.disposable_infrastructure
The domain is not on the disposable list, but its mail servers also host known disposable domains.
What it looks at#
Disposable-mail operators register new domains faster than any list can follow, and point
them all at the same few mail servers. This check takes the MX hosts the address’s domain
already resolved to (the same lookup email.mx makes, so no extra DNS) and compares them
with a reference set of MX hosts that each serve at least three domains from the
disposable list. It does not fire for domains already on the list (email.disposable_domain
covers those) or for public mailbox providers.
Shared mail providers (Google, Microsoft, Zoho, Proton, Yandex, iCloud, Fastmail, Cloudflare Email Routing, ImprovMX, Mailgun, SendGrid, large registrars and hosts) are excluded when the set is built. A throwaway domain hosted on Google therefore never taints Google-hosted businesses.
Why it matters#
A new throwaway domain on an operator’s existing servers is a disposable address the list
has not caught yet. Measured on a held-out 20% slice of the disposable list, with that slice
removed from both the list and the server set, this check recovered about half of the live
held-out domains. See the benchmark write-up in evals/results/signup-abuse-2026-10.md.
What to do#
Medium severity: an inference from shared servers, not a name on a list. Treat it like
email.disposable_domain if your product refuses throwaway addresses, but expect an
occasional false positive where a small host serves both a disposable operator and ordinary
customers. It cannot catch operators who use a different mail server for every domain, or
who host on a shared provider.