How old are disposable email domains?

What is RDAP, and why use it for domain age?#

RDAP, the Registration Data Access Protocol [1], is the JSON successor to WHOIS. A registry or registrar answers a query for a domain with its status and events, including a registration event with a date. That date is the basis for “domain age” checks. The rdap.org service redirects each query to the right registry [2]. Some registries publish no RDAP service, and some responses omit the date, so coverage is incomplete.

How old are disposable email domains?#

The disposable distribution is wide. A quarter of the domains are under a year old, and a quarter are over 11 years old. Registration counts by year show that 71 of the 335 were registered in 2026 and 43 in 2025, compared with 3 to 23 per year across 2005 to 2024.

The legitimate baseline’s one young domain is stormdoor.dev, which is days old and is flagged correctly by email.young_domain.

Why are so many disposable domains old?#

Three explanations fit the data, and we have not separated them.

1. Survivorship in the sample. Only domains with working MX records were sampled, which is about 30% of the list. Throwaway domains that were registered cheaply and abandoned may have lapsed or lost their DNS, in which case the survivors are those someone keeps paying for. We did not measure the ages of the dead 70%.
2. Lists lag. A volunteer-maintained list adds a domain after it has been seen and reported. A listed domain has by definition had time to be noticed, so brand-new unlisted domains are underrepresented in a list. This sample cannot say how old the unlisted ones are.
3. Repurposed domains. Operators can buy aged or expired domains and point them at disposable mail servers. Some listed domains may also be old, ordinary domains that were added at some point in their history. We did not test either case.

What does this mean for domain-age checks?#

A domain-age rule such as “flag domains younger than 30 days” would have fired for 7 of 335 listed disposable domains, so it is a poor disposable-email detector. Its value is different: it catches fresh domains that are on no list, which this sample cannot measure. StormDoor’s email.young_domain finding is low severity for that reason: new startups and personal domains are also young [3].

A baseline comparison shows the signal has some power as one input: 26.6% of disposable domains are under a year old against 0.7% of the legitimate baseline. But the baseline is hand-picked, large, well-known organisations, so it overstates the gap compared with a realistic stream of signups. Real signups include many small businesses with young domains.

Combine age with signals that do not depend on it: whether the domain exists and has MX (which mail servers disposable domains use), whether the mail servers are shared with listed domains (infrastructure matching), and the list itself (email.disposable_domain).

What should you do with this?#

Treat “domain registered less than 30 days ago” as a weak, cheap signal that is useful on addresses no list has seen, and do not rely on it for listed ones. You can look up any domain’s registration date in the domain age checker; the emails gate runs the same lookup as email.young_domain. StormDoor makes both. For how this signal fits next to mailbox checks, see email validation vs verification; other vendors’ disposable-email services are compared in best disposable email detection APIs. The domain-age lookup for this article used the public rdap.org service, not StormDoor’s own API.