Does this tell me if the email address really exists?

No. It checks the address’s shape and its domain — that mail can be routed there — not whether the mailbox is live. Mailbox probing means talking SMTP to the receiving server; StormDoor does not do that in this gate today. When it does, it will be a separately named check, and this page will say so.

Why is info@company.com marked suspect?

It is a role account: a shared or automated mailbox rather than a person’s. Fine for a contact form, a poor fit for a personal account. Severity is medium, so it lowers the verdict to suspect without blocking; decide what that means for your form.

What is a disposable email address?

An inbox from a service that exists to be thrown away — created without an account, public or short-lived, used to get past a signup and never read again. The check matches the domain against 61,733 known providers, refreshed through StormDoor’s reference-data pipeline (list generated 2026-09-27).

Does a +tag or a dot in a Gmail address count against it?

No. It contributes data.normalised (the address with dots and the tag removed) and emits nothing. Use the normalised form to spot duplicates; treat the address itself as ordinary.

Do you keep the addresses I check?

No. The request is processed in memory and dropped; nothing you type is written to a database, storage or logs.

FREE TOOL

Email address checker

Enter an address and see whether it is structurally valid, whether its domain can receive mail, whether the domain is one of 61,733 known disposable providers, whether the mailbox name is a shared role like info@, and whether the domain is a typo of a major webmail provider. It does not check that the specific mailbox exists — no message is sent and no mail server is contacted — so clean means "nothing wrong with the address or its domain", not "someone will read the mail".

INPUT

try

200 OK13 ms (api)

BLOCK

Domain "mailinator.com" is a known disposable/throwaway email provider

6 checks run

This address looks disposable

Valid syntax
Has MX records
Not disposable
Domain "mailinator.com" is a known disposable/throwaway email provider
Not a typo of a known domain
Not a role account

code: email.disposable_domain
severity: high

{
  "ok": true,
  "verdict": "block",
  "findings": [
    {
      "code": "email.disposable_domain",
      "severity": "high",
      "message": "Domain \"mailinator.com\" is a known disposable/throwaway email provider",
      "source": "rules"
    }
  ],
  "data": {
    "mx": [
      {
        "host": "mail.mailinator.com",
        "preference": 1
      },
      {
        "host": "mail2.mailinator.com",
        "preference": 1
      }
    ]
  },
  "checks_run": [
    "email.alias_normalisation",
    "email.disposable",
    "email.mx",
    "email.role_account",
    "email.syntax",
    "email.typo_domain"
  ],
  "checks_skipped": [
    {
      "code": "ip.not_public",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "ip.hosting_provider",
      "reason": "plan",
      "available_on": "starter"
    },
    {
      "code": "ip.tor_exit",
      "reason": "plan",
      "available_on": "starter"
    }
  ],
  "meta": {
    "gate": "emails",
    "ms": 13,
    "ruleset": "reference-a39927da"
  }
}

The full /v1/emails gate also checks

Address normalisationdisposable_infrastructureprovider_typeyoung_domainasnCloud hosting IPPrivate IP rangeTor exit nodevpn_provider

Also available through the API.

Join the waitlist /v1/emails docs

Live call to the same /v1 endpoint customers use. Rules only on this page; nothing you type is stored.

What it checks

email.syntax — a practical subset of RFC 5321/5322: one @, no whitespace, local part 1–64 characters, domain labels valid, 254 characters overall. Quoted local parts and IP-literal domains fail on purpose; they are legal and almost never legitimate.

email.mx — one DNS-over-HTTPS MX query for the domain. Three outcomes short of clean: no MX records, a null MX (RFC 7505, the domain's own statement that it takes no mail), or NXDOMAIN.

email.disposable — the domain against 61,733 disposable providers (two open lists, generated 2026-09-27). A list has edges: a service created yesterday is not on it.

email.role_account — the mailbox name, +tag stripped, against a fixed list: admin, support, info, sales, contact, billing, noreply, postmaster and about twenty more.

email.typo_domain — edit distance to about two dozen webmail domains (gmail.com, outlook.com, yahoo.com, icloud.com and similar). Two edits at most.

email.alias_normalisation — emits nothing; returns data.normalised for Gmail and Outlook-family addresses (dots and +tags removed) so you can spot the same person signing up twice. A +tag address is a normal address, not a finding.

What the result means

clean — the address is well-formed, the domain publishes MX records, and none of the lists matched. suspect — a medium finding: a role account or a typo domain. block — a high finding: bad syntax, no way to route mail, or a disposable domain.

Finding	Severity	Fires when
email.invalid_syntax	high	Not structurally an address.
email.no_mx	high	The domain exists but publishes no MX records.
email.null_mx	high	The domain declares it accepts no mail (RFC 7505).
email.domain_not_found	high	The domain does not exist in DNS.
email.disposable_domain	high	The domain is a known throwaway provider.
email.role_account	medium	`info@`, `support@` and similar.
email.typo_domain	medium	`gmial.com`, `hotnail.com` and similar.

Finding

Severity

Fires when

email.invalid_syntax

high

Not structurally an address.

email.no_mx

high

The domain exists but publishes no MX records.

email.null_mx

high

The domain declares it accepts no mail (RFC 7505).

email.domain_not_found

high

The domain does not exist in DNS.

email.disposable_domain

high

The domain is a known throwaway provider.

email.role_account

medium

info@, support@ and similar.

email.typo_domain

medium

gmial.com, hotnail.com and similar.

If you sent an IP, three more can appear: ip.not_public (low), ip.hosting_provider (medium), ip.tor_exit (medium).

Why it matters

Most bad signups are not clever: a typo the user will never notice, a throwaway inbox that will be dead in ten minutes, a shared mailbox that is nobody's. All of those are visible from the address alone, before you send a verification mail or create a record. The typo case is the one users thank you for — gmial.com is a real domain, so a "send verification email" flow fails silently and the user blames you.

From your own code

curl -s -X POST https://api.stormdoor.dev/v1/emails \ -H "Authorization: Bearer sk_live_..." \ -H "content-type: application/json" \ -d '{"email":"sam@mailinator.com","ip":"203.0.113.7"}'

ip is optional; leave it out and the three ip.* checks appear in checks_skipped with reason: "input". The API needs an account — signups open with paid plans, a one-time trial included, no card. Join the waitlist and you will hear first.

Email address checker

What it checks

What the result means

Why it matters

Email addresses,
answered.

From your own code

Read more

Guides about this

Email address checker

What it checks

What the result means

Why it matters

Email addresses,answered.

From your own code

Read more

Guides about this

Email addresses,
answered.