How to block disposable emails in Next.js

The problem

Throwaway email providers (Mailinator, temp-mail clones, and hundreds of rotating lookalikes) let anyone create a working inbox in seconds. In a Next.js app that means fake signups: skewed activation metrics, abused free tiers, and wasted onboarding emails. A hardcoded list of bad domains goes stale the day after you ship it. New throwaway domains appear constantly.

Step 1: install the SDK and create a server-side client

npm i mailsurity, then create one shared client. Keep it server-side: your API key is a secret and must never reach the browser (the SDK throws if you try). It fails open by default, so a transient blip never blocks a real customer.

import { Mailsurity } from 'mailsurity';

// One shared, server-side client. The API key is secret, never import
// this into a Client Component. Fail-open is on by default, so a transient
// outage never blocks a real signup.
export const mailsurity = new Mailsurity({
  apiKey: process.env.MAILSURITY_API_KEY!,
});

Step 2: reject at signup

Call mailsurity.isDisposable(email) from your signup route (or a Server Action) before you create the user, and return a friendly error for disposable addresses.

import { mailsurity } from '@/lib/mailsurity';

export async function POST(req: Request) {
  const { email } = await req.json();

  if (await mailsurity.isDisposable(email)) {
    return Response.json(
      { error: 'Please use a permanent email address.' },
      { status: 422 },
    );
  }

  // ...create the user as normal
  return Response.json({ ok: true });
}

Why not just use a static list?

Static blocklists only catch domains they already know. Mailsurity also fingerprints the mail servers behind throwaway addresses, so a brand-new disposable domain pointing at a known throwaway mail host is caught on the first request, before any list has heard of it. That is the gap an offline .json of bad domains can't close.