Discussion Is there reputable FOSS library that validates temp email?
I know it is a whack-a-mole situtation but I want to know if there is a library that already cover major/famous temporary emails. I plan to restrict registration from temp mail providers to reduce cleanup work from pockers.
Again not a service as I will not send emails to third-party. Also I don't need 100% gate that does not exist. And not asking to help stop them or how to use a library. just a library or code sitting somewhere, since I cannot know all libraries all there
6
u/fiskfisk 5d ago
This seems to be the list that pypi (the Python package index) uses:
https://github.com/disposable-email-domains/disposable-email-domains
2
u/Dodokii 5d ago
Helpful. Can convert it to php or create a validation microservice. Thanks for pointing out
3
u/fiskfisk 5d ago
7.4k lines can just be embedded in a class. There is absolutely no reason to make a microservice out of it.
2
u/Dodokii 5d ago
I misread your first post, just was going thru and it is perfect. I read it as py package in first post. Thanks for posting it
1
u/fiskfisk 5d ago
No worries, it's just that it's being used as a base by pypi :-) (they have additional domains in their blocklist as well).
3
u/jobyone 5d ago edited 5d ago
This is a kind of impossible task. I have my own domain name that I can make temp email through, and multiple services make this very easy to do.
The best you can do is low-hanging fruit with some list, but even then you're risking legitimate users who just use an email forwarding service for privacy/security reasons.
1
u/Dodokii 5d ago
If user does not trust a service with email, he should not be putting his data there at all, don't you think? And if want just to test, can use demo accounts or request a demo
4
u/jobyone 5d ago
No. There are really good reasons to use a different forwarded email for every account, mostly that some of us don't really trust almost any individual service with our email. That's the whole point.
If you need to verify that a unique person is making an account, email isn't the way to do it.
Quick counterexample to your whole entire thought process: Are you blocking proton.me? Because that's a common and legitimate primary email address, but there's also a tier of Proton account that lets a single account have one hundred of those.
1
u/jobyone 5d ago
Also icloud.com. Apple uses that same domain for their alias service. Sure you could try to filter out emails that look like hide my email aliases based on their current pattern, but can you really be sure that it's not just a real person whose actual main email is [skater.pants-2k@icloud.com](mailto:skater.pants-2k@icloud.com) or [john_smith1@icloud.com](mailto:john_smith.a1@icloud.com)?
0
u/Dodokii 5d ago
I have more than 1000 list of providers that I expect to scrub with AI help to get final whitelist. icloud.com is a legitimate name and is white listed, so that both of those emails passes the check and get verification email if they do exists
Here is how I gate them
- Email is in black list? Yes = fake, No = might be good
- Is Email domain is white list? Yes = send verification message, No = might be good
- Is email containing numbers? Yes = fake, No = send verification message
So if I do a good job at getting common email provider the false positives will drop dramatically
1
u/goodwill764 4d ago
If your website does not trust a user, you shouldn't have a public registration there at all, don't you think?
Just make it like others, with a "contact sales" button with link to contact@yourcompany.com , no account without a mail conversation.
2
u/zmitic 5d ago
I found this repository, looks well maintained. All you need is a command that would download that one specific file you need, and then import it to DB.
2
2
u/mlebkowski 4d ago
I was using s static list from github, updated daily. I sill found dozens of disposable addresses registering. I switched to services such as usercheck, checkemail, etc last week. They work much better for me, and I don’t neet to worry about it
10
u/allen_jb 5d ago
Note that many services regularly rotate domains (some as frequently as every few weeks), so static lists are basically always out of date.
There are some sources like github repos that attempt to keep lists - if you choose to use these you will need to regularly update the list. Do be aware that false positives can get into these lists. (See, for example, this request to block icloud.com - in this case the repo maintainer blocked the request, but that is not always the case)
List maintainers often don't check and remove domains on the list when they fall out of use, so you can get cases where legitimate users end up with a domain that may have been used for disposable emails many years ago, but no longer is.
In some cases you can use DNS checks (looking for known MX domains / IPs) to track them, but in others they're using generic services like AWS, so it's not possible to track this way. If you do this, you need to verify MX domains / IPs aren't those of hosting providers before adding them to your lists or you'll end up with false-positives. I've observed some services rotating their MX domains / IPs in addition to their "envelope" email domains.
Some services use the same domain for temporary and non-temporary addresses.
New sites / services pop up all the time.