The shared list of disposable addresses

A disposable address takes seconds to create and is dropped right after: it is the most common way to open accounts in bulk. Kreezalid keeps a list of these domains, shared by every marketplace and updated every night.

Where the list comes from

It combines three public lists of disposable domains, maintained by their communities: disposable-email-domains, disposable/disposable-email-domains (in its disposable-only version) and FakeFilter. A domain on any of them is added to the shared list.

What is never blocked

Major mailbox providers are kept out of the shared list, even when a source adds them: Gmail, Outlook, Hotmail, Live, MSN, Yahoo, iCloud, AOL, GMX, Web.de, Proton, Orange, Wanadoo, Free, La Poste, SFR and Bouygues Telecom (bbox.fr, neuf.fr).

Alias services, which forward messages to a real mailbox (Apple’s Hide My Email, Firefox Relay, SimpleLogin…), are accepted too.

Open the setting

In the menu, under Configuration, click Settings, then Users, in the Customers & communication group.

Both lists are on the General settings for users screen, one below the other; the Check an address card is at the bottom of the screen. Enter the domains without @, separated by commas (domain1.com, domain2.co.uk), then click Save Changes.

Settings › Users — example
E-mail providers blacklist
disposable-example.com, other-disposable.net

You can enter multiple domain names by separating them with commas

E-mail providers whitelist
example.com, example.co.uk

Domains accepted at sign-up even when blocked as disposable. Separate them with commas.

Save Changes

Block more domains: the blacklist

The E-mail providers blacklist adds your own domains to those of the shared list, for example a disposable service it does not know yet.

An address with one of these domains is accepted on the sign-up form, but the account is created inactive and banned.

Accept a refused domain: the whitelist

The E-mail providers whitelist accepts a domain at sign-up even when the shared list refuses it. Use it when a legitimate domain is on that list by mistake: the public lists it comes from sometimes carry one.

What happens to an address, by its domain (in order)
  1. 1On the shared list, not on your whitelistRefused
  2. 2On your blacklistAccount created, banned
  3. 3Anywhere elseAccepted

Check an address

When a user tells you they cannot sign up, enter their email address, or just a domain, in the Check an address card at the bottom of Settings › Users, then click Check. The answer gives the rule the sign-up form would apply:

Settings › Users, at the bottom of the screen — example

Check an address

Email address or domain
customer@example.com
Refused: an account already uses this address. The user can reset their password: https://your-marketplace.com/account/requestpassword View the account
Check
  • domain on the shared list: sign-up is refused; add the domain to the whitelist to accept it;
  • existing account: an account already uses this address. The View the account link opens its profile, and the answer gives the address of your storefront’s password reset page, to pass on to the user;
  • domain on your blacklist: the account would be created inactive and banned;
  • domain accepted thanks to your whitelist, or nothing blocks the address.
The other possible answers
Refused: disposable-example.com is on the platform’s list of disposable email providers. Add it to the whitelist to accept it.
The account is created inactive and banned: disposable-example.com is on your blacklist.
Accepted: example.com is on the platform’s list of disposable email providers, but your whitelist lets it through.
Nothing blocks example.com at sign-up.

What your users see

An address whose domain is on the shared list is refused:

  • on your storefront’s sign-up form;
  • when signing in with Google or Facebook would create a new account.

The user sees a message asking them to use another address, and no account is created, so they do not appear in your list of users. The same message appears when an account already uses the address: the checker tells the two cases apart.

With a domain on your blacklist, the sign-up looks accepted, but the person cannot log in. No message tells them which domains are filtered, so a bot learns nothing about what to change.

Edge cases and limits

  • Existing accounts are not affected: the lists apply at sign-up.
  • Exact domains: a domain matches exactly, regardless of case. example.com does not accept mail.example.com or example.fr, which you add separately.
  • A domain on both lists stays blocked: the whitelist only lifts the shared list’s block.
  • A domain alone in the checker: the check does not look for an existing account.