How to Block Disposable Emails at Signup in Node.js

Blocking throwaway addresses should be two lines of code and zero milliseconds of network time. Here is the pattern we recommend for production signup flows.

1. Install

npm install spamnull

2. Validate shape, then validate domain

Keep the two checks separate. Format validation tells the user they typed something wrong; domain detection tells you the address is throwaway.

import isSpam from "spamnull";

export function validateEmail(email) {
  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
    return { ok: false, reason: "invalid_format" };
  }
  if (isSpam(email)) {
    return { ok: false, reason: "disposable_domain" };
  }
  return { ok: true };
}

3. Wire it into your handler

app.post("/api/signup", async (req, res) => {
  const result = validateEmail(req.body.email);
  if (!result.ok) {
    return res.status(400).json({ error: result.reason });
  }
  await createUser(req.body);
  res.json({ ok: true });
});

4. Always validate on the server

A client-side check is a UX nicety, not a control. Anyone can POST straight to your endpoint. Run isSpam server-side; mirror it in the browser only to show instant feedback.

5. Fail politely

Never dead-end a real person. Show a message like "Please use a permanent email address" and offer a support path. Detection is a heuristic — read how to keep false positives near zero before you hard-block anyone.

6. Works in every runtime

The package ships ESM, CJS and TypeScript types, so the same call works in Node, Bun, Deno and edge runtimes such as Cloudflare Workers and Vercel Edge. That portability is a direct consequence of the self-hosted architecture, and it is why the check is safe on hot paths that run on every request.

New to the problem? Start with what disposable emails actually are.

$ npm install spamnull