The State of Disposable Email, November 2026

As of November 7, 2026, we track 228,253 disposable email domains, and a live Domain Name System (DNS) sweep run the same day found 37.31 percent of them able to receive mail. The headline is mortality, now measured at each domain's own 30 day mark: 2.32 percent of live disposable domains are dead within 30 days of first being seen alive. And a visitor to our own signup forms makes a point no dataset can: detecting disposable email and stopping bots are different problems.

Headline findings

• We track 228,253 disposable email domains, and 37.31 percent of them can still receive mail today.
• Measured at each domain's own day 30: 2.32 percent of live disposable domains, 1,952 of 84,242, are dead within 30 days of first observation.
• Inside the 37 day window, 4,236 tracked domains went from alive to dead and 2,833 came back the other way.
• Outside intake days, genuinely new disposable domains arrived at 91.9 per day, up from 84.2 last month, and no day produced zero.
• The free list disposable/disposable caught 3,301 of the window's 5,579 new domains, by far the best freshness any free list has posted in this series.
• .tw supplied 3.41 percent of the window's new domains against 0.09 percent of the full dataset, roughly thirty-eight times its historical weight.

How many disposable email domains exist right now?

We currently track 228,253 disposable email domains. That total is the accumulated picture, not a count of domains that work today: the same day sweep found 85,168 domains, 37.31 percent, able to receive mail, 57,954 with working Mail Exchange (MX) records and 27,214 reachable only through the address record fallback that Request for Comments (RFC) 5321 defines.

How did the numbers move since October?

This is the fourth monthly edition, and against the October 2026 edition the picture is one of steadying:

Metric	October 2026	November 2026
Domains tracked	225,969	228,253
Alive today	85,130 (37.67%)	85,168 (37.31%)
Genuinely new in window	9,155 in 35 days	5,579 in 37 days
Returning domains	531	12
Steady daily average outside intake days	84.2	91.9
Intake events	4 (6,628 domains)	3 (2,456 domains)
30 day mortality	2.22% (1,741 of 78,282 with a recheck on or after day 30)	2.32% (1,952 of 84,242 with a recheck on or after day 30)
Top free list coverage gap	91.7%	90.8%

Two reading notes. The window total fell by a third, but the table shows why: intake events delivered 6,628 domains in October's window against 2,456 in this one, while the steady daily average, the organic discovery rate, rose from 84.2 to 91.9. And a definitional note for regular readers: the 30 day mortality is now taken at each domain's own day 30, among domains with a recheck on or after that day, and both cells above use that definition; the 3.88 percent October headlined was the same cohort's share dead at latest recheck, the longer view reported separately below.

How fast do new disposable domains appear?

In the 37 days from October 1 to November 6, we detected 5,579 genuinely new disposable domains, an average of 150.8 per day with a median of 85. Three intake events sit inside that total, described here exactly as the pack words them: on October 2, 1,141 domains arrived from a one time vetted addition of newly identified throwaway domains; on October 9, 570 domains arrived from a surge across several of our upstream lists; and on October 21, 745 domains arrived from a surge across several of our upstream lists. Excluding those 3 intake days, the remaining 34 days averaged 91.9 genuinely new domains per day, and the quietest day of the window still produced 43.

New disposable domains detected per day across the observation window. The one time bulk import that seeded the dataset is excluded.

The arrivals are overwhelmingly real mail destinations: 4,861 of the 5,579 still pass MX validation today, with 689 already dead and 29 unknown. Grouped by the mail infrastructure they route through, cloudflare.net received 278 of the window's new domains, chatgpt.org.uk 191, and blackhole.mx 124. The standing caution applies, with an addition this month: a cluster names shared mail infrastructure, not necessarily a disposable operator, and the list is not a complete ranking, since it leaves out mail hosts that are themselves throwaway services and some large legitimate ones. 971 of the window's new domains have no mail host today and sit outside any cluster.

What are returning domains, and why do they matter?

A domain that drops out of our dataset and is listed again later gets a fresh detection date, which would make it look brand new. The report separates the two by checking every window domain against the previous month's extraction snapshot: this month, 12 domains turned out to be returners, already tracked before October 1, and they are excluded from every new domain figure here. The count is a floor, because a domain that left and came back between two snapshots still looks new. Twelve is a small number; the mechanism it guards against is not, as the resurrection counts below show.

Which top level domains do disposable providers use, and why does the concentration matter?

Across all 228,253 domains, the top five top level domains (TLDs) hold 125,072, 54.80 percent of the dataset, out of 683 distinct TLDs. .com leads at 82,692 domains, 36.23 percent, and now holds slightly fewer domains than it did a month ago even as the dataset grew, while .xyz, at 11,913, has overtaken .ru for second place.

Share of all 228,253 tracked disposable domains, by top level domain.

The concentration remains economic, and the month's sharpest signal is again in the new detections.

Top level domain mix of newly detected disposable domains versus the full dataset.

.com fell to 20.34 percent of new detections against 36.23 percent of the corpus. The overweight TLDs reshuffled again: .id ran at 10.04 percent of new against 1.12 percent overall, .click at 5.05 against 0.87, and .tw at 3.41 percent of new against 0.09 percent of the corpus, roughly thirty-eight times its historical weight. Last month the hot TLDs were .xyz and .ng; this month they are .id, .click, and .tw. The target keeps moving, which is why a detector tuned to the historical distribution lags the present.

How much of the disposable ecosystem is already dead?

Status	Domains	Share of all 228,253
Alive, mail could be delivered today	85,168	37.31%
Dead, no mail route today	139,056	60.92%
Unknown, transient DNS failure	4,029	1.77%

Of the dead, 135,735 have no mail route at all and 3,321, 1.45 percent of the dataset, publish an explicit null MX. The unknowns persisted through two retries and count as neither alive nor dead. The standing caution travels with the dead share: it describes the accumulated corpus, not a death rate, and dead entries are never harmless, because an expired domain re-registered by a legitimate owner turns a stale blocklist entry into a false block.

How quickly do live disposable domains die?

The 30 day figure is now taken at each domain's own day 30: of the 85,196 domains first observed alive at least 30 days before the window end, 84,242 have a recheck on or after their 30th day, and 1,952 of those, 2.32 percent, were dead or null MX at day 30. That is the only figure in this section that may be read as a 30 day rate: roughly one in forty-three live disposable domains is gone within a month of first being seen alive.

The longer view: of the same 85,196 domains, 5,674, 6.66 percent, are dead or null MX at their latest recheck, a median of 82 days after first observation. Read that as attrition to date, not a 30 day rate, and it should not be compared between editions, because it rises from one report to the next as the group ages. The churn inside the window ran in both directions: 4,236 tracked domains went from alive to dead or null MX, and 2,833 came back. Over seven thousand status flips in five weeks is the measured version of the argument this series keeps making: a static snapshot of this population is wrong within days, in both directions.

How well do the popular free blocklists actually perform?

The same three community blocklists, downloaded fresh on report day and judged against the same live MX sweep. All three remain genuinely maintained, and this month the movement is real enough to lead with.

Blocklist	Entries	Live disposables it misses	Dead weight	New in our window it caught
disposable-email-domains	10,143	77,293 (90.75%)	2,164 (21.33%)	515 of 5,579
disposable/disposable	98,914	33,579 (39.43%)	46,392 (46.90%)	3,301 of 5,579
mailchecker	57,702	65,437 (76.83%)	37,245 (64.55%)	726 of 5,579

Free blocklist coverage gaps and dead weight, both measured against a live MX sweep of every domain run the same day.

Credit first. disposable/disposable grew to 98,914 entries, pushed its coverage gap below 40 percent for the first time in this series, and caught 3,301 of the window's 5,579 new domains, nearly three in five, by far the best freshness result any free list has posted here; mailchecker's 726 is also its strongest showing. The structural limits stand: the most widely copied list misses 90.75 percent of the domains live right now, dead weight runs from a fifth to nearly two thirds of the lists' own entries, and every dead entry is a latent false block, a risk this month's 2,833 resurrections make concrete. The reverse comparison holds: 73 domains appear in at least one list but not in ours, every one a deliberate allow list exclusion protecting relay services and other legitimate domains.

What does a null MX record mean?

A null MX record is a domain declaring, in DNS, that it never accepts email: a single MX record pointing at the root, defined in RFC 7505, and the cleanest no-mail signal there is. In this month's dataset, 3,321 domains, 1.45 percent of the total, publish one, and we count them among the dead because by their own configuration that is what they are. The full mechanics, including why a null MX is the opposite of simply having no MX record, are in our null MX explainer.

Why are relay services like Apple Hide My Email not disposable?

Because a relay address forwards to a real person's permanent inbox, and a disposable address does not. A relay or forwarding service, Apple Hide My Email, Firefox Relay, SimpleLogin, addy.io, DuckDuckGo Email Protection, or Proton, gives a privacy conscious, often paying user a masked address that keeps working. We track 12 relay domains across those 6 provider families, a count reflecting the providers shipped in the current product configuration rather than a live database query, flagged as a separate signal, never part of the disposable verdict, and never blocked by default. Twelve stable domains against 5,579 new throwaways in five weeks is the whole distinction in one comparison, and blocking relays turns away real customers while stopping no abuse.

Seen on our own forms. These figures come from our own site's records, not the domain dataset. Starting late on November 2, 2026 (Coordinated Universal Time, UTC), one scripted browser spent about 19 hours visiting our public forms: 8 visits, every 1 to 3 hours, the same sequence each visit. It created 6 fake accounts, none ever verified, so none could use the service, and triggered 12 unwanted emails to whatever addresses it typed. Our web analytics showed nothing, it ignores automated browsers; the first sign, and the tell worth watching, was a run of signups that never verified. We stopped it about 1 hour 45 minutes after spotting it. Its addresses were not disposable, so they passed our own disposable check at signup. We do not know its motive; one known pattern is email bombing, signing a victim's real address up across many sites to flood their inbox, but we cannot confirm that.

What should you do if you run a signup form?

Start with what the sidebar above teaches: a signup form is also a form that sends email, verification, confirmation, welcome, so a script can make you send mail to addresses that never asked for it. Detecting disposable email and stopping bots are different problems, and a form needs both. This report is about the first problem, where the framing matters as much as the tooling. Letting throwaway signups through does not damage your sending reputation at Gmail, Outlook, or Yahoo; mailbox providers judge you on how their own users treat your mail, and a dead disposable domain has no users at any of them. The damage lands at your email service provider (ESP), and the mortality figure puts a clean number on the timeline: 2.32 percent of live disposable domains die within 30 days of first observation, so the throwaways you accept this month start hard bouncing on a schedule. Bounce spikes are among the strongest list quality signals platforms like Mailchimp and SendGrid police, with consequences running from warnings to suspension. The fix is unchanged: validate at signup against something that moves at the flow's speed, block confirmed throwaways with a clear message, let relay addresses through, and fail open so the check never breaks the form. This report is drawn from the same live, MX validated dataset that isitdisposable.com uses to do exactly that in one Application Programming Interface (API) call or a drop in snippet, with a free plan of 250 lookups a month and a 14-day full access trial, no credit card, if you want to see your own signup traffic through this lens.

Methodology

Every figure in this report, apart from the firsthand sidebar above, comes from a read-only extraction of our production database on 2026-11-07 at 04:17:02 UTC, paired with a live DNS sweep of all 228,253 tracked domains run the same day. Nothing is estimated or extrapolated, and any metric that could not be computed honestly is labeled CANNOT COMPUTE with the reason. The dataset is built from six upstream lists refreshed every six hours, plus our own monitoring of the domain pools that throwaway providers advertise, with staff review of additions; none of them are named. Aliveness uses the same resolution rules we apply in production: an MX lookup first, an A and AAAA address record fallback per RFC 5321 when a domain has no MX record and no null MX, and the null MX convention per RFC 7505. Transient DNS failures were retried twice, and anything still unresolved is reported as unknown, never counted as dead.

The observation window is the 37 days from 2026-10-01 to 2026-11-06. The initial bulk import that seeded the dataset, 200,782 domains sharing a single load timestamp, is excluded from every growth figure and included in every snapshot figure; the extraction day is excluded from the window and had contributed 75 new domains by extraction time. Returning domains are separated from genuinely new ones by checking every window domain against the previous month's extraction snapshot, and all new domain figures exclude them. This is the fourth monthly edition. Customer and API usage statistics are not part of the public data series.

Cite this data

You are welcome to cite any statistic in this report. Please attribute it to the isitdisposable.com State of Disposable Email report, November 2026, and link to this page. If you need a figure that is not here, or a breakdown we have not published, ask, and we will see whether the data supports it.