Disify API

Free disposable email checker API with no key: detect temporary and throwaway email domains, validate format and check DNS. CORS enabled. Tested example.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 19 Aug 2026

What is the Disify API?

Disify is a free, key-free API that checks whether an email address uses a disposable or temporary domain, and also validates its format and confirms the domain has working DNS records.

Disposable email addresses are the main way people bypass signup verification, free trials and rate limits. Disify checks an address against a maintained list of throwaway providers and returns a simple boolean.

It does three checks in one request: format validity, whether the domain is disposable, and whether DNS resolves. That last one is the quiet value — a syntactically valid address at a domain with no MX records can never receive mail, and catching that at signup avoids a guaranteed bounce.

Quick facts

Base URL: https://disify.com/api
Authentication: No API key required.
Rate limit: No published limit; fair use expected.
Pricing: Free.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the Disify API

Every request below was executed against the live API on 19 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Check an email address for disposability

GET https://disify.com/api/email/test@gmail.com

curl

curl 'https://disify.com/api/email/test@gmail.com'

JavaScript (fetch)

const res = await fetch("https://disify.com/api/email/test@gmail.com");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://disify.com/api/email/test@gmail.com", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

{
  "format": true,
  "domain": "gmail.com",
  "disposable": false,
  "dns": true,
  "whitelist": true,
  "confidence": 0,
  "domain_info": {
    "tld": "com",
    "is_subdomain": false,
    "parent_domain": null
  },
  "mx_info": [
    "gmail-smtp-in.l.google.com",
    "alt1.gmail-smtp-in.l.google.com",
    "alt2.gmail-smtp-in.l.google.com",
    "alt3.gmail-smtp-in.l.google.com",
    "alt4.gmail-smtp-in.l.google.com"
  ],
  "role": false,
  "free": true
}

Parameters

Parameter	Type	Required	Description
`email/<address>`	path	Optional	Check a full email address. `test@gmail.com`
`domain/<domain>`	path	Optional	Check a domain only. `mailinator.com`
`email (POST)`	body	Optional	Bulk check by POSTing newline-separated addresses. `a@x.com\nb@y.com`

Response fields

formatboolean: Whether the address is syntactically valid.
domainstring: The domain that was checked.
disposableboolean: True when the domain is a known throwaway provider.
dnsboolean: Whether the domain has working DNS records.
whitelistboolean: True for well-known trusted providers such as Gmail.

What you can build with the Disify API

Block disposable addresses at signup to reduce fake accounts
Catch undeliverable addresses before sending, reducing bounce rate
Protect free trials and referral programmes from abuse
Clean an existing mailing list of dead domains

Common errors and how to fix them

format: false

The address is syntactically invalid.

Fix: Reject before attempting delivery; no further checks are meaningful.

dns: false

The domain has no working DNS or MX records.

Fix: Mail to this address will bounce — treat it as invalid at signup.

False positives on new domains

The disposable list cannot be exhaustive.

Fix: Use it as one signal among several rather than a sole gate on account creation.

Disify API — frequently asked questions

Is there a free API to detect disposable email addresses?

Yes. Disify checks whether an address uses a known throwaway domain, with no API key required, and also validates format and DNS.

What does the whitelist field mean?

It marks well-known legitimate providers such as Gmail and Outlook. A whitelisted domain is definitively not disposable.

Can I check many addresses at once?

Yes, POST newline-separated addresses to the bulk endpoint rather than making one request per address.

Should I block every disposable address?

It depends on your product. Blocking reduces abuse but also blocks privacy-conscious legitimate users. Many teams allow signup but require verification before granting paid features.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

Alternatives to Disify API

If Disify does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
EPSS (FIRST.org)	Free EPSS API from FIRST.org with no key: daily exploitation probability and percentile for every published CVE. Prioritise patching by likelihood, not just severity.	No key	Yes	21 Aug 2026
FilterLists	Free FilterLists API with no key: a catalogued directory of thousands of adblock, DNS and firewall filter lists with syntax, licence, language and maintainer metadata. Tested example included.	No key	No	21 Aug 2026

All Security & Auth APIs

Disify is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 19 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.