A practical guide to implementing email verification in SaaS products: why disposable emails are a real problem for trials and analytics, how to integrate real-time verification into signup forms without friction, handling role addresses, and cleaning user imports.
Disposable email services let bad actors create unlimited free trials without ever using a real identity. Popular for feature extraction, competitor research, and credit card fraud.
Invalid and disposable addresses in your user database skew activation rates, retention metrics, and cohort analysis. Your data team is working off polluted numbers.
Sending activation emails and product notifications to invalid addresses generates hard bounces. Above 2-3%, Gmail and Microsoft start filtering your emails for real users too.
| Address type | BounceZero flag | B2B SaaS action | B2C / dev tool action |
|---|---|---|---|
| Disposable (mailinator, guerrillamail...) | is_disposable: true | Block - always | Block - always |
| Invalid (no MX record, SMTP rejection) | result: invalid | Block - always | Block - always |
| Role address (info@, admin@...) | is_role_address: true | Warn - ask for personal work email | Allow - many devs use role addresses legitimately |
| Free provider (Gmail, Hotmail...) | free_provider: true | Warn or block - require work email | Allow - Gmail signups are legitimate |
| Catch-all (score > 0.5) | catch_all_score: 0.5+ | Allow - likely valid | Allow |
| Unknown (catch-all, low score) | result: unknown | Allow (fail-open) - block only on definitive signals | Allow |
Real-time at signup (on blur)
Call the API when the user tabs away from the email field. Give instant feedback before they submit the form. This is the highest-value touchpoint - catching abuse before the account is created.
Server-side before account creation
Even if you have client-side validation, validate server-side too. Client-side checks can be bypassed. The server-side check is the last line of defence.
Fail-open for unknown results
If the API is unavailable or returns unknown (with no strong negative signal), allow the signup. Blocking legitimate corporate addresses because they’re on a catch-all domain will cost you real customers.
Async for high-volume imports
For CSV imports or SSO sync, run verification in a background job. Mark users as unverified, send a verification email, and deactivate accounts that never verify within 72 hours.
Re-check on re-activation
Users who churn and re-sign-up months later may be using a new email. Re-verify on re-activation - addresses deactivate between sign-up and re-sign-up.
Server-side proxy pattern - never expose your API key to the browser.
// Frontend - calls your own server, not BounceZero directly
const emailInput = document.getElementById('signup-email');
const feedback = document.getElementById('email-feedback');
emailInput.addEventListener('blur', async () => {
const email = emailInput.value.trim();
if (!email) return;
try {
const res = await fetch(`/api/verify-email?email=${encodeURIComponent(email)}`);
const data = await res.json();
if (data.result === 'invalid' || data.is_disposable) {
feedback.textContent = 'Please use a valid work email address.';
feedback.className = 'text-red-500 text-xs mt-1';
emailInput.setCustomValidity('invalid');
} else if (data.free_provider) {
feedback.textContent = 'Please use your work email for a business account.';
feedback.className = 'text-yellow-600 text-xs mt-1';
} else {
feedback.textContent = '';
emailInput.setCustomValidity('');
}
} catch {
// fail-open: API unavailable > no feedback, allow submission
}
});
New to verification? Start with the complete email verification guide.
Three reasons: (1) Block trial abuse from disposable addresses. (2) Improve activation and retention metrics by keeping invalid addresses out of your database. (3) Protect transactional deliverability - hard bounces from invalid addresses damage the sending domain that delivers activation emails to real users.
For B2B SaaS: yes, flagging or blocking free providers and requiring a work email is common practice. For B2C or developer tools where Gmail is legitimate: block only known disposable domains with is_disposable. Do not block Gmail wholesale - many developers and indie users legitimately sign up with Gmail.
Fail-open real-time verification on blur: call the API when the user leaves the email field, block only on definitive invalids and disposables, allow unknowns. Validate server-side too. For bulk imports, run asynchronously and deactivate unverified accounts after 72 hours.
BounceZero’s API returns is_disposable, is_role_address, and free_provider flags in one call - everything you need to protect your SaaS signup flow. 100 free credits, no credit card.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Tailored use cases across teams and sectors
Verify candidate emails before outreach
Block fake signups, reduce fraud at KYC
Block invalid addresses at checkout and signup
Volume pricing, team accounts, GDPR-ready
Block disposable emails at signup - real-time API
Protect sender reputation before outreach
Explore other topics