Disposable Email & Domain Blocklists

1. What It Is & Why It Exists

The Attack Vector: Disposable Burner Inboxes

In any platform offering free incentives (cloud compute credits, sign-up bonuses, referral rewards, or free trial quotas), malicious actors script mass account creation using disposable email services (e.g., tempmail.com, mailinator.com, 10minutemail.com, guerrillamail.com).

These services expose public REST APIs or catch-all inboxes that allow botnets to receive activation links and OTP verification codes programmatically within hundreds of milliseconds without paying for email infrastructure or providing identity credentials.

Interactive Architecture Diagram
100%Fit100%
Synthesizing vector architecture diagram...

The Systemic Impact: SES Reputation Destruction

Allowing disposable email addresses causes critical infrastructure failure beyond fake accounts:

1. Email Provider Blacklisting: Disposable addresses are transient; they expire within 10 to 60 minutes. Subsequent transactional emails (receipts, updates, security alerts) hard-bounce.
2. AWS SES Suspension: Amazon SES requires accounts to maintain a hard bounce rate under $5\%$ (warning threshold at $2\%$). A spike in disposable account registrations rapidly pushes bounce rates above $5\%$, causing AWS to terminate the entire sending identity.
3. Database Bloat & Analytics Pollution: Registration tables fill with ephemeral accounts that will never convert, skewing cohort retention and lifetime value (LTV) metrics.

2. Core Mechanics & Algorithmic Foundation

A. Fast Set Membership: In-Memory Set vs Bloom Filter

Validating whether an email domain is disposable must not add measurable latency to the registration critical path ($< 0.5\text{ ms}$).

1. In-Memory Hash Set ($\mathcal{O}(1)$):
   • Maintains a set of canonical domains (e.g., 5,000 known disposable domains).
   • Memory footprint: $5000 \times 32\text{ bytes} \approx 160\text{ KB}$. Fits easily in application L3 cache or Node.js runtime memory.
2. Radix Trie for Wildcard Subdomains:
   • Disposable providers frequently generate dynamic subdomains (e.g., user123.trashmail.net, temp.inbox.org).
   • Reversing the domain strings (ten.liamhsart.) and storing them in a Radix Trie enables prefix matching in $\mathcal{O}(L)$ time where $L$ is the length of the domain.
3. Redis Bloom Filter (Distributed Cache):
   • For a cluster of hundreds of microservices, an Amazon ElastiCache Redis cluster running RedisBloom allows multi-instance domain checks via BF.EXISTS disposable_domains <domain> with a false positive probability $p < 0.001$:

$m = -\frac{n \ln p}{(\ln 2)^2} \quad\text{where } n = 100,000 \text{ domains}, \; p = 0.001 \implies m \approx 179\text{ KB}$

B. Pre-flight DNS MX Record Resolution

Attackers frequently register new custom domains daily (e.g., temp-drop-2026.xyz) that do not yet appear in public open-source blocklists. To intercept these, the system performs a DNS Mail Exchange (MX) check:

Interactive Architecture Diagram
100%Fit100%
Synthesizing vector architecture diagram...