Disposable email

A disposable email address is a temporary inbox from a throwaway-mail service - created in one click, no registration, often expiring within minutes or hours. The address works long enough to receive a confirmation message, then evaporates, leaving no way to reach whoever used it.

Legitimate people do use them, mostly to dodge newsletters they never asked for. But on forms that exist to start a relationship - a lead form, a signup, a quote request - a disposable address is a strong negative signal. A visitor who wants a reply does not hand you an inbox that will not exist tomorrow, so disposable domains correlate heavily with bots, fake signups, and free-trial abuse.

Detection is done by domain: the throwaway services operate under known domains, and community-maintained lists track them. The lists churn constantly as services rotate domains to evade exactly this kind of filtering, so coverage is always partial and occasionally wrong - a small legitimate mail host can land on a list by mistake. That fallibility is the argument for treating a disposable-domain hit as grounds for review rather than automatic deletion: the signal is strong, but the list behind it is a moving target.

In SheetLink Forms, disposable email domains are one of the content heuristics, alongside link stuffing and empty payloads, all tuned by the per-form strictness dial. A submission whose email domain looks disposable is quarantined for one-click review rather than dropped - if it turns out to be a privacy-conscious human, approving delivers the row, and the false positive costs seconds, not a lead.

The reasoning behind quarantine-over-deletion is laid out on the security page, with the heuristics listed in the docs.