How to Stop Fake Signups from Throwaway Email Addresses in Magento 2

Look through your customer grid and you'll probably find accounts with addresses ending in @mailinator.com, @guerrillamail.com, or @yopmail.com. None of those belong to real relationships with real people — they belong to whoever wanted an account on your store for the length of one session and no longer.

Why "anyone can sign up" is quietly a problem

Disposable email services exist for exactly one purpose: let someone receive a confirmation link without giving up anything that identifies them. That's a legitimate thing to want in plenty of contexts — but on a storefront, it means someone can create a customer account, submit a review, claim a signup discount, or fill out a wishlist with zero real commitment and zero way for you to ever reach that person again. Multiply that by however many bored or malicious visitors decide to do it, and you end up with:

A customer count that overstates your actual reachable audience, throwing off every metric downstream of it.
Product reviews from accounts that were never going to buy anything, diluting the signal in the reviews you actually care about.
A customer grid cluttered with throwaway rows that make it harder to spot and manage your real customers.
First-order signup discounts claimed repeatedly by the same person cycling through fresh disposable addresses.

Blocking at the domain, not the address

You can't usefully blocklist individual disposable addresses — a service like Guerrilla Mail generates new addresses without limit. What's stable is the domain: mailinator.com is disposable regardless of what's before the @. The module works from a bundled list of roughly 400 known disposable-email domains and checks the domain portion of any email submitted at registration (and, if you enable it, at guest checkout) against that list. A match blocks the submission before an account or order gets created from it.

The list ships with the module, not with a live API call. Registration and checkout are two of the worst places to introduce a network dependency — a slow or failing third-party lookup there means real customers stuck on a spinner, or a fallback path that silently lets everything through anyway. Checking against a bundled, offline list means the check runs in-process, adds no meaningful latency, and has no external service that can go down and take your signup flow with it.

The list isn't the ceiling

New disposable-email services show up constantly, and no bundled list stays exhaustive forever. Admins can append their own domains to the block list directly — so if a specific throwaway service starts showing up in your signups that isn't in the default ~400, adding it is a one-line addition in the admin, not a wait for the next module release.

Keep throwaway addresses out of your customer grid — offline, instant, and appendable.

See Disposable Email Blocker — from $19