[Discussion] Custom domains also flagged as disposable

[jthvai]

Since, upon account registration, platforms are also checking MX records for email service providers that they don't like think are disposable (AnonAddy for example) and outright blocking those, creating a custom domain no longer works to avoid being marked as a "disposable email user".

Is there a way to circumnavigate this without violating the DNS spec? (it is likely that pointing the MX record at a CNAME would be sufficient but that isn't compliant)

[jthvai]

Could it be possible to point the MX record directly at the ip that mail.anonaddy.me resolves to?

[willbrowningme]

Thanks, I am aware of this. Do you know which third-party service is doing it?

I know of https://quickemailverification.com/tools/disposable-email-address-detector that have singled out AnonAddy and incorrectly list even custom domain aliases as disposable. They do not however list Duck email, Firefox relay or Simple Login as disposable. I have contacted them multiple times but they have not responded.

Unfortunately it's not possible for an MX record to point directly to an IP address, it must be a hostname. It is not possible to point an MX record to a CNAME either.

Perhaps if more people contacted these services and asked them to correctly categorise the service as not disposable they may listen.

[jthvai]

My bad for opening an issue, I didn't realise GitHub discussions were a feature until now.

There is also https://verifymail.io/ which correctly categorises AnonAddy (and custom domains with its MX records) as a non-disposable alias service in its initial Details section (but still recommends blocking AA in that section), then proceeds to state:

Based on our findings, we have deemed anonaddy.me to be a temporary or disposable email provider. Website administrators should block this domain name from their website and prevent any account registrations using this domain name.

SimpleLogin and Duck email receive the same treatment, but Firefox relay appears to be exempt.

Links:
https://verifymail.io/domain/anonaddy.me
https://verifymail.io/domain/simplelogin.com
https://verifymail.io/domain/duck.com
https://verifymail.io/domain/mozmail.com (relay.firefox.com is also marked as safe)

[jthvai]

I have contacted them multiple times but they have not responded.

This is really unfortunate. I find it incredibly ironic that one of their most recent blog posts is titled "How to Use Customer Voice and Reviews to Increase Sales" and yet they ghost multiple contact attempts of yours.

Perhaps if more people contacted these services and asked them to correctly categorise the service as not disposable they may listen.

I tried a few times (since I only recently started using AA) with explanations about the ways aliasing services are similar to mainstream emails, but it always feels like a losing battle much like many requests for additional privacy anywhere. I feel like (disclaimer: very cynical) depending on what their true goals are, it may not be in their perceived interest to correctly categorise the service - it may be more in their interest to overreach with their disposable designation than let some slip through.

Speaking more about verifymail.io's ruling; this reminds me of this and this discussion. I cannot think of a compelling reason why a platform (consumer of email verifiers) might want to reject signups from aliased email addresses (aside from questionable ones such as farming PII or harassing the customer after they have terminated their relationship with the platform) - if the goal is genuinely just to reach the customer then AA is demonstrably sufficient, so long as the customer does want to be reached.

If the goal is to prevent spam accounts... I had one platform ban both AA and SL domains (and custom domains thereof), but allowed any [email protected], [email protected], etc, as well as any permutation of [email protected]. [email protected] etc to function as UIDs for separate accounts. Hm.

[RokeJulianLockhart]

#467 (comment)

mastodon/mastodon#27431 (comment) may be an example of this. @jakejoh?