Stop disposable emails before they sign up.
SpamNull is a high-performance, self-hosted detector for disposable email and spam domains. Detection runs locally in your process — no external API, no network calls, no data leaving your stack.
- 215,822 usable domains
- after whitelist filtering
- ESM + CJS + TypeScript
- types included out of the box
- Self-hosted detection
- 100% local, no external API
- Default & named exports
- isSpam both ways
Quickstart
Two lines to first detection
Use the default export or the named isSpam export — both are the same function. TypeScript types ship with the package.
// ESM / TypeScript
import isSpam, { isSpam as check } from "spamnull";
isSpam("[email protected]"); // true — disposable domain
isSpam("[email protected]"); // false — legitimate provider
check("[email protected]"); // true// CommonJS
const { isSpam } = require("spamnull");
isSpam("[email protected]"); // true
isSpam("[email protected]"); // falseRun anywhere
One package, every runtime
Node.js
ESM & CJS builds included
Bun
Native ESM import, zero config
Deno
Via npm: specifier
Edge runtimes
Workers, Vercel Edge & more
How it works
A curated dataset, checked locally
Curated domain dataset
Ships with 215,822 usable domains after whitelist filtering — legitimate providers are excluded so real users aren't flagged.
Whitelist-first filtering
Known-good mail providers are stripped from the blocklist before detection, reducing false positives at signup.
Local lookup, zero network
Detection runs entirely in your process. No API calls, no external service, no data leaves your infrastructure.
Built responsibly
Fast, private, and honest about limits
Performance
A single local lookup per check — no DNS queries, no HTTP round-trips, no rate limits. Designed for hot paths like signup and comment endpoints.
Security & privacy
Fully self-hosted: addresses you check are never sent anywhere. No telemetry, no third-party calls. Detection is a heuristic signal — combine it with your own verification flows.
Responsible use
Disposable-email detection reduces abuse, but no blocklist is perfect. Use SpamNull as one signal among several, provide an appeal path, and avoid hard-blocking users without recourse.
API highlights
Deliberately small surface
One function does the work. Pass an email address or a bare domain — get a boolean back. Full TypeScript declarations included.
isSpam(input: string): boolean
Default and named export — same function.
Emails or domains
Accepts [email protected] or domain.tld directly.
Zero dependencies on network
Dataset is bundled; lookups never leave the process.
Dual package
ESM and CJS entry points with .d.ts types.
declare function isSpam(input: string): boolean;
export default isSpam;
export { isSpam };
// Usage
isSpam("[email protected]"); // true
isSpam("tempmail.com"); // true
isSpam("[email protected]"); // falseShip signup protection today
Install from npm and run your first check in under a minute. MIT licensed, self-hosted, and dependency-free at runtime.