Reduce free trial abuse

If your trial includes something expensive (compute, AI credits, SMS, seats, data exports), someone will try to get it again and again. The usual tricks show up in the email address first.

The tricks, and the signal for each

Trick	Example	Signal
Disposable inbox	`x8f2@<temp-mail service>`	`is_disposable`, reason `disposable_provider`
Disposable service on a fresh custom domain	`x@<new domain>` whose MX serves known disposable domains	reason `mx_shared_disposable` → `disposable`
`+tag` variations	`jane+1@`, `jane+2@`	`has_subaddress`, `normalized_email`
Relay aliases	`…@privaterelay.appleid.com`, `…@duck.com`	`is_relay`
Cheap new domain	registered yesterday, no website	`is_new_domain`, reasons `new_domain`, `no_website`, `parked_domain` (with `deep=true`)
Forwarding-only domain	MX at a forwarding service	reason `mx_forwarding_service`
Lookalike of a big provider	confusable characters, punycode	`is_lookalike`
Known abuser	reported spam/abuse sources	`is_blocked`

A layered policy

const v = await checkEmail(email); // see /docs/code-examples

// 1. Hard stops
if (v.recommendation === 'block') return reject('Please use your work email.');

// 2. One trial per normalized address
if (v.normalized_email && await trialExistsFor(v.normalized_email)) {
  return reject('This address already used a trial.');
}

// 3. Suspicious but not certain: limit instead of reject
const risky = v.is_new_domain || (v.reasons ?? []).includes('mx_forwarding_service');
return startTrial({ limited: risky || v.recommendation === 'review' });

Use normalized_email for the “one trial per person” check; it strips +tags.
deep=true adds domain age and the homepage check (counts as 5 checks). Use it at trial start, not on every request.
For abuse-heavy products, policy: 'strict' also blocks unknown domains and role accounts.

What email checks can’t do

A determined abuser with a real company domain, or a fresh Google Workspace account on a new domain, will pass the email check. Pair it with:

payment-method or phone verification for the expensive features
rate limits on the costly actions themselves
device or network signals from your fraud tooling

Email signals catch the cheap, scalable abuse, which is most of it, before it costs you anything.

Report what slips through

Found a disposable service we classify as business? Report it. Confirmed reports update the lists for everyone.