Burner Email Blocklists Are Hurting Real Users — Time to Split Aliases from Throwaways

Benjamin Piouffle recently tried to sign up for a public open-data service using a Proton Mail alias and got rejected as “potential spam.” The irony wasn't lost on him: in 2018 he published Burnex, an Elixir package that checked emails against a list of known burner domains. That list was the popular wesbos/burner-email-providers. Now he's publicly walking back the recommendation to block burner domains at signup.

Burners and Aliases Are Not the Same Thing

A classic burner email is a public, short-lived inbox anyone can access — think yopmail.fr or mailinator.com. An email alias, on the other hand, is a permanent forwarding address tied to your account that you control and can disable. Services like Firefox Relay and Apple Hide My Email are mainstream now, not hacker toys. Blocklists that conflate the two end up punishing users who are trying to protect their privacy. Aliases limit cross-site tracking, reduce spam after breaches, and let you trace leaks. We should want more people using them, not fewer.

Blocklists Don't Stop Determined Abusers

Spammers have never been limited to blocklisted domains. Gmail's + aliasing, services like Emailnator, and cheap custom domains make it trivial to bypass a domain blocklist. The cost is asymmetric: a naive bot gets slowed down slightly, while a real user with a legit alias gets hard-rejected with no recourse. You're optimizing for the attacker who gives up easily and punishing the user who takes privacy seriously. Email verification in general only proves someone could receive an email once — it's not proof of identity or trustworthiness.

There Are Still Valid Uses

Checking whether an email domain appears on a known-disposable list is still a reasonable signal for a broader risk score, surfacing suspicious patterns across batches, or ignoring them in marketing campaigns. But Piouffle argues that if he were to rebuild Burnex today, he'd narrow its scope to genuinely public and shared inboxes and separate personal alias providers into a different category. The upstream list is consumed as-is by many signup validators, so its categorization choices have real downstream effects.

What Should Change

Piouffle has opened an issue on the wesbos list proposing a split: one file for public shared inboxes (yopmail.fr, mailinator.com) and a second for personal alias and forwarding providers (passmail.net, anonaddy.me, mozmail.com). He also recommends updating the README with guidance on good practices. Burnex itself has been deprecated and transferred to a new maintainer.

The takeaway for engineers: don't blindly block domains from a single list. Distinguish between shared throwaways and personal aliases. Your users will thank you, and the spammers won't even notice.