SignupBouncer

Checks one email address, and optionally the signup's IP address, the way SignupBouncer checks a new signup. Returns the result as "verdict" (allow, challenge or block), a 0-100 score, the reasons with their reason codes, the normalized inbox (Gmail dots and +tags folded) and the IP's network. When the domain looks like a typo of a big mail provider (gmial.com), "suggestion" holds the corrected address. Looks up the domain's mail servers live. Every reason is listed, including ones only paid plans count. We don't store or log the email or IP address it checks. We cache the email's domain and its mail servers for up to an hour. For the rate limits we keep a keyed hash of the calling IP address, or of the account when the client sends a key, for up to 24 hours. When the client sends a key, we also keep a hash of the key in memory, and keyed hashes of the calling IP address and its network (/24 or /64), for up to two minutes. The IP hashes limit guessed keys. A valid key's hash is also stored with its account.

Explains a SignupBouncer reason code (for example disposable_domain, burner_mx, repeat_inbox, datacenter_ip): what it means, how many points it adds or whether it blocks alone, and the lowest plan on which it counts. Without a code, lists every code.

Returns the steps and the copy-paste code that checks new signups with SignupBouncer in one stack: supabase (a hook, no code), ory (a web hook, no code), fetch (any TypeScript server), nextjs, express, hono, python, firebase or better-auth. Use it when the user asks for code that checks or blocks signups in their app. The code reads the API key from SIGNUPBOUNCER_API_KEY. The call has a 1.5-second limit, and any failure lets the signup through.

Says whether a domain is on SignupBouncer's disposable (burner) email list, only on an old burner list (a challenge, not a block), a known relay service or a free subdomain mail service, or a known real mailbox provider, and when our harvester observed it. Uses only the loaded lists, no DNS lookup, so a brand-new burner domain on a burner mail server is caught only by check_email. Accepts a domain or an email address.