Reporting abuse
A disposable email service is a useful tool and, inevitably, a tool that some people misuse. We would rather hear about it from you than from a blocklist. This page explains what to send and what happens next.
Last updated: 11 September 2026
How to report
Send a report to the abuse address listed in the footer of every page. Reports are read by a person, not by an automated filter, and you will receive a reference number in reply.
We aim to acknowledge reports within one working day and to act on well-evidenced reports within three.
What to include
A report we can act on generally contains:
- The full 9inbox address involved, including the domain.
- The approximate date and time of the activity, with a timezone.
- What happened, in enough detail that we can distinguish it from a legitimate use of the service.
- Any reference number from your own system, so that we can correlate follow-up correspondence.
What we can act on
We can disable an address, suspend the session or account behind it, block a local part or a pattern of local parts, and refuse mail for an address at the SMTP level. Where the activity involves an account rather than a guest session, we can suspend that account across every address it owns.
We keep audit records of enforcement actions so that repeated abuse from the same source is visible even when individual addresses have long since expired.
What we cannot do
We cannot disclose the content of messages in response to an abuse report. Reading message content requires a report reference, a recorded reason and elevated authorisation, and it is logged; it is not something we do to satisfy curiosity about a report, and it is not something we can do on request.
We cannot identify a guest user, because there is no identity to disclose. A guest session is a signed token in a browser and nothing else. We can act against the session and the addresses it created; we cannot tell you who was holding it.
We cannot act on mail that did not pass through our systems. If the address in question is not on one of our domains, the report needs to go to whoever operates that domain.
For site operators
If you run a service that does not want signups from disposable addresses, the most reliable approach is to check the domain of the sign-up address against a disposable-domain list at registration time and refuse it there — rather than to accept the signup and discover the problem later.
If you would prefer that our domains not be used on your service at all, tell us and we will explain which domains we operate so that your list is accurate. We would rather your block list be correct than approximate.