Files
email-verifier/metadata_disposable_allowlist.go
Jason MaandGitHub f03867b8d5 feat(build_metadata): keep real providers out of the disposable list (#209)
The upstream disposable list classifies a handful of real mailbox providers as
throwaway services, and that misfiling costs two answers rather than one.
free.txt is the free candidates minus the disposable list, so a domain wrongly
listed there is not merely reported disposable -- it is also dropped from free,
and the library ends up answering "neither" about a real provider.

disposable_allowlist.txt is subtracted when the lists are generated and applied
again after every EnableAutoUpdateDisposable() refresh. Both halves are needed:
the generated map is what a caller gets who never enables auto-update, and
without the runtime half the first refresh reinstates every entry.

The maintenance surface is bounded, which is what makes this worth having
rather than an open-ended list to police. Of the 5142 free candidates, 612 are
subtracted as disposable, and 556 of those are corroborated by at least one
blocklist other than the one we use. That leaves 56 claims resting on a single
source -- reviewable in one sitting, and 41 of them are plainly right: eleven
free-subdomain hosts under .cu.cc, .uu.gl, .ye.vc and .usa.cc, two
*.otherinbox.com, tempmail.net, junkmail.com, the typosquats 74gmail.com and
yaho.com, test.com, and a run of domains with no MX at all.

Six entries have evidence worth acting on:

  4x4man.com  alphafrau.de  mail2world.com  qmail.com

    Catalogued as free mail services by disposable/disposable's own
    mailservices.json. That file is wired into nothing: the only switch that
    reads it, --add-free-mailservices, is passed from cli.py into options the
    generator never consults, and the data repo's cron does not set it anyway.
    Exclusions there come from whitelist.txt and greylist.txt, and none of
    these is in either.

  hush.com  lavabit.com

    Long-running providers on their own mail infrastructure, neither offering
    throwaway addresses.

Left out deliberately: email.org, 8848.net, unomail.com, uomail.com,
vjmail.com, webcity.ca, whale-mail.com, yyhmail.com, moose-mail.com,
movemail.com, snail-mail.net, mail15.com, latinmail.com, za.com and sify.com.
Some are probably misfiled too, but a live MX is the only evidence for them,
and most disposable domains have one. sify.com is the most likely of these to
be wrong -- a real Indian portal -- but two independent blocklists name it, so
it does not belong in a list whose entries are supposed to be checkable.

  disposable.txt   75264 -> 75258
  free.txt          4529 ->  4535

All six move from Free=false/Disposable=true to Free=true/Disposable=false, and
the fifteen left out stay disposable.

update.sh fails if an allowlist entry is no longer in the upstream list. An
entry that upstream has since fixed, or that was never needed, is invisible
otherwise, and a list nobody prunes is how this kind of file rots.

The generator now skips blank and comment lines. It quoted every line it read,
so a hand-maintained list could not explain its own entries -- every "#" line
would have become a map key. No effect on the three existing lists, which
update.sh writes without either.

Tests, each confirmed to fail when its mechanism is removed:

  TestAllowedDomainsAreNotDisposable          the build-time subtraction ran
  TestUpdateDisposableDomainsKeepsAllowlistOut a refresh does not reinstate them
  TestAddDisposableDomainsOutranksAllowlist    an explicit caller still wins
  TestGeneratedMetadataMatchesSources          now covers the allowlist too

The staleness guard was checked the same way, by adding a domain upstream does
not list: the script refuses to publish and exits 1 before writing anything.

The restore-the-package-set cleanup added to TestUpdateDisposableDomainsOK in
an earlier commit is now shared as restoreDisposableDomains, since three tests
replace that set.
2026-09-09 18:29:58 +08:00

13 lines
316 B
Go

// Code generated by cmd/build_metadata; DO NOT EDIT.
package emailverifier
// map to store domains never to be treated as disposable
var allowedDisposableDomains = map[string]bool {
"4x4man.com": true,
"alphafrau.de": true,
"mail2world.com": true,
"qmail.com": true,
"hush.com": true,
"lavabit.com": true,
}