Download the PHP package harungecit/php-email-validator without Composer

• 137,600+ disposable domains from multiple sources — rebuilt daily, released weekly, and false-positive filtered (no namecheap.com, no yandex.net, no ISP domains, no public suffixes).
• Explainable results — which list entry matched, whether through a subdomain, and from which list.
• A full validation pipeline, not just a blocklist — RFC format modes, MX/DNS, homograph spoofing, role accounts, plus-addressing, typo suggestions, SMTP and catch-all.
• Every PHP framework, natively — validation rules, constraints, services and commands that feel at home in each framework.
• Fast — O(1) lookups (~2.5 µs, subdomains included); with OPcache the full domain index costs zero load time and per-request memory.
• No API keys, no per-request fees — everything runs locally; network is only used for the checks you enable (MX, SMTP) and for list syncs.

Table of Contents

• Why this package?
• Installation
• Quick start
• Disposable email detection
• The disposable domain list
• Keeping the list fresh (sync)
• Full validation pipeline
• Configuration
• Plain PHP
• Command line
• Performance
• Caching, rate limiting & logging
• Result objects & API reference
• Changelog

⭐ Why this package?

Installation

Compatibility

• PHP 8.0 – 8.5 (runtime verified on 8.0; full test suite on 8.1 – 8.5), on Linux, Windows and macOS.
• Laravel 9 – 13 · Symfony 6.4 – 8.x · CodeIgniter 4.4+ · CakePHP 4.4+ / 5.x · Yii 2.0 · Yii 3 (yiisoft/validator 2.x) · Phalcon 5.
• Optional: ext-intl (IDN + spoof check), egulias/email-validator (rfc/strict format modes), ext-curl (sync), ext-redis/predis/predis/ext-memcached (cache backends), symfony/yaml (YAML config).

🚀 Quick start

Just need a disposable check, no network?

🛡 Disposable email detection

How a domain is matched

The domain and each of its parent domains are looked up, most specific first — a.b.mailinator.com, b.mailinator.com, mailinator.com — so throwaway subdomains are caught too. On each level the lists are consulted in this order (first hit wins):

So your own decisions always win over the bundled data — e.g. you can block a privacy relay the package allows, or allow a domain the package blocks.

Lists can also be changed at runtime (fluent): addToBlocklist(), addToAllowlist(), removeFromBlocklist(), removeFromAllowlist(), getBlocklist(), getBlocklistCount(), isBlocklisted(), isAllowlisted(). Runtime changes never copy the shared index.

Privacy relays (Apple Hide My Email, Firefox Relay, DuckDuckGo, SimpleLogin, Proton Pass, addy.io) forward to a real inbox and are allowed by default. To block them, add them to your blocklist.

📚 The disposable domain list

The bundled list is rebuilt every day from multiple upstream projects and released as a patch version every Monday, so a regular composer update keeps you current. Want daily freshness? See sync.

Aggregated feeds contain real companies and ISPs that were once abused by spammers. Blindly merging them would block e.g. namecheap.com, yandex.net, sutterhealth.org, Roadrunner/Spectrum ISP addresses (nyc.rr.com) or entire country zones (msk.ru, pp.ua). The build therefore drops:

On top of that the build refuses to shrink the list by more than 5% in one run, switches to an additive (remove-nothing) mode if an untrusted source is down, and CI keeps regression tests for known false positives. Build details live in data/metadata.json and in the output of email-validator stats.

Found a missing domain or a false positive? See CONTRIBUTING.md — fixes are permanent.

🔄 Keeping the list fresh (sync)

Package releases are weekly; the list on main is rebuilt daily. The synchronizer downloads remote lists into a file in your app, and every validator configured with that file blocks those domains too — no deploy needed.

Schedule it (cron, Laravel scheduler, Symfony scheduler, …):

By default the synchronizer downloads this package's own filtered list from main (Configuration::DEFAULT_SYNC_URL), so you get the same false-positive protection. Use --url= (repeatable) or the sync.urls setting to add other plain-text or JSON lists.

Safeguards — a bad download never damages your last good list:

• failed requests, non-2xx responses, HTML error pages, empty responses and lists without a single valid domain are rejected before anything is written;
• append-only by default; --replace only drops domains when every source succeeded;
• allowlisted domains (bundled + yours, including subdomains) are never written;
• only domains that are not already bundled are stored, so the file stays tiny and cheap to load;
• writes go to a temp file that is atomically renamed, under an exclusive lock; an unchanged list is not rewritten.

Programmatic use:

🔬 Full validation pipeline

validate() runs every enabled check and returns a ValidationResult:

Presets

strict() enables SMTP and catch-all verification, which open live connections and can be slow or blocked. For most applications standard() is the recommended starting point.

Format modes

Spoofing (homograph) detection

Individual checks

Batch validation

⚙ Configuration

Use the fluent builder, an array, or a PHP/JSON/YAML file — they all produce a Configuration.

Ready-made templates: config/emailvalidator.json.

🧩 Framework integrations

Every integration wraps the same core, so behaviour and configuration keys are identical everywhere.

Laravel

Supports Laravel 9–13 (rule objects need Laravel 10+). The service provider and the EmailValidator facade are auto-discovered.

Validation rules

Messages live in the emailvalidator::validation translation group (php artisan vendor:publish --tag=emailvalidator-translations). Rule-object messages accept :attribute; NotDisposableEmail also :domain and :matched, ValidEmail also :reason and :suggestion.

Facade, Blade & commands

Configuration (config/emailvalidator.php, env-aware; the cache driver defaults to your Laravel cache store):

Set EMAIL_VALIDATOR_SYNC_SCHEDULE=daily and the package registers email-validator:sync on Laravel's scheduler (withoutOverlapping()). AI agents using Laravel Boost get this package's guidelines automatically.

Symfony

Supports Symfony 6.4, 7.x and 8.x.

Message parameters: {{ value }}, {{ domain }}, {{ matched }} (NotDisposableEmail); {{ check }}, {{ reason }}, {{ suggestion }} (ValidEmail), with one error code per failed check. Services: EmailValidator (autowirable, alias email_validator), Configuration, ListSynchronizer (email_validator.synchronizer).

CodeIgniter 4

Zero configuration. CodeIgniter's auto-discovery picks up the package's Config/Registrar.php and Config/Services.php: the rules are added to Config\Validation::$ruleSets and service('emailValidator') returns a shared validator.

Messages ship as language lines ({field}, {value} and per-field custom errors work); override them in app/Language/<locale>/Validation.php. Use permit_empty for optional fields.

To configure, create app/Config/EmailValidator.php (properties mirror the configuration keys; .env overrides such as emailvalidator.checks.mx = false work too):

Discovery disabled? Add \HarunGecit\EmailValidator\Framework\CodeIgniter\EmailValidatorRules::class to Config\Validation::$ruleSets. Sync from cron: vendor/bin/email-validator sync --path=writable/email-validator/synced.conf.

CakePHP

Rules: notDisposable, notRoleBased, notSubaddressed, notSpoofed, hasMx, verifiedEmail (full pipeline). Manual use works as with any provider: ->setProvider('emailValidator', new EmailValidationProvider())->add('email', 'notDisposable', ['rule' => 'notDisposable', 'provider' => 'emailValidator']).

Register the plugin to get EmailValidator/Configuration in the DI container, configured from the EmailValidator key:

Yii 2

Messages support {attribute}, {value}, {domain}, {matched} (and {check}, {error}, {suggestion} for VerifiedEmailValidator) and go through Yii::t('app', …).

Yii 3

Handlers receive EmailValidator from the DI container — register it with your configuration:

Phalcon 5

Plain PHP / any framework

The core has no framework dependency: create an EmailValidator, keep it in your container, and use vendor/bin/email-validator sync from cron. Slim, Mezzio, Laminas, Lumen, Nette, Spiral, WordPress plugins — anything with Composer works.

💻 Command line

Exit codes: 0 = nothing flagged, 1 = disposable/invalid found or sync failed, 2 = usage error — handy for shell scripts and CI (e.g. validating a CSV export).

⚡ Performance

• Lookups are O(1) hash lookups; a check including the parent-domain walk takes ~2.5 µs.
• With OPcache (every production PHP-FPM setup) the precompiled data/blocklist.php index is an immutable array in shared memory: loading the whole list costs nothing and adds no per-request memory.
• Without OPcache (CLI, workers) the list is read with a single explode() in ~18 ms, once per process.
• Runtime list changes (addToBlocklist(), custom/synced lists) are kept in small side tables, so the shared index is never copied.
• MX and catch-all results are cached through the configured cache backend.

Caching, rate limiting & logging

Rate limiting throttles validations per address with a token bucket that shares the cache backend (works across processes with Redis/Memcached/File):

PSR-3 logging: $validator->setLogger($logger) or $config->setLogger($logger) — each validate() logs a debug entry with the outcome, checks and errors.

📖 Result objects & API reference

Testing

The library runs on PHP 8.0+; the test suite needs PHP 8.1+ (PHPUnit 10–12). CI runs PHP 8.1 – 8.5 on Ubuntu, Windows and macOS, the oldest supported framework versions on PHP 8.1, a PHP 8.0 runtime smoke test, and data-integrity checks on every push.

Upgrading

3.2 is backward compatible with 3.0/3.1 and the 2.x API. Worth knowing:

• The bundled list grew from ~8,900 to over 136,000 domains in 3.2.0. If a legitimate domain your users rely on is now flagged, add it to lists.custom_allowlist and report it.
• Your custom_blocklist / addToBlocklist() entries now override the bundled allowlist (previously the allowlist always won). The bundled blocklist still never overrides the allowlist.
• EmailValidator::create() now shares the precompiled index instead of copying the list.
• List files written by Fetcher::saveList() end with a newline.

Coming from 1.x? The namespace changed from PHPOrbit\EmailValidator to HarunGecit\EmailValidator, and the package from phporbit/php-email-validator to harungecit/php-email-validator.

Contributing

Contributions are welcome — missing disposable domains, false-positive reports, framework integrations and docs. Please read CONTRIBUTING.md; security issues go through SECURITY.md.

License

MIT — see LICENSE. The disposable domain data is derived from disposable-email-domains (CC0) and eramitgupta/disposable-email (MIT); thanks to their maintainers and to the Public Suffix List and Tranco projects.

Author

Harun Geçit — GitHub · LinkedIn · Email

If this package saves you from fake sign-ups, please ⭐ the repository — it helps other PHP developers find it.

Changelog

Automated weekly data releases (blocklist updates) are documented on the Releases page.

v3.2.0

• 136,577 disposable domains at release (up from 8,948): the blocklist is now built from disposable-email-domains (trusted) and eramitgupta/disposable-email (filtered aggregator).
• False-positive filtering in the build: Public Suffix List, Tranco top-100k, typo domains, allowlist subdomains and upstream merge artifacts; allowlist expanded to 237 domains (ISPs, organisations, privacy relays such as SimpleLogin and Proton Pass).
• The list is rebuilt daily on main; patch releases still ship every Monday (skipped automatically when main has unreleased code).
• New checkDisposable() returning DisposableCheckResult (matched domain, source, subdomain match), isDisposableDomain(), isSpoofed() and getListStatistics(); validate() adds disposable_match/disposable_source metadata.
• New configuration: lists.custom_blocklist, custom_allowlist, custom_*_paths, synced_blocklist_path, block_subdomains, sync.urls, sync.timeout, format.mode (filter, filter_unicode, rfc, strict) and the spoof check.
• New list synchronizer (ListSynchronizer) with append-only/replace modes, HTML/empty-response rejection, allowlist filtering, atomic writes and locking.
• New framework-agnostic CLI: vendor/bin/email-validator check|validate|sync|stats.
• Precompiled OPcache index (data/blocklist.php): zero load cost and no per-request memory with OPcache; runtime list changes no longer copy the list.
• Domain normalization (case, trailing dot, IDN → punycode) for every list lookup.
• New integrations: CodeIgniter 4 (auto-discovered rules + service), CakePHP (validation provider + plugin), Yii 2 (component + validators), Yii 3 (attribute rules), Phalcon 5 (validators + service provider).
• Laravel: rule objects, not_spoofed rule, @disposableEmail Blade directive, Artisan commands, scheduled sync, Laravel Boost guidelines. Symfony: #[NotDisposableEmail] / #[ValidEmail] constraints and console commands. Laravel 13 and Symfony 8 support.
• Application lists (custom_*) now take precedence over the bundled allowlist.
• Added CONTRIBUTING.md and SECURITY.md; leaner Composer dist archive.

v3.1.1

• Updated the disposable blocklist to 8,900+ domains (785 new domains from upstream).
• isDisposable() now detects subdomains of disposable providers ([email protected]) by also checking parent domains; the most specific list entry wins. Lookups use a hash index instead of a linear scan.
• Added a scheduled GitHub Actions workflow that refreshes the blocklist weekly and publishes a patch release automatically.
• composer update-lists now rebuilds the blocklist as upstream + data/blocklist.local.conf − allowlist instead of a keep-everything union, so upstream false-positive removals are applied (removed gmal.com, iwi.net, mailhub.pro). Added safety checks for unattended runs (malformed lines skipped, abort on a suspiciously small upstream or a >5% shrink; --force overrides).

v3.1.0

• Updated the disposable blocklist to 8,100+ domains (244 new domains from the disposable-email-domains project).
• Expanded the allowlist to 190+ domains (added proton.me, pm.me, hey.com, tuta.com, zohomail.com, icloud.com, duck.com, simplelogin.io, addy.io, and more). The upstream allowlist was discontinued; it is now maintained in this package.
• Added composer update-lists (scripts/update-lists.php) to refresh the blocklist from upstream with a single command.
• Expanded the default typo mappings and common-domain list (Proton, Tuta, HEY, Zoho Mail, GMX, Yandex, and regional Yahoo/Hotmail/Outlook domains) and synchronized them across all config templates.
• Expanded the default role-based prefixes (administrator, donotreply, security, privacy, legal, compliance, notifications, and more).
• Fetcher::saveList() now always writes LF line endings regardless of platform.

v3.0.1

• Fixed CI failures on PHP 8.0 and 8.1.

v3.0.0

• Requires PHP 8.0+ (dropped 7.4). Forward-compatible through PHP 8.5.
• Added a rich ValidationResult object returned by the new validate() method, plus validateBatch().
• Added Configuration and a fluent ConfigurationBuilder with strict, standard, basic, and minimal presets.
• Added configuration file loading (PHP / JSON / YAML) via EmailValidator::fromConfigFile().
• Added new checks: role-based detection, subaddress (plus addressing), typo suggestions (SuggestionResult), SMTP verification, and catch-all detection.
• Added a pluggable cache layer with Memory, File, Redis, Memcached, PSR-16, and Null adapters.
• Added token-bucket rate limiting with RateLimitExceededException.
• Added PSR-3 logging support.
• Added Laravel (service provider, facade, publishable config, validation rules) and Symfony (bundle, DI extension) integrations.
• Updated the disposable blocklist to 7,900+ domains, synchronized with the disposable-email-domains project.
• Fully backward compatible with the 2.x public API.

v2.0.0

• Breaking: Namespace changed from PHPOrbit\EmailValidator to HarunGecit\EmailValidator.
• Breaking: Package name changed from phporbit/php-email-validator to harungecit/php-email-validator.
• Added batch validation (validateMultiple, filterValid, filterInvalid), isValid(), validateWithDetails(), getStatistics(), and the EmailValidator::create() factory.
• Added a fluent interface for list management, MX record caching, hasValidDNS(), email normalization, and isAllowlisted()/isBlocklisted().
• Enhanced the Fetcher with caching, custom list loading, and merge capabilities.
• Added multi-platform CI (Ubuntu, Windows, macOS).

v1.0.x

• Initial releases: email format validation, disposable email detection, and MX record validation.