# Blacklists

DISIFY maintains two public blacklists that power the detection engine. Both are served as plain text and are free to view.

## Available lists

| Blacklist | Contents |
| --- | --- |
| [Domain Blacklist](https://disify.com/blacklist/domains) | Known disposable email domains, used for exact and parent-domain matching. |
| [MX Blacklist](https://disify.com/blacklist/mx) | Mail-server hostnames and IPs associated with disposable providers. |

## Why two lists

Domain matching catches known providers. MX hostname and IP matching can also catch providers that change domains while reusing mail infrastructure.

## Endpoints

`GET /blacklist/domains`
`GET /blacklist/mx`

```bash
# Domain blacklist (plain text, one domain per line)
curl https://disify.com/blacklist/domains

# MX blacklist (hostnames and IPs)
curl https://disify.com/blacklist/mx
```

**Prefer the API over the raw lists**

Use the [email endpoint](https://docs.disify.com/api/email.md) for individual addresses and the [domain endpoint](https://docs.disify.com/api/domain.md) for bare domains. Raw lists do not include every detection signal, provider exception, or per-email alias check, so an offline lookup will not necessarily reproduce the API verdict.

## Keeping lists current

The API applies detection updates server-side. If you use an offline copy, refresh it periodically and replace it only after a successful download. Use [community submissions](https://docs.disify.com/resources/submissions.md) to report providers or request corrections.

Source: https://docs.disify.com/resources/blacklists.html