PyPI Adds Email Reputation Checks and Lifts Its Outlook Ban

On 16 October 2026 PyPI announced that it now checks the reputation of email addresses when someone registers an account or adds an address to an existing one. Addresses identified as disposable are rejected. With that check in place, outlook.com and hotmail.com addresses can be used on PyPI again, after a blanket ban that started in June 2024.

In the month the checks ran before the announcement, PyPI says they blocked 62 disposable domains from registering accounts and rejected more than 120 attempts to use a disposable address on an otherwise valid domain.

What's affected

This changes how accounts get created on pypi.org. It doesn't change how packages are installed.

Before. PyPI blocked disposable addresses with two static lists: the public disposable-email-domains list and an internal list of prohibited domains. The post says "neither can tell a throwaway address apart from a real one on a large provider like Outlook." So when a malware campaign in June 2024 registered accounts in bulk with Outlook addresses, the only option was to block the whole provider, which also locked out legitimate users. Adding domains to the internal list needed staff or volunteer time.

Now. Addresses that pass the existing domain checks are sent to an email reputation service, which says whether the address is disposable. That covers new throwaway providers that appear faster than lists can track, and throwaway aliases on large public providers. When the service flags a whole domain as disposable, PyPI adds it to the prohibited list automatically, so later attempts are rejected without another lookup.

The reputation service was donated by UserCheck. The post frames the automation as necessary for "the new age of autonomous exploits," where fast response matters.

How to check if you're exposed

There are two sides to this: the accounts you publish from, and the accounts that publish what you install.

Your publishing accounts. Log in to each PyPI account your team uses and check:

• The primary email is on a domain your organisation controls, or a personal address the maintainer will keep. Account recovery runs through it.
• The address is verified, and 2FA is on.
• Old addresses that no one reads anymore are removed.

Your dependencies. PyPI doesn't publish account emails, but package metadata often includes author and maintainer emails. You can check those against the same public disposable list PyPI used:

curl -s https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/main/disposable_email_blocklist.conf > disposable.txt

for p in $(sed -E 's/[<>=!~ ;\[].*//' requirements.txt | grep -v '^#' | grep .); do
  curl -s "https://pypi.org/pypi/$p/json" \
    | jq -r '.info.author_email // empty, .info.maintainer_email // empty'
done | grep -oE '@[A-Za-z0-9.-]+' | tr -d '@' | tr 'A-Z' 'a-z' | sort -u > domains.txt

grep -Fxf disposable.txt domains.txt

No output means none of your direct dependencies list a known disposable domain. A hit isn't proof of anything bad, since metadata emails are self-declared, but it tells you which packages deserve a closer look.

What to do now

1. Move publishing accounts to durable addresses. If a maintainer registered with a throwaway or soon-to-expire address, change it. An address that lapses is an account recovery path someone else could take over.
2. If you were blocked before, you can now use Outlook or Hotmail. Problems with registration or email can be reported on the PyPI support tracker at github.com/pypi/support.
3. Use organisation accounts for company-owned projects, so access doesn't depend on one person's inbox.
4. Prefer trusted publishing from CI over long-lived API tokens, so a compromised account email has less to unlock.
5. Add the disposable-domain check above to your dependency review for new packages. It costs seconds and catches a cheap signal.

Why it matters

Bulk account creation is how most registry malware campaigns start. Throwaway addresses make each account free, which lets an attacker publish hundreds of typosquats and lose nothing when they're removed. A blanket ban on a provider stops one campaign but punishes everyone using that provider and does nothing about the next disposable domain.

Reputation checks change the cost per account without excluding real users. They also take a manual chore off a small team. PyPI's post makes that point directly: adding to the prohibited list no longer needs staff or volunteer time. For a registry, defences that run themselves are the ones that keep working.

Try it yourself

Run the dependency email check above against one project's requirements.txt. Then extend it to transitive dependencies by generating a full list with pip freeze in a clean virtual environment, and compare how many unique maintainer domains appear in each. The jump from direct to transitive is a useful number for any review of who you trust.

Click through it at your own pace, or open it full screen.

You can also drop the same requirements.txt into the free scan at gold.safeguard.sh/scan. It runs in the browser, needs no login, the file never leaves your machine, and it handles up to 100 dependencies per scan.

Quick check

Sources

• PyPI Blog: Checking email reputation, and allowing Outlook again (16 October 2026)
• disposable-email-domains list
• PyPI JSON API documentation
• PyPI support tracker