Kickbox

Gotchas & limits

• Access-Control-Allow-Origin is a reflected Origin, not a wildcard — confirmed live this run: a request sent with Origin: https://example.com got back access-control-allow-origin: https://example.com, while a plain request with no Origin header got back the same header present but set to an empty string. Don't assume a * like Disify's; check the header is non-empty for your actual origin.
• There are no rate-limit headers at all on the keyless tier — confirmed across every response this run (no x-ratelimit-limit, retry-after, or similar), unlike Disify's x-ratelimit-limit: 30. There's no visible signal for how much headroom is left before throttling kicks in.
• A syntactically invalid string like notanemail is still HTTP 200 with {"disposable":false}, not an error — confirmed live this run. Unlike Disify, there's no format field to tell you the input wasn't parsed as an email or domain at all; a typo and a genuine non-disposable result look identical.
• There is no catch-all/accept-all surface on the Open API, despite what a general description of Kickbox might suggest — confirmed live this run: /accept-all/mailinator.com and /catch-all/mailinator.com each 301-redirect to https://docs.kickbox.com/, exactly as a made-up path (/bogus-nonexistent-path/mailinator.com) does, and appending ?catchall=true to the working route changed nothing ({"disposable":true}, unchanged). Kickbox's own open.kickbox.com landing page advertises its ACCEPT-ALL detector under the heading "Go beyond just checking for disposable email addresses" — i.e. as a feature of the paid Email Verification API, not this free one.