Overview
An email verification API and email checker for signup forms and CRM imports. Email Validator checks the address format, resolves the domain's MX records, follows the RFC fallback to the domain's A record, flags domains that publish a null MX, and reports whether the domain has SPF and DMARC records. It matches the domain against free, disposable and role-account lists, and returns a normalized address so +tag and Gmail-dot variants collapse to one. Every check runs over DNS, with no SMTP mailbox probe, so a slow mail server never holds up the response. Paid plans add a risk score and a suggested correction for domain typos.
Live Test Email Validator API →
Endpoint
One host, one path per API. The block below shows this call in four languages; every one of them is the same HTTP request. Making requests covers the timeouts, retries and parameter rules that apply to all of them. The SDKs wrap the same call in a typed client.
curl "https://api.apiverve.com/v1/emailvalidator?email=support%40myspace.com" \
-H "x-api-key: your_api_key_here"const res = await fetch('https://api.apiverve.com/v1/emailvalidator?email=support%40myspace.com', {
headers: { 'x-api-key': 'your_api_key_here' },
});
if (!res.ok) throw new Error(`${res.status} ${await res.text()}`);
const { data } = await res.json();
console.log(data);import requests
res = requests.get(
"https://api.apiverve.com/v1/emailvalidator?email=support%40myspace.com",
headers={"x-api-key": "your_api_key_here"},
timeout=15,
)
res.raise_for_status()
print(res.json()["data"])package main
import (
"fmt"
"io"
"net/http"
)
func main() {
req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/emailvalidator?email=support%40myspace.com", nil)
req.Header.Set("x-api-key", "your_api_key_here")
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
out, _ := io.ReadAll(res.Body)
fmt.Println(string(out))
}Replace your_api_key_here with the key from your dashboard. When the inputs arrive as a list rather than one at a time, batch requests run up to 200 of them through this same API in a single call.
Authentication
Send your key in the x-api-key header. That is the only auth step — there is no token exchange and no per-endpoint scope to configure. Authentication covers creating, rotating and revoking keys.
A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.
Parameters
Sent in the query string. Premium parameters are accepted on every plan but only take effect on plans that include them.
| Parameter | Type | Description |
|---|---|---|
emailRequired | string | The email address to validate (e.g., support@myspace.com) email |
Response
Every API returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape. Response format covers the envelope, the other output formats and how premium fields are withheld.
{
"status": "ok",
"error": null,
"data": {
"email": "support@myspace.com",
"domain": "myspace.com",
"username": "support",
"isRegexValid": true,
"hasTypo": false,
"isMxValid": true,
"isValid": true,
"isFreeEmail": false,
"isCompanyEmail": true,
"isDisposable": false,
"isRoleAccount": true,
"mxRecord": "mxa-00ac0e01.gslb.pphosted.com",
"isNullMx": false,
"canReceiveMail": true,
"hasSpf": true,
"hasDmarc": true,
"isSubaddressed": false,
"normalizedEmail": "support@myspace.com",
"suggestedCorrection": null,
"mailProvider": "Proofpoint",
"isSecurityGateway": true,
"riskScore": 10,
"riskLevel": "low"
}
}
Response fields
Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.
| Field | Type | Example | Description |
|---|---|---|---|
email | string | "support@myspace.com" | The email address that was validated |
domain | string | "myspace.com" | The domain portion extracted from the email |
username | string | "support" | The username (local part) extracted from the email |
isRegexValid | boolean | true | Email passes standard regex format validation |
hasTypo | boolean | false | The address is malformed and fails format validation |
isMxValid | boolean | true | The domain has valid mail exchange (MX) records and can receive mail |
isValid | boolean | true | Indicates whether the email address is valid |
isFreeEmail | boolean | false | Domain belongs to a free consumer email provider |
isCompanyEmail | boolean | true | Domain appears to be a corporate/company domain |
isDisposable | boolean | false | Domain is a known disposable or throwaway email provider |
isRoleAccount | boolean | true | Mailbox is a role or shared address (e.g. info@, support@, noreply@) rather than a person |
mxRecord | string | "mxa-00ac0e01.gslb.pphosted.com" | The preferred (lowest-priority) mail exchanger host for the domain, or null when it has none |
isNullMx | boolean | false | The domain publishes a null MX record (RFC 7505), declaring that it accepts no email |
canReceiveMail | boolean | true | The domain can be sent mail: it has a real MX record, or no MX at all but an A record that mail falls back to (RFC 5321). Null if the fallback lookup could not complete. Unlike isMxValid, this follows the RFC fallback, so a parked domain with only a website address can be true |
hasSpf | boolean | true | The domain publishes an SPF (v=spf1) record, a sign it is set up to send mail. Null if the TXT lookup could not complete |
hasDmarc | boolean | true | The domain publishes a DMARC (v=DMARC1) record at _dmarc. Null if the lookup could not complete |
isSubaddressed | boolean | false | The address uses a +tag sub-address, e.g. jane+news@example.com |
normalizedEmail | string | "support@myspace.com" | Canonical address for spotting duplicates: the +tag removed, and for Gmail the dots too (googlemail.com folds into gmail.com). Not a deliverability claim |
suggestedCorrectionPremium | object | null | The likely intended email when a common domain typo is detected (e.g. gmial.com to gmail.com), otherwise null |
mailProviderPremium | string | "Proofpoint" | Who handles the domain's incoming mail, read from its MX records: Google, Microsoft, Zoho, Proofpoint and about 25 others. Null when the domain runs its own mail servers or uses a provider not on the list |
isSecurityGatewayPremium | boolean | true | True when mailProvider is an email security gateway (Proofpoint, Mimecast, Cisco and similar) that filters mail before it reaches the real mailbox host, which is typical of larger companies; null when mailProvider is null |
riskScorePremium | number | 10 | Composite 0-100 risk score combining deliverability, disposable, role and format signals (higher is riskier) |
riskLevelPremium | string | "low" | Risk band derived from the score: low, medium or high |
Errors
Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change. Error handling covers the full status list and which of them are worth retrying.
| Status | Meaning | What to do |
|---|---|---|
400 | Input was rejected | Read error; it names the parameter. |
401 | Key missing or invalid | Check the header name and the key value. |
403 | Key valid, but not permitted | A key restriction or IP allow-list; see key scoping. |
429 | Rate limited, or out of credits | Read error to tell them apart; see rate limits. |
Start from a template
Working apps built on this API, ready to deploy with your own key. Vercel asks for the key when you deploy; the code is on GitHub to change first.
Lead Validator
Score a lead from its email and phone number: throwaway inboxes, typos, VoIP and temporary numbers.
- Next.js
- React
Also uses Phone Number Validator
Signup Email Checker
Accept, review or reject an email at signup: catches throwaway inboxes, dead domains, typos and shared inboxes.
- Node.js
- Express
Use cases
- Signup Abuse Prevention
- To stop fake signups, SaaS onboarding flows block temporary addresses by checking disposable flags before creating new trial accounts.
- B2B Lead Routing
- Sales teams verify company domains against free provider flags to route corporate inquiries directly to account executives.
- Mailing List Hygiene
- When scrubbing subscriber databases, email marketers filter out missing mail records and invalid syntax to protect sender reputation.
- Customer Support Routing
- Flag shared inboxes like billing or support addresses during ticket submission to direct automated receipts to named team members instead.
- Free Trial Abuse
- Store the normalized address at signup so jane+1@gmail.com and j.ane@gmail.com count as one person when a product hands out free trials or credits.
Other ways to use Email Validator
Set up Email Validator on APIVerve, or reach the same source a different way. Your APIVerve account and credits work on all of them — one key, one balance.
Related
Pages that use this API:
- Block fake signupsGuides
- CodaIntegrations
- Node-REDIntegrations
- Response formatReference
More in Data Validation:

