SMTP-Level Email Verification

Email Verification That Stops You Paying for Dead Inboxes.

99.99% accuracy from our 9-point API engine. Catch invalid, disposable, and catch-all addresses in 2 seconds, before they hurt deliverability.

Sign up free and get 1,000 verifications instantly, 2,500 with a work email. No credit card required.

Trusted by 500,000+ leading GTM teams of all sizes

How It Works

How the 9-check verification engine works

Three steps from a raw address to a verdict you can act on, with no setup, no field mapping and no waiting on a support ticket.

001INPUT

Paste or upload

Drop one address into the pill above, paste a few hundred, or upload a CSV. Gmail, Outlook, custom domains and role aliases all go through the same front door.

002ENGINE

Run the 9-check engine

Nine checks fire in parallel: syntax, DNS, MX, a live SMTP handshake, disposable, role, catch-all, domain age, and SPF with DKIM and DMARC authentication. Nothing is sampled.

003VERIFY

Verdict in 2 seconds

Valid, risky or invalid, with a confidence score, the per-check breakdown and a retry policy. Read it here, pull it over the API, or export the clean file. Nothing is stored.

In plain terms

What email verification actually does

The short answer, before the pitch. What a verifier checks, where the honest limits are, and why any of it moves revenue.

Email verification confirms that an address exists, is formatted correctly, and can actually receive mail before you send anything to it. A verifier checks the syntax against RFC 5321 and 5322, confirms the domain publishes valid MX records, then opens an SMTP conversation with the receiving server to ask whether the mailbox is real. Good engines go further and screen for disposable domains, role accounts like info@ and billing@, and catch-all servers that accept every address whether a human reads it or not.

The 9-point engine

Nine checks, one verdict

The same nine-check engine our paid email verification API runs. Every email, every verification, every time.

  1. 01

    Syntax

    Every address runs a full RFC 5321 and RFC 5322 compliance pass before a single network call goes out. The engine catches what visual scanning misses, the double dot in [email protected], the trailing period, the IDN homograph that looks valid but resolves to a different domain.

    Bundled typo suggestions let your form offer “did you mean [email protected]?” instead of rejecting silently.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the Syntax tile is ringed in the nine-check result board, beside a card showing the parse of matthamnett @ avencera.ai against RFC 5321 and RFC 5322, verdict “Valid format”.
  2. 02

    Domain & MX

    Once syntax passes, the engine resolves the domain. We confirm the DNS records exist, fetch the MX record priority list in order, and verify at least one mail-exchange server is actively accepting connections right now.

    Misspelled domains like gmial.com, expired domains, and parked-for-sale domains all fail this gate before the engine wastes a single SMTP roundtrip.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the MX Record tile is ringed in the result board, beside a card showing the real MX 0 record avencera-ai.mail.protection.outlook.com on Microsoft 365, verdict “MX record found”.
  3. 03

    SMTP handshake

    The engine opens a TCP connection on port 25, performs the EHLO handshake, then negotiates MAIL FROM and RCPT TO. Every server response code (220, 250, 550, 552) is parsed deterministically against the IANA enhanced-status registry.

    This is the moment a mailbox proves it actually exists. No third-party guesses, no statistical heuristics, just the receiving server's own answer.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the SMTP Connect tile is ringed in the result board, beside a card showing the EHLO → MAIL FROM → RCPT TO exchange and the server’s 250 2.1.5 Recipient OK reply, verdict “Mailbox proven”.
  4. 04

    Catch-all detection

    Some domains accept every email regardless of whether the mailbox exists, a setup known as a catch-all configuration. The engine sends a deterministic probe to a deliberately fake address ([email protected]); if the server returns the same 250 OK it returned for the real address, the domain is catch-all.

    The verdict isn't dropped, it's flagged RISKY so you know the deliverability signal is degraded.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the Catch-All tile is ringed in the result board, beside a card comparing the real address (250 OK) with a deliberately fake probe (550 rejected), verdict “Validates recipients”.
  5. 05

    Disposable

    The engine maintains a curated registry of 10,247 disposable email providers, including Mailinator, Guerrilla Mail, 10MinuteMail, Tempmail, and the long tail of regional clones.

    Any address matching the blocklist is flagged INVALID. Deliverability to a mailbox that exists for 10 minutes and is never checked is functionally zero, regardless of whether the SMTP handshake passes.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the Disposable tile is ringed in the result board, beside a card showing the 10,247-provider throwaway blocklist and no match for avencera.ai, verdict “Legitimate domain”.
  6. 06

    Role address

    info@, support@, no-reply@, admin@, hello@, billing@, contact@. These are shared inboxes, not individuals.

    The engine extracts the local-part of every address, matches it against the known role-prefix registry, and tags the result with a reduced engagement score.

    You don't drop them automatically. The verdict tells you they're roles so you can decide whether they belong in your outbound.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the Role Address tile is ringed in the result board, beside a card matching the local-part matthamnett against the info@ / support@ / no-reply@ / admin@ role registry with no match, verdict “Personal address”.
  7. 07

    Domain age

    Fresh-spam domains registered hours ago are the single biggest source of inbound abuse. The engine queries WHOIS and RDAP for every unique domain, extracts the registration date, and flags anything under 30 days old with a “fresh” warning.

    Domains aged 5+ years pick up a corresponding trust signal. The same heuristic spam filters have been using since the early 2000s, ported into the verdict.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the Domain Age tile is ringed in the result board, beside a card showing the WHOIS creation date 2025-07-10 against the 30-day fresh-spam threshold, verdict “1y old”.
  8. 08

    Email authentication

    SPF, DKIM, and DMARC together prove the sender is authorised to send from that domain.

    The engine reads each policy via DNS, validates SPF includes recursively, scans six common DKIM selectors for a published key, and confirms DMARC alignment with the From: header.

    A failing DMARC policy means the sender can be spoofed, so the verdict warns you before you reply.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the DMARC tile is ringed in the result board, beside a card showing the real SPF include, DKIM selector1/selector2 and DMARC p=reject records, verdict “Aligned & enforcing”.
  9. 09

    Mailbox state

    Beyond “exists vs doesn't exist”, the engine extracts the precise mailbox state from the SMTP server's response. Full inbox (552 / 522 quota), disabled mailbox (550 5.1.1), out-of-office autoresponder, frozen account.

    Each state maps to a specific retry policy. Full inbox retries in 6 hours. Disabled drops permanently. The verdict tells you which bucket the bounce belongs in so your retry logic doesn't waste cycles.

    /dashboard/verify
    The Verifox dashboard verifying matthamnett@avencera.ai: the Inbox Exists tile is ringed in the result board, beside a card showing the live 250 2.1.5 active reply against the full-inbox and disabled states that drive retry policy, verdict “Inbox confirmed”.
One platform, end to end

Everything the engine does

Verify one address or a million, find the ones you are missing, and wire the same verdict into your product over the API or the MCP server.

Verification engine
0

checks on every
address

The same nine-check pipeline runs on the free checker, the bulk uploader and the paid API. No stripped-down tier.

No signup to start

Verify your first emails right here, no account, no card.

0k emails a minute

Bulk CSV in, verified list out. Same speed on every plan.

Instantly verified

Every address comes back already checked, with a confidence score.

0.00% accurate

Validated on a 10,000-address mixed benchmark including catch-all domains.

Credits never expire

1,000 free on signup. 2,500 with a work email. Pay as you go after that.

Start verifying, free

Emails are never stored

Processed in memory, dropped on response. SOC 2 · GDPR · CCPA.

Plans and packs

Pick how you want to pay

A subscription for steady senders, one-time packs for bursty cleanups. Either way, every credit you buy stays yours until you spend it.

Free

Prove the accuracy on your own list before you spend anything. Every account starts loaded.

$0forever
  • 1,000 free verifications
  • 2,500 with a work email
  • Credits never expire
  • All 9 checks included
  • No card required
  • Full API + bulk CSV access

Enterprise

For 250K+ credits, annual contracts, and teams that need SLAs, invoicing, and dedicated throughput.

Custompricing
  • 250K to 1M+ credit packs
  • Dedicated throughput
  • Priority support
  • Invoicing available
  • 99.99% uptime SLA
  • Dedicated Slack support · 2hr SLA
99.99% measured accuracy30-day money-back on unused creditsCredits never expire

One credit verifies one email; a find costs 10 credits — the same pool powers both. Free credits arrive on signup with no card. ONE renews until you cancel, and every credit it granted stays yours.

GDPR-ready · Emails processed in memory, never stored · Secure checkout via Stripe

Built for senders

Who relies on an email verification service

Anyone whose revenue touches an inbox. The workflows differ; the failure mode, a burned sending domain, is identical.

  • Email marketing teams

    Mailbox providers throttle domains that bounce. Verifying before each campaign keeps hard bounces near zero, so your open rate reflects the content you wrote and not the list you inherited. Most teams start by running their worst segment through the free email checker.
  • Sales and outreach teams

    Cold outreach dies fastest at catch-all corporate domains. Verify prospect lists before they reach your sequencer, and fill the gaps with the email finderinstead of guessing patterns that burn a rep’s morning on bounces.
  • Agencies managing client lists

    Every client list you mail is a reputation you are renting. Batch verify each one through the multiple email checker or the bulk uploader before a single send goes out under your infrastructure.
  • Developers and product teams

    Verify at signup with one call to the REST API, about 380ms median, and keep fake accounts out of your activation metrics. Building agents? The MCP server exposes the same engine as native tools.
What teams are saying

Built for the teams that ship outbound

Growth leads, marketers, and engineers running real campaigns on real lists, with a verified email on every byline.

Thomas George, GTM Lead at Stripe

90% lower bill, 0.4% bounces

We were paying ZeroBounce a four-figure monthly bill and still landing 3% bounces on cold campaigns. Switched the pipeline to Verifox, dropped to 0.4% bounces, and cut the bill by more than 90%.
Thomas G.GTM Lead, Stripe
Brittany King, GTM Lead at HubSpot

Catch-all finally has a verdict

Other tools flag 30% of our B2B list as 'risky catch-all' and leave the call to us. Verifox returns a real verdict on those addresses, with a confidence score. We send more, we send safer.
Brittany K.GTM Lead, HubSpot
Dale Micallef, GTM Lead at Slack

Reputation rebuilt in 6 weeks

We had a Gmail spam-folder problem after a bad list import. Verifox cleaned the list and the warmup ran on the same engine. Back in primary inbox in six weeks. One vendor, half the cost.
Dale M.GTM Lead, Slack
Erica Kovalkoski, GTM Lead at Discord

0.7% bounce on 50k

Ran a 50,000-address outbound list through Verifox before our quarterly campaign. Bounces landed at 0.7%, sender reputation didn't move, replies were up 22% over last quarter.
Erica K.GTM Lead, Discord
Greg Lindsay, GTM Lead at OpenAI

MCP in 10 minutes

Their MCP server let me wire email verification directly into our internal Claude agent in about ten minutes. Zero glue code. No other vendor in this space has thought about that workflow.
Greg L.GTM Lead, OpenAI
Rini Vasana, Product Manager at Vercel

10k/min held under 400ms

Tested Verifox at 10,000 verifications per minute on a Tuesday morning. Latency held under 400ms median, no soft failures, no rate-limit walls. The vendor we benched throttled at 2,000/min.
Rini V.Product Manager, Vercel
Jonathan Aharon, GTM Lead at MongoDB

Hygiene that doesn't break pipeline

Our SDRs were enriching from three tools and 14% of the emails were invalid before they hit the sequencer. Verifox sits in the pipeline now and the team stopped seeing 'undeliverable' replies the next week.
Jonathan A.GTM Lead, MongoDB
Emma Fox, GTM Lead at Linear

Bulk that actually ships

Bulk upload, sorted CSV back in twenty minutes, plug into our growth stack. The half-day list-hygiene project per cohort turned into something the marketing intern runs on autopilot.
Emma F.GTM Lead, Linear
David Hare, GTM Lead at Snowflake

Scores you can act on

Verifox returns a 0-100 confidence score per address, not just a label. We thresholded at 75 for the cold sequencer, 60 for nurture, and our deliverability team finally has a knob they can tune.
David H.GTM Lead, Snowflake
Trust & compliance

Enterprise-grade security and scale

Every layer of the stack carries a third-party attestation, so you can ship into regulated industries without rebuilding your compliance posture.

  • Claymation Japanese hanko seal in jade-green clay with a twisted shimenawa rope rim, the words SOC 2 TYPE II embossed in cream clay on its face.

    SOC 2 Type II

    Independently audited to the SOC 2 Type II standard.

  • Claymation Japanese hanko seal in cobalt-blue clay with a twisted shimenawa rope rim, the word GDPR embossed in cream clay on its face.

    GDPR

    Built for the EU with full GDPR data-subject rights.

  • Claymation Japanese hanko seal in rose-pink clay with a twisted shimenawa rope rim, the word CCPA embossed in cream clay on its face.

    CCPA

    California opt-out, do-not-sell, plus DSAR handling.

  • Claymation Japanese hanko seal in terracotta clay with a twisted shimenawa rope rim, the text ISO 27001 embossed in cream clay on its face.

    ISO 27001

    Information security held to the ISO 27001 standard.

  • Claymation Japanese hanko seal in lilac-purple clay with a twisted shimenawa rope rim, the text ISO 42001 embossed in cream clay on its face.

    ISO 42001

    AI governance aligned to the new ISO 42001 standard.

Free field manual

The Dead List

An investigation into the money leaking out of your list — and the nine checks that decide whether your email is read, or never arrives at all.

The Dead List field manual, held up by the Verifox fox
Get the free manual

57 pages, free PDF, no signup

Common questions

Nine honest answers

The questions teams ask before they move a list onto a new verifier, with the real numbers, the real limits, and the real opinions behind our nine-check engine.

What is email verification?

Email verification is the process of confirming that an email address exists and can safely receive mail before you send to it. A verifier checks the address syntax, the domain’s MX records, and the mailbox itself over SMTP, then screens for disposable domains, role accounts, and catch-all servers. Instead of guessing, you get a verdict: Valid, Risky, or Invalid.

Verifox runs 9 checks on every address, including an AI confidence pass on catch-all domains and SPF, DKIM, and DMARC authentication. The full breakdown lives on the email verification service page, or you can test an address free right now.

How is this different from ZeroBounce?

ZeroBounce runs 4 checks. We run 9, and the five they skip are the ones that decide whether a B2B list is usable: catch-all detection with an AI confidence pass, domain age, and SPF, DKIM, and DMARC authentication.

The gap shows on catch-all domains, where 20-40% of B2B lists live and 4-check tools shrug with “unknown.” Run the same address through both engines and compare; the free email checker needs no signup.

How many emails can I verify for free?

4 per day with no account on the free email checker. Create a free account and you get 1,000 credits on the spot, or 2,500 if you sign up with a work email. No card either way.

Past that, credits are pay-as-you-go with volume pricing shown for your region. And if you need to find an address before you can verify it, the email finder is part of the same platform.

What is catch-all resolution?

Catch-all domains accept mail for every address, valid or not, so a standard SMTP check can’t tell you whether a specific mailbox exists. Most tools stop there and return “unknown.”

Our AI runs a second-pass confidence analysis on those addresses and returns a real verdict: Valid, Risky, or Invalid. It’s the hardest part of our email verification service, and the reason catch-all-heavy lists come back usable instead of half gray.

How fast is the API?

Median latency is around 380ms for a single address, and most verdicts land within 2 seconds even when a slow mail server drags out the SMTP conversation. Bulk lists process at roughly 10,000 emails per minute.

Endpoint shapes, rate limits, and code samples live in the API docs.

Can I verify emails at signup?

Yes. The real-time endpoint is built for signup flows: block disposable domains, role accounts, and dead mailboxes the moment someone types an address. At a median of ~380ms, it runs inline without making your form feel slow.

Wiring it up is one endpoint call; the API docs walk through it.

Do credits expire?

Never. Buy once, use whenever, even years later. Credits stay on your account permanently: no monthly minimums, no use-it-or-lose-it pressure. The pricing page shows the volume tiers for your region.

What happens to my email data?

We verify, not store. Addresses are processed in memory and discarded the moment verification completes. Nothing is retained, logged, or sold, and the platform is SOC 2 Type II compliant.

Can AI agents use Verifox?

Yes, natively. Verifox ships an email verification MCP server, so Claude, Cursor, and custom LLM agents can verify addresses without glue code. Drop the MCP URL into your agent config and the tools are wired.

Prefer to call the engine directly? Everything the MCP exposes is also available over the REST API, documented in the API docs.