Email Validation &
Deliverability Intelligence

The API performs multiple layers of verification in a single call: syntax validation, MX record lookup, live SMTP connection to confirm the mailbox exists, disposable domain detection, role account identification, and free email provider detection. It returns a confidence score (0–100), quality rating, and structured risk_flags so your application can act on specific issues rather than just a binary pass/fail.

The confidence score (0–100) reflects the overall deliverability likelihood of the email address. A score above 70 with SMTP confirmation means the inbox is very likely reachable. Scores below 50 indicate catch-all domains, SMTP failures, or other unresolved signals. We recommend gating sign-ups or list additions at a threshold that fits your risk tolerance — for example, only auto-accepting scores above 70 and sending a manual review notification for scores between 40–70.

Role accounts are generic email addresses not tied to an individual — such as info@, support@, admin@, sales@, or noreply@. These addresses are often monitored by teams, routed to ticketing systems, or checked infrequently. For marketing and sales outreach, role accounts reduce deliverability and engagement rates. The role_account_validation field flags these explicitly so you can route them to a human review queue rather than automated campaigns.

The API checks the email domain against a continuously updated database of known disposable and temporary email service providers — including Mailinator, Guerrilla Mail, Temp-Mail, and thousands of others. The disposable_validation.value field returns true when the domain is NOT disposable (safe) and false when it IS a disposable domain. This inverted logic is intentional — a true value always means the validation passed.

risk_flags is an array of named signals in the API response that your application can check programmatically. Common values include: role_account (address is a generic role inbox), catch_all_unknown (the mail server accepts all addresses — deliverability unconfirmed), and disposable_domain (the domain is a known throwaway service). An empty array means no specific risks were detected beyond the overall confidence score.

No. SMTP verification works by initiating a connection to the mail server and checking whether the mailbox is accepted at the protocol level — without delivering a message. This is sometimes called a "dry run" SMTP check. It confirms that the inbox exists and can receive email without triggering any spam filters or sending a real message.

Some mail servers are configured to accept all inbound email regardless of whether the specific mailbox exists — these are called catch-all domains. When this is detected, smtp_validation.checked may be false and catch_all_unknown will appear in risk_flags. The confidence score will reflect this uncertainty. Catch-all addresses are not confirmed deliverable, but they are also not confirmed undeliverable — treat them as medium risk.

Each successful email validation deducts 2 credits from your shared credit balance. Credits are only charged on a successful 200 response. Invalid requests (400), unauthorised (401/403), and rate limit responses (429) are never charged. The free plan includes 1,000 credits per month — enough for 500 email validations at no cost.

Yes. You can call the API sequentially for any list size. Each call validates one email address. For high-volume batch processing, use our Professional or Business plan which supports 500 requests per second rate limits. The structured JSON response makes it straightforward to build a batch processor that collects results and flags addresses below your confidence threshold.

Yes. The Email Validation API processes only the email address you submit and returns validation metadata. No email addresses are stored beyond the processing window. The compliance field in the response provides context on free provider detection relevant to B2B marketing consent workflows. All data is processed in EU infrastructure.