What Does Email Validation Actually Check?

Email validation checks an address in layers: first whether it is syntactically well-formed, then whether its domain exists and can receive mail (via DNS and MX records), and finally whether the specific mailbox is likely to exist. Most services also flag disposable, role-based, and free email domains. The practical limit is that no check can prove a mailbox is real with 100% certainty, so results usually come back as a status like valid, invalid, risky, or unknown rather than a simple yes/no.

The layers of an email validation check

1. Syntax check (RFC formatting)

The validator parses the address against email formatting rules: a local part, an @ symbol, and a domain. It catches malformed input such as missing @, illegal characters, consecutive dots, or a domain with no dot. This layer is fast and deterministic — an address either parses or it doesn't — but passing it says nothing about whether the mailbox exists.

2. Domain and MX record check

The validator looks up the domain's DNS records, especially MX (mail exchange) records, which declare where mail for that domain should be delivered. If the domain has no MX records and no fallback A record, it generally cannot receive email. This layer separates "the domain is real and configured for mail" from "the domain doesn't exist or isn't set up to receive mail."

3. Mailbox existence (SMTP-level checks)

This is the deepest and least reliable layer. The validator connects to the domain's mail server and, in a simplified description, asks whether the specific mailbox is accepted. In practice:

• Many servers refuse to answer, rate-limit, or return misleading responses to prevent spam harvesting.
• Catch-all domains accept any address at that domain, so a "valid" result may be meaningless.
• Greylisting and temporary errors produce inconclusive answers.

Because of this, mailbox checks often return unknown or risky rather than a clean valid/invalid.

4. Disposable, role, and free email detection

Beyond deliverability, validators classify the type of address:

WhoisXML API's Email Verification service lists a Disposable Email Domains Database and a Free Email Domains Database among its data feeds, which is how this classification is typically sourced.

How to read validation results

Treat the output as a set of independent signals, not one verdict:

• Syntax + domain/MX pass, mailbox unknown → the address is plausible; deliverability is unconfirmed.
• Catch-all domain → individual mailbox results are unreliable; consider it risky.
• Disposable or role-based flag → decide based on your use case (transactional email vs. marketing list hygiene).
• Hard invalid (bad syntax, no MX) → safe to reject.

False positives (marking a good address invalid) usually come from aggressive SMTP probing or temporary server errors. False negatives (marking a bad address valid) usually come from catch-all domains. When a result is unknown, the safe move is to retry later or send a confirmation email rather than discard the address.

Practical usage

WhoisXML API offers several ways to run these checks — an Email Verification API, a Bulk Email Verification API, and a Bulk Email Verification web tool — so the same layered logic applies whether you validate one address or a list. The service advertises free trials; current pricing is listed separately (the site references plans starting from $129/month and dedicated API and database pricing pages), so confirm the tier that matches your volume before committing.

For a single signup form, a syntax + MX check plus a confirmation email is usually enough. For cleaning a large list, run bulk validation and segment by status: drop hard invalids, quarantine unknowns for retry, and treat disposable/role-based addresses according to your policy.