emailverification.whoisxmlapi.com

Email validation checks an address in layers: first whether it is syntactically well-formed, then whether its domain exists and can receive mail (via DNS and MX records), and finally whether the specific mailbox is likely to exist. Most services also flag disposable, role-based, and free email domains. The practical limit is that no check can prove a mailbox is real with 100% certainty, so results usually come back as a status like valid, invalid, risky, or unknown rather than a simple yes/no.

The layers of an email validation check

1. Syntax check (RFC formatting)

The validator parses the address against email formatting rules: a local part, an @ symbol, and a domain. It catches malformed input such as missing @, illegal characters, consecutive dots, or a domain with no dot. This layer is fast and deterministic — an address either parses or it doesn't — but passing it says nothing about whether the mailbox exists.

2. Domain and MX record check

The validator looks up the domain's DNS records, especially MX (mail exchange) records, which declare where mail for that domain should be delivered. If the domain has no MX records and no fallback A record, it generally cannot receive email. This layer separates "the domain is real and configured for mail" from "the domain doesn't exist or isn't set up to receive mail."

3. Mailbox existence (SMTP-level checks)

This is the deepest and least reliable layer. The validator connects to the domain's mail server and, in a simplified description, asks whether the specific mailbox is accepted. In practice:

• Many servers refuse to answer, rate-limit, or return misleading responses to prevent spam harvesting.
• Catch-all domains accept any address at that domain, so a "valid" result may be meaningless.
• Greylisting and temporary errors produce inconclusive answers.

Because of this, mailbox checks often return unknown or risky rather than a clean valid/invalid.

4. Disposable, role, and free email detection

Beyond deliverability, validators classify the type of address:

WhoisXML API's Email Verification service lists a Disposable Email Domains Database and a Free Email Domains Database among its data feeds, which is how this classification is typically sourced.

How to read validation results

Treat the output as a set of independent signals, not one verdict:

• Syntax + domain/MX pass, mailbox unknown → the address is plausible; deliverability is unconfirmed.
• Catch-all domain → individual mailbox results are unreliable; consider it risky.
• Disposable or role-based flag → decide based on your use case (transactional email vs. marketing list hygiene).
• Hard invalid (bad syntax, no MX) → safe to reject.

False positives (marking a good address invalid) usually come from aggressive SMTP probing or temporary server errors. False negatives (marking a bad address valid) usually come from catch-all domains. When a result is unknown, the safe move is to retry later or send a confirmation email rather than discard the address.

Practical usage

WhoisXML API offers several ways to run these checks — an Email Verification API, a Bulk Email Verification API, and a Bulk Email Verification web tool — so the same layered logic applies whether you validate one address or a list. The service advertises free trials; current pricing is listed separately (the site references plans starting from $129/month and dedicated API and database pricing pages), so confirm the tier that matches your volume before committing.

For a single signup form, a syntax + MX check plus a confirmation email is usually enough. For cleaning a large list, run bulk validation and segment by status: drop hard invalids, quarantine unknowns for retry, and treat disposable/role-based addresses according to your policy.

An email validator checks an address in layers, from simple text formatting up to whether the mailbox can actually receive mail. Most tools run syntax checks, domain and MX record lookups, and mailbox-level probes, then add risk signals like disposable domains and role accounts. The result is usually a status such as valid, invalid, risky, or unknown — and the right action depends on which layer failed, not just the final label.

Syntax and format checks

The first pass is purely textual. The validator confirms the address matches the expected structure: a local part, an @ symbol, and a domain.

• Local part: allowed characters, no leading or trailing dot, no consecutive dots.
• Domain: at least one dot, valid characters, no leading or trailing hyphen in a label.
• Length limits: the local part and the full address stay within RFC-defined maximums.

This layer catches typos like [email protected] or name@domain with no top-level domain. It cannot tell you whether the mailbox exists — a syntactically perfect address can still be dead.

Domain and MX record checks

Next, the validator asks whether the domain can receive email at all.

• Domain existence: does the domain resolve in DNS?
• MX records: are there mail exchanger records pointing to a mail server?
• Fallback A/AAAA record: some valid setups accept mail on the domain itself when no MX record exists, so a good validator checks this too.

If the domain has no MX record and no fallback, the address cannot receive mail regardless of how it looks. This is a strong invalid signal.

Mailbox-level checks

This is where validators differ most. A mailbox check opens an SMTP conversation with the destination mail server and asks whether the specific address is accepted — without sending a message.

• SMTP handshake: connect, greet, and issue a RCPT TO command for the address.
• Server response: an acceptance suggests the mailbox exists; a rejection suggests it does not.
• Catch-all detection: some servers accept every address. A validator tests a random address at the same domain — if that is also accepted, the domain is catch-all and individual results are unreliable.

Mailbox checks are the most informative layer but also the least deterministic. Greylisting, rate limits, and servers that refuse to confirm addresses can all produce an "unknown" result rather than a clean yes or no.

Risk signals beyond existence

A deliverable address can still be a bad address to send to. Validators flag:

• Disposable domains: temporary inbox providers. WhoisXML API publishes a Disposable Email Domains Database for this purpose.
• Role accounts: addresses like info@, sales@, or support@ that reach a group rather than a person.
• Free email domains: consumer providers, which may matter for B2B list hygiene. WhoisXML API also offers a Free Email Domains Database.
• Spam traps and known-bad addresses: addresses that exist only to catch senders with poor list hygiene.

These signals do not make an address invalid. They make it risky, and the decision to keep or drop it depends on your use case.

How to interpret the results

The key point: "valid" is not the same as "wanted." A validator tells you whether mail can be delivered, not whether the recipient will engage. Use the status to clean hard failures first, then apply risk rules that match your sending policy.

What a validator does not check

• Whether the person wants your email — that is a consent and engagement question, not a technical one.
• Whether the inbox is full — a full mailbox may still accept the message and bounce later.
• Content or intent — an address tied to a spam trap looks normal at every technical layer.

For a practical workflow, run syntax and domain checks on every address at capture time, run mailbox and risk checks before a campaign, and re-verify addresses that have not been contacted in several months. WhoisXML API's Email Verification API and Bulk Email Verification API cover these layers, and the site lists free trials alongside paid API and database pricing.

Email address verification checks more than whether an address looks correctly formatted. A verifier typically examines syntax, the domain's mail (MX) records, whether the mailbox appears to exist, and whether the domain is disposable or a free provider — then returns a status such as deliverable, undeliverable, risky, or unknown rather than a simple yes/no. WhoisXML API's Email Verification service describes its products as answering "these questions and others" for every email, and offers three delivery modes: an API, bulk verification, and a disposable email domains database. Which one fits depends on whether you're checking one address interactively, cleaning a list, or filtering signups at scale.

The specific checks behind a verification result

Most verification pipelines run through a sequence of gates. Each gate can pass, fail, or return an inconclusive result:

The page evidence lists these as the questions the service answers for every email, and separately notes a Disposable Email Domains Database and a Free Email Domains Database as distinct products — meaning disposable and free detection are treated as their own data problems, not just side effects of an SMTP probe.

Why you get statuses, not a yes/no

A verifier can only report what the receiving server tells it. Several conditions make a definitive answer impossible:

• Catch-all domains accept mail for any address at the domain, so the server won't confirm whether a specific mailbox exists.
• Greylisting temporarily rejects first-time senders; a probe that doesn't retry may read this as undeliverable.
• SMTP timeouts or rate limiting from the receiving server leave the result unknown rather than invalid.

This is why results come back as deliverable, undeliverable, risky, or unknown. A "risky" or "unknown" result isn't a bug — it's the honest output when the domain's configuration prevents a conclusive check. Treating unknown as undeliverable will discard real addresses; treating it as deliverable will let some bad ones through.

API vs. bulk validator vs. disposable-domain feed

These three modes solve different problems, and the choice follows from your workflow:

Real-time API — for checking a single address at the moment of capture, such as a signup form or a support ticket. You get a per-address answer immediately, which lets you block or flag the address before it enters your system.

Bulk verification — for cleaning an existing list before a send. You submit many addresses at once and get statuses back for each, then suppress the undeliverable and risky ones. This is a batch job, not an interactive check.

Disposable email domains database — for filtering at scale without a per-address round trip. If your main concern is throwaway signups, matching the domain against a downloadable list is faster and cheaper than verifying every address individually. WhoisXML API lists this as a separate product with its own pricing page.

A practical pattern is to combine them: use the disposable-domain feed as a fast first filter, the API for real-time signup checks, and bulk verification for periodic list hygiene.

Choosing based on your use case

• Signup forms and transactional flows → real-time API, so you can act on the result before the address is stored.
• Marketing list cleaning before a campaign → bulk verification, because you need statuses for thousands of addresses in one pass.
• High-volume signup abuse prevention → disposable email domains database, because domain-level matching scales without per-address latency.
• Mixed needs → the service's product lineup supports combining these; the page presents them as separate products rather than one bundled tool.

WhoisXML API's page states that free trials are available, and its pricing links reference "Start from $129/month," API pricing, and database pricing as separate pages. Check the specific product page for the mode you need, since API and database pricing are listed separately.

Common reasons a valid-looking address fails

If an address that clearly exists comes back undeliverable or unknown, the cause is usually on the receiving side, not the address itself:

1. The domain uses a catch-all, so no per-mailbox confirmation is possible.
2. The server greylists or rate-limits probes, producing a timeout.
3. The mailbox is real but the server refuses SMTP verification for anti-spam reasons.
4. The address is a role account or alias that the verifier flags as risky rather than invalid.

In each case, the right response is to route the address to a review or retry path rather than hard-rejecting it.

An email verifier checks an address at several layers: syntax, domain and MX records, mailbox existence via SMTP, and risk signals such as disposable or role-based addresses. It confirms whether an address is technically deliverable and flags risky ones, but it cannot guarantee a human will open or read your message. The checks below are the ones WhoisXML API's Email Verification service describes, and they apply to most verifiers on the market.

The Four Layers of Verification

1. Syntax Check

The verifier parses the address against RFC rules: a local part, an @ symbol, and a valid domain. It catches typos like name@@example.com, missing dots, illegal characters, and trailing spaces.

What it catches: malformed addresses that no mail server would accept. What it misses: a perfectly formatted address that does not exist.

2. Domain and MX Record Check

The verifier looks up the domain and its DNS records, especially the MX (mail exchange) records that tell the internet where to deliver mail for that domain.

• No MX record → the domain cannot receive email; the address is undeliverable.
• MX record present → the domain is configured to accept mail, so the address passes this layer.

This step also surfaces whether the domain is parked, expired, or has no mail infrastructure at all.

3. SMTP Probe (Mailbox Existence)

The verifier connects to the recipient's mail server and starts an SMTP conversation, asking whether the specific mailbox exists. A 250 response suggests the mailbox is real; a 550 typically means it is not.

This is the closest a verifier gets to confirming a mailbox exists, but it has limits:

• Many servers use catch-all configurations, accepting every address at the domain, so a positive response does not prove the individual mailbox is real.
• Some servers greylist or throttle probes, returning inconclusive results.
• Servers may accept then bounce later, so a clean SMTP result is not a delivery guarantee.

4. Risk and Reputation Signals

Beyond deliverability, verifiers flag addresses that are technically valid but risky to send to:

WhoisXML API offers a Disposable Email Domains Database and a Free Email Domains Database as separate data feeds, which is how these signals are typically sourced.

What the Results Mean for Sending Decisions

Verifiers usually return one of four statuses:

• Valid — passes syntax, domain, and mailbox checks. Safe to send.
• Invalid — fails at least one hard check (bad syntax, no MX, mailbox rejected). Remove from your list.
• Risky / Accept-all — technically deliverable but flagged (catch-all, disposable, role-based). Send with caution or segment separately.
• Unknown — the server would not give a definitive answer (greylisting, timeouts). Retry later or treat as risky.

The practical rule: send to valid, suppress invalid, and route risky/unknown into a separate, lower-volume campaign so a bad batch does not drag down your domain reputation.

Single vs. Bulk Verification

• Single (real-time) verification fits sign-up forms, checkout flows, or one-off checks — you verify as the user types or submits.
• Bulk verification fits list cleaning before a campaign. WhoisXML API's Bulk Email Verification API and Bulk Email Verification tool are built for processing large lists at once.

Use single checks to stop bad addresses at the point of entry; use bulk checks to clean lists you already have.

Verification Is a Snapshot, Not a Permanent Label

An address that is valid today can go invalid tomorrow: mailboxes get deleted, domains expire, and catch-all servers change behavior. For lists you reuse, re-verify on a regular schedule — quarterly is a common starting point — and always re-verify before a major send.

Where to Start

WhoisXML API's Email Verification service offers an Email Verification API, a web lookup for single addresses, and bulk validation for lists, with free trials available. Pricing for the API and the disposable email domains database is published on their respective pricing pages.

An email verification service checks several layers of an address, not just its spelling. At minimum, it confirms the syntax is valid, the domain exists and can receive mail (via MX records), and often whether the specific mailbox is deliverable through an SMTP handshake. Many services also flag disposable, free, or role-based addresses and return a status such as valid, invalid, unknown, or risky. The exact checks and result labels vary by provider, so treat any single result as a signal, not a guarantee.

The layers of an email verification check

Verification typically runs through a sequence, and each layer can stop the process early if it fails.

1. Syntax and format validation

The service parses the address against email standards: a local part, an @ symbol, and a domain. It catches obvious problems like missing @, illegal characters, or malformed domains. This is the cheapest check and the first filter.

2. Domain and DNS checks

The service looks up the domain's DNS records, especially MX (mail exchange) records, which tell the internet where to deliver mail for that domain. No MX records usually means the domain cannot receive email. Some services also check A records and DNS configuration as a secondary signal.

3. Mailbox-level (SMTP) verification

This is the deepest common check. The service connects to the recipient's mail server and starts an SMTP conversation, asking whether the specific mailbox exists. The server's response indicates whether the address is likely deliverable. This step is where results get less certain, because many servers refuse to answer, rate-limit, or give misleading responses to protect against spam and harvesting.

4. Risk and category flags

Beyond deliverability, services often label the address type:

• Disposable email domains — temporary addresses from throwaway providers.
• Free email domains — consumer providers (the provider's own database distinguishes these).
• Role-based addresses — generic mailboxes like info@ or support@ that may not reach a specific person.

WhoisXML API, for example, offers a Disposable Email Domains Database and a Free Email Domains Database as separate products alongside its Email Verification API, so these categories can be checked independently of a live SMTP probe.

What the result statuses mean

Verification results usually fall into a small set of categories. The exact wording depends on the provider, but the meaning is broadly consistent:

The unknown category is the one people misread most often. It does not mean the address is bad. It usually means the receiving server declined to confirm the mailbox, which is common with large providers. A verification service cannot force an answer.

How to use verification results to decide whether to send

Verification is a decision input, not a verdict. A workable approach:

1. Suppress invalid addresses before sending. Hard failures at the syntax or domain level rarely recover.
2. Send to valid addresses as your primary audience.
3. Handle unknown addresses deliberately. For transactional or high-value mail, you may still send; for bulk marketing, consider suppressing or segmenting them to protect sender reputation.
4. Treat category flags as policy choices. A disposable address may be fine for a low-stakes signup and wrong for a paid account. A role address may be correct for a company contact form and wrong for a personal outreach list.
5. Re-verify over time. Mailboxes go dormant and domains expire, so a result has a shelf life.

Why no single check is conclusive

SMTP verification depends on the receiving server's cooperation, and servers have strong incentives to be uncooperative. Catch-all domains accept mail for any address, so a "valid" response there is weak. Greylisting and rate limits can produce false negatives. This is why reputable services combine multiple checks and report a status rather than a binary yes/no, and why you should match the strictness of your sending to the cost of a bad address.

Where to start

WhoisXML API's Email Verification product line covers the checks described here through an Email Verification API, a web lookup, and a bulk validator, with disposable and free email domain databases available separately. The site lists a free trial and paid plans starting from $129/month, with separate API and database pricing pages; check current terms on those pages before committing, since pricing and trial conditions can change.