How EmailVerify verifies email
A transparent look at exactly what we check, and what our results mean.
Most verifiers hand you a green tick and hope you trust it. We would rather show our work. Every address you submit goes through the same layered pipeline, and we report an honest status even when a mailbox simply cannot be confirmed.
The checks we run
- Syntax — RFC-grade format validation, including internationalised (IDN) domains normalised to punycode.
- Domain & MX — confirms the domain exists and publishes mail servers that can receive email (with an A-record fallback).
- Disposable — flags throwaway and temporary-inbox providers.
- Role-based — detects shared inboxes such as info@, sales@ and admin@.
- Live SMTP mailbox check — connects to the recipient's mail server and asks whether the specific mailbox exists. We use a null sender and never deliver an actual email.
- Catch-all — probes a random address on the domain to detect servers that accept everything, which makes any single address unconfirmable.
- SPF & DMARC — reads the domain's email-authentication records as a legitimacy signal.
We also detect the mail provider, spot likely typos (with a "did you mean" suggestion), and check Gravatar as a real-world usage signal.
What each status means
VALID The address is well-formed, the domain accepts mail, and the mailbox was confirmed or shows strong positive signals. Safe to send.
INVALID The address failed a hard check, for example bad syntax, no mail servers, or the mailbox was explicitly rejected by the server (SMTP 550). Do not send.
RISKY The address may work, but carries risk, for example a catch-all domain, a role inbox, or a mailbox we could not positively confirm. Send with caution.
UNKNOWN The mail server did not give a definitive answer at the time of the check, usually due to rate-limiting or greylisting. Re-checking later often resolves it.
The confidence score
Alongside the status we return a 0 to 100 confidence score. It blends every signal above, so you can set your own threshold, for example accept 80+ and review the rest, instead of relying on a single yes/no.
Why some addresses cannot be confirmed
- Large providers such as Gmail and Outlook deliberately rate-limit verification probes to prevent abuse, so they may return an unknown or risky result rather than confirming a mailbox.
- Catch-all domains accept every address, so individual mailboxes on them genuinely cannot be verified by anyone.
- Greylisting temporarily defers a first contact; a later re-check usually succeeds.
When we cannot confirm a mailbox we tell you honestly, rather than guessing "valid" and letting the bounce find you later.
Bulk verification
Upload a CSV or Excel file (up to 500 emails) with a column headed "Email". We verify every address, add Status, Score, Confidence, SMTP and Reason columns, and give you the same sheet back to download. Checks run with sensible per-domain pacing so we do not hammer mail providers.
Honest limitations
Verification is best-effort and reflects the state of a mailbox at the moment of the check. A mailbox can change at any time, and no verifier can guarantee delivery. See our Disclaimer for the full picture.