REST Email Verification for Developers

Email Verification API That Returns a Verdict, Not a Guess.

One GET request runs all 9 checks and answers in ~380ms median time. Wire it straight into forms, CRMs, or AI agents instantly.

Get your free API keyRead the API reference

1,000 free credits on signup, 2,500 with a work email. No card.

Trusted by 500,000+ leading GTM teams

How it works

One call, a full verdict

Three moves, no glue code. Send the address, let the nine-check engine run, and read a structured verdict your code can branch on.

001REQUEST

Send one request

Pass the address to /v1/email-validation with your X-API-Key header: a GET in the URL or a POST in the body. No SDK, no OAuth dance, just one authenticated call.

002ENGINE

9 checks run in parallel

Syntax, DNS and MX, a live SMTP handshake, catch-all and disposable detection, role and domain-age signals, and SPF/DKIM/DMARC all fire at once, answering in ~380ms median.

003VERDICT

Read the JSON verdict

One structured object comes back: reachable for the one-word answer, score for catch-all confidence, and every per-check field so your code can branch on the exact reason.

Why an email verification API

Verification belongs in the request path

It turns list hygiene from a monthly chore into a property of your system: every address checked the moment it enters, in about 380 ms.

An email verification API moves list hygiene from a monthly chore to a property of your system: every address gets checked the moment it enters, at the signup form, the lead-capture webhook, or the CRM import. What a real-time API catches that regex cannot is what happens after syntax — a mailbox deactivated last quarter, a disposable domain spun up this morning, or a catch-all server that accepts everything and bounces it later, where 20 to 40% of B2B lists fail.

Quickstart

Copy, paste, verify in a single call

No SDK to install and no OAuth dance. Just a key, a plain GET request, and a JSON object your code can branch on in one line — no libraries, no ceremony.

Verify one email
GET/v1/email-validation/:email
1curl -X GET "https://api.verifox.ai/v1/email-validation/[email protected]" \
2  -H "X-API-Key: vfx_your_api_key"
200 — the 9-check verdict
1{
2  "email": "[email protected]",
3  "domain": "example.com",
4  "isValid": true,
5  "reachable": "safe",
6  "syntax": true,
7  "smtp": {
8    "hostExists": true,
9    "fullInbox": false,
10    "catchAll": false,
11    "deliverable": true,
12    "disabled": false
13  },
14  "mx": {
15    "records": ["gmail-smtp-in.l.google.com."],
16    "smtpProvider": "Google",
17    "domainAgeDays": 11196,
18    "domainCreated": "1995-08-13",
19    "hasSPF": true,
20    "hasDMARC": true,
21    "hasDKIM": false
22  },
23  "isFree": false,
24  "isRole": false,
25  "isDisposable": false,
26  "hasGravatar": true,
27  "suggestion": null,
28  "verifiedAt": "2026-03-31T10:30:00Z",
29  "score": 92
30}
Verify a list in bulk
POST/v1/email-validation/bulk
1curl -X POST "https://api.verifox.ai/v1/email-validation/bulk" \
2  -H "X-API-Key: vfx_your_api_key" \
3  -H "Content-Type: application/json" \
4  -d '{"input": ["[email protected]", "[email protected]", "bad@invalid"]}'
200 — the progress poll
1{
2  "job_id": "69d78b9e37e519a86c186261",
3  "total_records": 1000,
4  "processed_records": 420,
5  "status": "processing",
6  "progress": 42,
7  "summary": {
8    "total_safe": 200,
9    "total_risky": 50,
10    "total_invalid": 150,
11    "total_unknown": 20
12  }
13}

Every check maps to a field: syntax for format, mx for the domain and its SPF/DKIM/DMARC posture plus domainAgeDays, smtp for the live handshake and catch-all flag, and isDisposable / isRole for the address class. score carries the AI confidence on catch-alls.

The endpoints

Five routes cover the whole job

Two ways to verify a single address, and a three-call bulk flow for lists. That is the entire surface area you need to learn.

  • GET/v1/email-validation/:email

    Verify one address in the URL. Full 9-check verdict, 1 credit.

  • POST/v1/email-validation

    Same verdict via JSON body, for callers that keep addresses out of URLs and logs.

  • POST/v1/email-validation/bulk

    Start a bulk job from an array or an uploaded CSV. Up to 100,000 emails per job.

  • GET/v1/email-validation/bulk/:jobId/progress

    Poll a running job: processed count, percent done, and a safe/risky/invalid summary.

  • GET/v1/email-validation/bulk/:jobId/results

    Fetch completed results with cursor pagination, 50 rows per page by default.

Request and response schemas for every route, parameter by parameter, live in the email validation API reference.

Trust & compliance

Built to verify other people's addresses responsibly

Emails sent to the API are processed in memory and discarded, never stored, logged, or sold. SOC 2 Type II attested, with 2.1B+ emails verified on the platform to date.

  • Claymation Japanese hanko seal in jade-green clay with a twisted shimenawa rope rim, the words SOC 2 TYPE II embossed in cream clay on its face.

    SOC 2 Type II

    Independently audited to the SOC 2 Type II standard.

  • Claymation Japanese hanko seal in cobalt-blue clay with a twisted shimenawa rope rim, the word GDPR embossed in cream clay on its face.

    GDPR

    Built for the EU with full GDPR data-subject rights.

  • Claymation Japanese hanko seal in rose-pink clay with a twisted shimenawa rope rim, the word CCPA embossed in cream clay on its face.

    CCPA

    California opt-out, do-not-sell, plus DSAR handling.

  • Claymation Japanese hanko seal in terracotta clay with a twisted shimenawa rope rim, the text ISO 27001 embossed in cream clay on its face.

    ISO 27001

    Information security held to the ISO 27001 standard.

  • Claymation Japanese hanko seal in lilac-purple clay with a twisted shimenawa rope rim, the text ISO 42001 embossed in cream clay on its face.

    ISO 42001

    AI governance aligned to the new ISO 42001 standard.

Free field manual

The Dead List

An investigation into the money leaking out of your list - and the nine checks that decide whether your email is read, or never arrives at all.

The Dead List field manual, held up by the Verifox fox
Get the free manual

57 pages, free PDF, no signup

Common questions

Email verification API, answered

Auth, rate limits, the response shape, bulk jobs, and what happens to the addresses you send us. Real numbers, including the ones that are limits.

How do I authenticate with the email verification API?

One header: X-API-Key: vfx_your_api_key. Create a free account, generate a key in the dashboard, and every endpoint accepts it. Keys carry scopes, so you can mint a verify-only key for a service that should never touch anything else.

The full auth section, including key rotation and the read-only scope, lives in the API reference.

What does a single API call actually check?

Nine things, in parallel: RFC 5321/5322 syntax, domain existence and MX records, a live SMTP handshake with a mailbox ping, disposable-domain match, role-address detection, catch-all detection, AI-confidence scoring on catch-alls, domain age, and SPF/DKIM/DMARC authentication.

Every one of those surfaces as a field in the response, so your code can branch on the exact failure. The methodology behind each check is on the email verification service page.

How fast is the email verification API?

Median single-verify latency is around 380 ms, and under 50 ms when the result is cached. Bulk jobs process roughly 10,000 emails per minute on the standard tier.

A real SMTP handshake takes time; anything that claims instant mailbox checks is skipping the mailbox. SLA is 99.9% on Starter and 99.99% on an annual Volume contract.

What are the rate limits?

60 requests per minute on the single-verify endpoints. Past that you get a 429 and should back off before retrying. We publish the number because you will hit it if you loop a list through the single endpoint.

That is what the bulk endpoint is for: one POST covers up to 100,000 addresses and the rate limit stops mattering. Details in the API docs.

Is there a free tier for the API?

Yes. Signing up credits your account with 1,000 verifications, or 2,500 if your signup email is a work address. No card. Each single verify costs 1 credit, and credits never expire.

Want to test the engine before writing any code? The free email checker runs the same engine in the browser, 4 checks a day without an account.

How does bulk email verification work over the API?

POST your list (a JSON array or an uploaded CSV referenced by s3_url) to /v1/email-validation/bulk and you get a job ID back. Poll the progress endpoint for a live safe/risky/invalid summary, then page through results when the status hits completed.

Honest note: results are pull-based today. There is no webhook on bulk jobs, so build a poller. For a no-code path, the multiple email checker covers the same flow in the browser.

How does the API handle catch-all domains?

Catch-all servers accept every address during the handshake, which is why 20 to 40% of B2B lists fail there with most verifiers. We flag the domain via smtp.catchAll, then run AI-confidence scoring so the score field still separates likely-real from likely-fake.

You decide the threshold per use case. See the catch-all email checker for how the scoring behaves on real domains.

Do you store the emails I send to the API?

No. Addresses are processed in memory and discarded when the verification completes. Nothing is logged, retained, or sold, which matters when the addresses you verify belong to your users.

Verifox is SOC 2 Type II compliant, and the privacy policy spells out exactly what is touched and what is not, byte by byte.

What do isValid, reachable, and score mean in the response?

reachable is the verdict: safe, risky, invalid, or unknown. isValid is the boolean rollup, and score (0 to 100) is the confidence grade that does the heavy lifting on catch-alls.

Most integrations gate on reachable and only read the nested smtp and mx objects when they need the why. Field-by-field docs are in the API reference.

Can AI agents call the email verification API?

Yes, two ways. Any agent that can make HTTP calls can hit the REST endpoints directly. Or skip the glue code: the email verification MCP server exposes this same engine as native tools for Claude, Cursor, and any MCP client.

If your agent also needs to discover addresses, not just verify them, pair this API with the email finder API or the email finder tool.