Paste the address
Drop any email into the pill — Gmail, Outlook, custom domains, or role aliases like info@ and sales@. Verify one address free right now, or upload a CSV to check a whole list once you sign up.
Continuous Deliverability Watch
The mail monitor for email deliverability that re-runs MX, SMTP, mailbox, and SPF, DKIM, DMARC checks on every address. Same 9-point engine as our paid API.
Free to try. No signup, no card.
No signup, no card. Paste any address, get a deliverable or bounce verdict in seconds, and repeat on a cadence to catch list decay early.
Drop any email into the pill — Gmail, Outlook, custom domains, or role aliases like info@ and sales@. Verify one address free right now, or upload a CSV to check a whole list once you sign up.
Nine checks fire in parallel: syntax, DNS, and MX records, a live SMTP handshake, catch-all and disposable detection, role and domain-age signals, mailbox state, and email authentication, then you get the full verdict.
Every address comes back valid, invalid, or risky, with the format, address type, server status, and mailbox status called out on the page. The API returns the same verdict with a 0-100 confidence score and the full per-check breakdown.
Same nine checks as the one-off test, run on a schedule so decay never builds up silently.
Deliverability monitoring is the address side of list health, run on a schedule. Most monitoring tools cover blacklist status and sending reputation — the right first half, but they skip the addresses. Mailboxes decay constantly: people change jobs, inboxes get retired, and 20 to 40% of B2B lists quietly fail at catch-all domains that accept every probe. The nine-check sweep catches those before they bounce.
The same nine-check engine our paid email verification API runs. Every email, every verification, every time.
Every address runs a full RFC 5321 and RFC 5322 compliance pass before a single network call goes out. The engine catches what visual scanning misses, the double dot in alice@verifox..ai, the trailing period, the IDN homograph that looks valid but resolves to a different domain.
Bundled typo suggestions let your form offer “did you mean alice@gmail.com?” instead of rejecting silently.


Once syntax passes, the engine resolves the domain. We confirm the DNS records exist, fetch the MX record priority list in order, and verify at least one mail-exchange server is actively accepting connections right now.
Misspelled domains like gmial.com, expired domains, and parked-for-sale domains all fail this gate before the engine wastes a single SMTP roundtrip.


The engine opens a TCP connection on port 25, performs the EHLO handshake, then negotiates MAIL FROM and RCPT TO. Every server response code (220, 250, 550, 552) is parsed deterministically against the IANA enhanced-status registry.
This is the moment a mailbox proves it actually exists. No third-party guesses, no statistical heuristics, just the receiving server's own answer.


Some domains accept every email regardless of whether the mailbox exists, a setup known as a catch-all configuration. The engine sends a deterministic probe to a deliberately fake address (zzz9k7q@domain.com); if the server returns the same 250 OK it returned for the real address, the domain is catch-all.
The verdict isn't dropped, it's flagged RISKY so you know the deliverability signal is degraded.


The engine maintains a curated registry of 10,247 disposable email providers, including Mailinator, Guerrilla Mail, 10MinuteMail, Tempmail, and the long tail of regional clones.
Any address matching the blocklist is flagged INVALID. Deliverability to a mailbox that exists for 10 minutes and is never checked is functionally zero, regardless of whether the SMTP handshake passes.


info@, support@, no-reply@, admin@, billing@. These are shared inboxes, not individuals.
The engine extracts the local-part of every address, matches it against the known role-prefix registry, and tags the result with a reduced engagement score.
You don't drop them automatically. The verdict flags them as roles so you can decide.


Fresh-spam domains registered hours ago are the single biggest source of inbound abuse. The engine queries WHOIS and RDAP for every unique domain, extracts the registration date, and flags anything under 30 days old with a “fresh” warning.
Domains aged 5+ years pick up a corresponding trust signal. The same heuristic spam filters have been using since the early 2000s, ported into the verdict.


SPF, DKIM, and DMARC together prove the sender is authorised to send from that domain.
The engine reads each policy via DNS, validates SPF includes recursively, scans six common DKIM selectors, and confirms DMARC alignment with the From: header.
A failing DMARC policy means the sender can be spoofed, so the verdict warns you before you reply.


Beyond “exists vs doesn't exist”, the engine extracts the precise mailbox state from the SMTP server's response. Full inbox (552 / 522 quota), disabled mailbox (550 5.1.1), out-of-office autoresponder, frozen account.
Each state maps to a specific retry policy. Full inbox retries in 6 hours. Disabled drops permanently. The verdict tells you which bucket the bounce belongs in so your retry logic doesn't waste cycles.


An MX lookup is a read-only window into how a domain receives email. In one query you learn who runs the mail, how it routes, and whether it can receive at all.
The same DNS resolution the Verifox verification engine runs first on every address it checks.
The MX hosts name the provider — Google Workspace, Microsoft 365, Proofpoint, or a self-hosted server.
Records return lowest-number-first, so you read the primary server and its fallbacks straight away.
No MX record, or a broken one, means mail bounces before it is ever sent.
An MX lookup starts the story; verifying the address confirms the mailbox itself is real.
An MX lookup is only the first step. Verifying the address confirms the mailbox is real and deliverable.
The single most useful thing a mail exchanger lookup tells you — who to talk to about mail.
Same nine-check pipeline, a 0-100 catch-all confidence score, credits that never expire, and an MCP server no competitor offers. Head-to-head with the two providers our buyers shortlist.
Most tools reset your balance every month. Verifox sells credits that sit in your account until you spend them.
forever
1,000credits on signup
No card required
2,500 with a work email
Free includes
one time
10,000credits
$0.0059 eachSAVE 34%
Everything in Free, plus
per month
15,000credits a month
$0.0053 each
Unused credits roll over
Everything in packs, plus
One credit verifies one address; a find costs 10, a company search 100 and an email reveal 50. All prices in USD, secure checkout via Dodo Payments.
Prices are before tax. Any VAT, GST or sales tax your country charges is added at checkout. Buying as a business? Enter your VAT or GST number there.
The addresses you submit are used only to run your verification. They are never sold, and nobody on your list hears from us.

The addresses you submit are never sold or shared.

We ask the mail server. Not one message is sent.

Full GDPR data-subject rights for everyone in the EU and UK.

California opt-out, do not sell and DSAR handling.
An investigation into the money leaking out of your list - and the nine checks that decide whether your email is read, or never arrives at all.

57 pages, free PDF, no signup
Common questions
Common questions about deliverability monitoring: what changes between checks, how often to run sweeps, and where monitoring fits alongside one-time verification.
Email deliverability monitoring means re-checking, on a schedule, the signals that decide whether your mail gets accepted: live mailboxes, valid MX records, a passing SMTP handshake, and SPF, DKIM, and DMARC authentication. A one-time list scrub answers those questions for a single day; monitoring keeps answering them as mailboxes die, DNS records change, and forms collect new junk.
Verifox runs nine checks per address on every pass, the same pipeline behind our email verification service, so a monitoring sweep is a full verification, not a cached lookup.
For the address and authentication side, yes. Classic mail monitor services watch your sending domain: blacklist listings and inbox placement panels. Verifox monitors what those services assume is already fine, whether the mailboxes on your list still exist and whether your SPF, DKIM, and DMARC records still pass.
The two halves complete each other. Run your sweeps here, then cover the domain-reputation side with the email blacklist check and the domain reputation checker.
Yes. The scanner on this page gives you 4 checks per day with no account and no card. That is enough to spot-check your own address and your highest-value contacts daily.
Sign up free and 1,000 credits land once you verify your email, 2,500 if you register with a work address. From there credits are pay-as-you-go with volume discounts on larger packs.
Every address goes through nine checks in parallel:
The authentication leg is the one most list tools skip entirely. If you only need that piece, the standalone DMARC, DKIM and SPF check runs it on its own.
Before every meaningful send, and at least monthly for any list you mail regularly. Addresses decay constantly: people change jobs, companies migrate domains, and inboxes get retired without notice. A list that verified clean a quarter ago is a different list today.
The expensive failure mode hides at catch-all domains, where 20 to 40% of B2B email lists actually fail. Those domains accept every probe a basic checker sends, so only the catch-all resolution with AI scoring catches the dead ones between sends.
Yes, that is how most teams run it. A scheduled job hits the REST API, sweeps the list, and routes anything that flips to undeliverable back into your CRM.
AI agents get the same engine with zero glue code through the native MCP server: point Claude, Cursor, or a custom agent at the MCP URL and the monitoring tools are wired.
Yes. The ninth check validates SPF, DKIM, and DMARC on the sending domain, and the MX leg confirms mail routing still resolves. DNS edits are the classic silent killer: one rewritten TXT record turns a passing SPF into a SoftFail, and nothing tells you until open rates sag.
For deeper single-purpose digging, the MX lookup, DKIM tester, and SMTP test each isolate one layer of the same stack.
They are used only to run the verification and show you the result. Verifox never sells the addresses you monitor, which matters when the list you are sweeping is your customer base.
Verifox is GDPR and CCPA compliant; our security overview has the details, and the privacy policy spells out exactly how your data is handled.
One credit per address per pass, and credits never expire, so a monthly cadence wastes nothing if a sweep slips a few weeks. Volume rates step down as usage grows; exact numbers are on the pricing page.
Custom SLAs are available on annual Volume contracts, with live status at status.verifox.ai.
Same engine, different posture. A one-time deliverability test answers “is this address good right now?” Monitoring asks that question again next week, because the answer changes. The verdicts themselves are identical: deliverable, undeliverable, or risky, with a confidence score and a per-check breakdown.
If you want a single composite grade for an address instead of a recurring sweep, the email health checker frames the same nine checks as a one-shot report card.