Paste the address
Drop any email into the pill — Gmail, Outlook, custom domains, or role aliases like info@ and sales@. Verify one address free right now, or upload a CSV to check a whole list once you sign up.
Run the MX lookup, the SMTP handshake, and the SPF, DKIM, and DMARC checks a real receiving server runs, on the same 9-point engine our paid API uses.
Free to try. No signup, no card.
No signup, no card. Paste any address and the same nine-point engine our API uses runs MX, SMTP, and mailbox-exists checks, returning an accept-or-bounce verdict.
Drop any email into the pill — Gmail, Outlook, custom domains, or role aliases like info@ and sales@. Verify one address free right now, or upload a CSV to check a whole list once you sign up.
Nine checks fire in parallel: syntax, DNS, and MX records, a live SMTP handshake, catch-all and disposable detection, role and domain-age signals, mailbox state, and email authentication, then you get the full verdict.
Every address comes back valid, invalid, or risky, with the format, address type, server status, and mailbox status called out on the page. The API returns the same verdict with a 0-100 confidence score and the full per-check breakdown.
Two product families share the same name. Verifox owns the one that tests whether a message gets accepted at all.
Email testing platforms split into two families. The first tests the message: previews, spam scoring, seed sends. The second tests the plumbing: authentication records, live mail servers, and addresses that actually exist. Verifox is built around the second kind — nine checks in parallel on every test, including an SMTP handshake and catch-all AI scoring with a 0-100 confidence score — and covers the message side where it decides acceptance: spam-risk scoring and template linting, minus the screenshot farm.
The same nine-check engine our paid email verification API runs. Every email, every verification, every time.
Every address runs a full RFC 5321 and RFC 5322 compliance pass before a single network call goes out. The engine catches what visual scanning misses, the double dot in alice@verifox..ai, the trailing period, the IDN homograph that looks valid but resolves to a different domain.
Bundled typo suggestions let your form offer “did you mean alice@gmail.com?” instead of rejecting silently.


Once syntax passes, the engine resolves the domain. We confirm the DNS records exist, fetch the MX record priority list in order, and verify at least one mail-exchange server is actively accepting connections right now.
Misspelled domains like gmial.com, expired domains, and parked-for-sale domains all fail this gate before the engine wastes a single SMTP roundtrip.


The engine opens a TCP connection on port 25, performs the EHLO handshake, then negotiates MAIL FROM and RCPT TO. Every server response code (220, 250, 550, 552) is parsed deterministically against the IANA enhanced-status registry.
This is the moment a mailbox proves it actually exists. No third-party guesses, no statistical heuristics, just the receiving server's own answer.


Some domains accept every email regardless of whether the mailbox exists, a setup known as a catch-all configuration. The engine sends a deterministic probe to a deliberately fake address (zzz9k7q@domain.com); if the server returns the same 250 OK it returned for the real address, the domain is catch-all.
The verdict isn't dropped, it's flagged RISKY so you know the deliverability signal is degraded.


The engine maintains a curated registry of 10,247 disposable email providers, including Mailinator, Guerrilla Mail, 10MinuteMail, Tempmail, and the long tail of regional clones.
Any address matching the blocklist is flagged INVALID. Deliverability to a mailbox that exists for 10 minutes and is never checked is functionally zero, regardless of whether the SMTP handshake passes.


info@, support@, no-reply@, admin@, billing@. These are shared inboxes, not individuals.
The engine extracts the local-part of every address, matches it against the known role-prefix registry, and tags the result with a reduced engagement score.
You don't drop them automatically. The verdict flags them as roles so you can decide.


Fresh-spam domains registered hours ago are the single biggest source of inbound abuse. The engine queries WHOIS and RDAP for every unique domain, extracts the registration date, and flags anything under 30 days old with a “fresh” warning.
Domains aged 5+ years pick up a corresponding trust signal. The same heuristic spam filters have been using since the early 2000s, ported into the verdict.


SPF, DKIM, and DMARC together prove the sender is authorised to send from that domain.
The engine reads each policy via DNS, validates SPF includes recursively, scans six common DKIM selectors, and confirms DMARC alignment with the From: header.
A failing DMARC policy means the sender can be spoofed, so the verdict warns you before you reply.


Beyond “exists vs doesn't exist”, the engine extracts the precise mailbox state from the SMTP server's response. Full inbox (552 / 522 quota), disabled mailbox (550 5.1.1), out-of-office autoresponder, frozen account.
Each state maps to a specific retry policy. Full inbox retries in 6 hours. Disabled drops permanently. The verdict tells you which bucket the bounce belongs in so your retry logic doesn't waste cycles.


An MX lookup is a read-only window into how a domain receives email. In one query you learn who runs the mail, how it routes, and whether it can receive at all.
The same DNS resolution the Verifox verification engine runs first on every address it checks.
The MX hosts name the provider — Google Workspace, Microsoft 365, Proofpoint, or a self-hosted server.
Records return lowest-number-first, so you read the primary server and its fallbacks straight away.
No MX record, or a broken one, means mail bounces before it is ever sent.
An MX lookup starts the story; verifying the address confirms the mailbox itself is real.
An MX lookup is only the first step. Verifying the address confirms the mailbox is real and deliverable.
The single most useful thing a mail exchanger lookup tells you — who to talk to about mail.
Same nine-check pipeline, catch-all confidence scoring, credits that never expire, and an MCP server no competitor offers. Head-to-head with the two providers our buyers shortlist.
Most tools reset your balance every month. Verifox sells credits that sit in your account until you spend them.
forever
1,000credits on signup
No card required
2,500 with a work email
Free includes
one time
10,000credits
$0.0059 eachSAVE 34%
Everything in Free, plus
per month
15,000credits a month
$0.0053 each
Unused credits roll over
Everything in packs, plus
One credit verifies one address; a find costs 10, a company search 100 and an email reveal 50. All prices in USD, secure checkout via Dodo Payments.
Prices are before tax. Any VAT, GST or sales tax your country charges is added at checkout. Buying as a business? Enter your VAT or GST number there.
The addresses you submit are used only to run your verification. They are never sold, and nobody on your list hears from us.

The addresses you submit are never sold or shared.

We ask the mail server. Not one message is sent.

Full GDPR data-subject rights for everyone in the EU and UK.

California opt-out, do not sell and DSAR handling.
An investigation into the money leaking out of your list - and the nine checks that decide whether your email is read, or never arrives at all.

57 pages, free PDF, no signup
Common questions
FAQs about email testing platforms: what this checks beyond preview tools, why catch-alls are hard to read, and how to pick the right approach.
An email testing platform checks a message and the infrastructure behind it before a real send, so problems show up in a dashboard instead of a bounce report. The category covers rendering previews, spam-content scoring, authentication checks (SPF, DKIM, DMARC), SMTP and MX diagnostics, and recipient-address verification.
Verifox covers the infrastructure and recipient side: it proves whether mail will be accepted at all. The checker tools here run the same 9-point verification engine as the paid API, backed by dedicated blacklist, spam-risk, and template-linting tools.
Email testing examines your side of the send: templates, links, authentication records, reputation. Email verification examines the recipient side: whether each address on your list exists and will accept mail.
The two fail independently. A perfectly authenticated domain still bounces off dead mailboxes, and a clean list still lands in spam if DKIM is broken. Verifox puts both layers on one account: the free email checker for addresses, the DKIM tester and its siblings for your sending setup.
At minimum, the nine that decide whether a message gets accepted: syntax and format validation (RFC 5321/5322), domain existence and MX records, a live SMTP handshake with a mailbox-exists ping, disposable-domain match, role-address detection, catch-all detection with AI-confidence scoring, domain age, and SPF, DKIM, and DMARC authentication.
Verifox runs all nine in parallel on every address test. The full breakdown lives on the email verification service page.
No. Authentication records are public DNS data, and reading them should not cost anything. Verifox ships a free DKIM tester and a combined SPF, DKIM, and DMARC checker that read your records and flag the gaps in plain English.
Where paid platforms earn their keep is volume: testing thousands of addresses before a campaign, or wiring checks into a signup form via the API. The record-reading stays free.
No. Rendering previews need a farm of real mail clients taking screenshots, and that is a different product. Verifox tests the layer previews cannot see: whether the receiving server accepts your mail at all.
We do cover the markup side of the problem: the email template checker lints your HTML for the mistakes that break rendering and trip spam filters, and the acceptance checks catch what a pixel-perfect preview never will, like a dead mailbox or a broken DKIM key.
Only partly, and any platform claiming certainty is overselling. Inbox placement depends on your content, your sending history, and each provider’s filters. What a platform can prove is the acceptance layer: valid authentication, a live mailbox, a clean sending domain.
Get those right and placement problems become content problems you can iterate on. Start with the spam check for address risk and the blacklist check for sender reputation.
Verifox is free to start. You get 4 checks per day on this page without an account, then 1,000 free credits on signup, or 2,500 if you sign up with a work address. No card required.
Past that, credits are pay-as-you-go and never expire, with volume discounts on the pricing page. No seat fees, no lock-in.
Yes, and you should: mailbox providers throttle senders once hard bounces climb, so testing the list is the cheapest insurance a campaign can buy. Bulk runs take a CSV upload, included from the free tier up.
Paste a handful into the multiple email checker to try it, then upload the full file once you have claimed your free credits.
Yes. The REST API returns a verdict you can use inside signup forms and CRMs. HubSpot, Salesforce, and Mailchimp connect out of the box.
For AI agents, Verifox ships a native MCP server: drop the URL into a Claude or Cursor config and the testing tools are wired without glue code. Uptime history is public at status.verifox.ai.
Every address gets 9 checks, catch-all domains included. Catch-alls are the honest differentiator: 20 to 40% of B2B lists sit behind domains that accept everything during a basic SMTP probe, and most platforms skip them or mark them unknown.
Verifox runs an AI-confidence pass on every catch-all instead of giving up. The free tier runs the identical engine the paid verification API runs, capped only on volume.