Email Validation

Email validation is the term that gets thrown around loosely, often as a synonym for verification, sometimes to mean nothing more than a regex check. Neither is quite right. Validation is the specific, mechanical layer that confirms an address is built correctly and points somewhere real: right syntax, a domain that can receive mail, a mailbox that answers. It is the foundation every serious verification process is built on, and understanding exactly what it does, and does not, cover is what separates a list that performs from one that quietly bounces.

What email validation covers

As the umbrella term, validation spans three core mechanical checks, each narrower and more expensive than the last. The first is syntax, confirming an address is formatted to spec under RFC 5321 and RFC 5322: a legal local part, a single @, and a domain with a valid top-level domain. The second is domain validation, looking up the domain’s MX record to confirm it actually publishes mail servers rather than just existing as a registered name. The third is mailbox-level reachability, an SMTP handshake with the receiving server that asks, directly, whether that specific mailbox exists.

Together those three checks answer one question: could this address be real? That is a narrower question than whether you should send to it, and the gap between the two is where validation ends and something more is needed.

Validation vs. verification — where the line actually is

In casual conversation, “validation” and “verification” get used as if they were the same word, and most of the time that is harmless. We draw the line more precisely, because it matters for what a tool actually tells you. Validation is the mechanical layer: the syntax, domain, and mailbox checks above, confirming an address could be real. Verification is the fuller process, running those same checks and then layering in risk signals — catch-all, disposable, and role detection among them — to arrive at a confident send-or-don’t-send verdict rather than a plain pass/fail on format.

Put another way, validation is a fact-check, and verification is a judgment call built on that fact-check. An address can pass every validation check and still be a bad idea to mail: it can sit on a catch-all domain that answers for any username, belong to a shared role inbox nobody reads, or come from a disposable provider engineered to die within hours. Validation has no mechanism to catch any of that, because catching it was never its job. That is exactly what the risk layer in full verification is for.

Why syntax-only checks catch almost nothing

Of the three validation layers, syntax is the one most often mistaken for the whole job, usually because it is the easiest to bolt onto a signup form with a single regex line. That convenience is exactly why it catches so little. A regex can only judge the shape of the text: is there one @, does the domain have a dot, does it end in something that looks like a top-level domain. It has no way to know whether the domain exists, whether it accepts mail, or whether a human is on the other end of that mailbox.

[email protected] is perfectly valid syntax and cannot receive a single message. A regex approves it without hesitation. Worse, most hand-rolled patterns also over-reject legal-but-rare forms, like quoted local parts and plus-addressing, while still letting through dead domains and abandoned mailboxes wholesale. Syntax checking is worth running, since it is free and instant and disqualifies obvious typos before anything touches the network, but treating it as validation on its own is how lists end up full of addresses that were never going to deliver.

What a real validation pipeline checks

A validation pipeline built to actually mean something runs the three mechanical layers in order, cheapest first, so each stage disqualifies obviously bad addresses before the next, slower stage runs. Syntax goes first and rejects malformed strings instantly, with no network call at all. Domain validation comes next, resolving the MX record to confirm the domain is actually configured to receive mail rather than just registered. Last, and slowest, is the SMTP handshake, opening a live conversation with the receiving mail server to ask whether that exact mailbox exists.

That is the foundation. Verification takes the addresses that clear all three and runs them through the risk layer on top, flagging catch-all domains, disposable providers, and role addresses so you know not just whether an address could be real, but whether it is worth sending to. You can see the full pipeline resolve a real address, mechanical checks and risk layer together, on the free email checker, and the email verification page walks through every stage in detail. Volume tiers for validating and verifying at scale are on the pricing page.