Email Checker API - Real-Time Validation, Deliverability & Risk Signals
Every invalid address that slips through your signup form costs you twice - once as a bounce that damages your sender reputation, and again as a fake account polluting your data. The Email Checker API validates any email address in real time over a single REST call and returns a clear deliverability verdict backed by syntax, DNS, and mailbox-level analysis. You get disposable and catch-all detection, role-account flags, domain reputation signals, and - when you pass the signup IP - location and threat screening in the same response. Built for developers protecting registration flows, checkout forms, and CRM pipelines. Start with 10,000 free credits, no credit card required.
What You Get in Every Response
Deliverability Verdict
Every response returns validEmail with one of six values - valid, accept_all, invalid, unknown, risky, or app_server_blocked - plus a reason string explaining any non-valid result (omitted when the verdict is valid). This is the field your application branches on: accept, reject, or queue for review.
Use it to gate signups in real time as an email verification API instead of discovering bad addresses after they bounce.
RFC 5322 Syntax Validation
validSyntax checks format compliance against RFC 5322 before any network lookup runs. When syntax fails, validEmail always returns invalid, so malformed input is rejected at zero deliverability cost.
Use it to catch typos at the point of entry and give users instant feedback in registration and contact forms.
MX Record and DNS Verification
The dns object returns every one of the domain's live mxRecord hosts at its lowest preference (not just one) plus its aRecord, and domain.validDomain confirms the domain resolves and runs mail infrastructure. mxRecord is absent when a domain publishes no MX record at all - check aRecord in that case - and the whole dns object is absent when a domain publishes neither record type.
Use these fields to reject undeliverable domains and to log the exact mail servers behind each address for audits.
Disposable and Temporary Email Detection
domain.disposable flags addresses from known throwaway providers such as Mailinator-style temporary inboxes. Trial abusers and fraudsters lean on these to farm accounts.
Use this disposable email detection API flag to block burner signups before they consume free-tier resources or corrupt conversion metrics.
Catch-All Domain Detection
Catch-all domains accept mail for every address, so an accepted recipient there never actually confirms the mailbox exists. These addresses get their own validEmail verdict - accept_all - instead of being folded into valid. domain.catchAll is set alongside it to explain why.
Use accept_all to route these addresses to a risk queue instead of counting them as confirmed - corporate domains are frequently catch-all, so expect a visible share of traffic to land here.
Role Accounts and Full Mailboxes
account.role detects functional addresses like admin@, support@, sales@, and info@ - inboxes read by teams, not people, and a common source of spam complaints. account.fullMailBox reports mailboxes over capacity when SMTP response codes make that determinable.
Use both to keep engagement-killing addresses out of marketing sends.
Domain Reputation and B2B Filtering
domain.free distinguishes consumer providers such as Gmail from company-owned domains, and domain.spam flags domains listed in spam databases - the field to build on when you need an email spam checker API signal.
Use them together to qualify B2B leads and keep spam-associated domains out of your pipeline.
Optional IP Location and Threat Screening
Pass the optional ip field and the response adds an address object: city-level geolocation plus a security profile with threat_score, is_tor, is_proxy, proxy_type, is_bot, and is_known_attacker. One call validates the email and screens the signup IP - a check the dedicated email verification providers don't bundle.
Use it to catch fraudsters hiding behind VPNs, proxies, and Tor exits at registration.
Built for These Use Cases
Signup and registration protection
Validate every address the moment it's entered and branch on the verdict: accept deliverable addresses, reject invalid ones, and hold risky or unknown results for confirmation flows. Disposable and role-account flags stop burner and team inboxes from becoming user accounts.
Fraud screening at checkout
Send the buyer's email and IP address in one request. You get the deliverability verdict alongside anonymity and threat signals for the connection - flagged Tor exits, proxies, VPNs, and known attacker infrastructure - before the order ships. Pair it with the IP Geolocation Lookup when you need full network intelligence beyond the signup check.
Pre-send list hygiene
Re-validate addresses before each campaign to catch mailboxes that have gone stale since collection. For cleaning entire databases, the Bulk Email Validation API runs the same checks on up to 10 addresses per request with per-address error handling.
B2B lead qualification
Filter consumer-provider addresses out of sales pipelines and route only company-domain contacts to your CRM, with spam-listed domains excluded automatically.
Typo recovery at the point of entry
Syntax failures return instantly without consuming a network lookup, so your form can prompt the user to correct a malformed address while they're still on the page - a real time email verification API pattern that recovers genuine users you'd otherwise lose.
API Endpoint
All Endpoints
| Endpoint | Description | Credits | Reference | Playground |
|---|---|---|---|---|
| Email Checker | Check if an email address is valid, available, and deliverable. | 15 | Reference | Playground |
How-To-Guides
Validate an Email Address
Before a new account gets created, you want one answer: can this address actually receive mail? Post the address to the single-validation endpoint and branch on validEmail in the response - the syntax, domain, DNS, and account objects tell you why a verdict came back the way it did.
curl -X 'POST' \
'https://api.apifreaks.com/v1.0/email-validation/single?apiKey=API-KEY' \
-H 'Content-Type: application/json' \
-d '{
"email": "someone@gmail.com",
"name": "ABC Person"
}'
# Response
{
"success": true,
"email": "someone@gmail.com",
"name": "ABC Person",
"validEmail": "valid",
"validSyntax": true,
"domain": {
"name": "gmail.com",
"disposable": false,
"spam": false,
"free": true,
"validDomain": true,
"catchAll": false
},
"account": {
"role": false,
"fullMailBox": false
},
"dns": {
"mxRecord": [
"gmail-smtp-in.l.google.com.",
"alt1.gmail-smtp-in.l.google.com.",
"alt2.gmail-smtp-in.l.google.com.",
"alt3.gmail-smtp-in.l.google.com.",
"alt4.gmail-smtp-in.l.google.com."
]
}
}
Validate an Email with IP Enrichment
A deliverable email from a Tor exit node is a different risk than the same email from a residential connection. Add the optional ip field to the request body and the response gains an address object with geolocation and a full anonymity profile - proxy type, bot flags, and a threat score - so you can score the signup, not just the address.
curl -X 'POST' \
'https://api.apifreaks.com/v1.0/email-validation/single?apiKey=API-KEY' \
-H 'Content-Type: application/json' \
-d '{
"email": "someone@gmail.com",
"name": "ABC Person",
"ip": "223.226.82.170"
}'
# Response
{
"success": true,
"email": "someone@gmail.com",
"name": "ABC Person",
"validEmail": "valid",
"validSyntax": true,
"domain": {
"name": "gmail.com",
"disposable": false,
"spam": false,
"free": true,
"validDomain": true,
"catchAll": false
},
"account": {
"role": false,
"fullMailBox": false
},
"dns": {
"mxRecord": [
"gmail-smtp-in.l.google.com.",
"alt1.gmail-smtp-in.l.google.com.",
"alt2.gmail-smtp-in.l.google.com.",
"alt3.gmail-smtp-in.l.google.com.",
"alt4.gmail-smtp-in.l.google.com."
]
},
"ip": "223.226.82.170",
"address": {
"location": {
"city": "Gurugram",
"district": "Sector 39",
"confidence": "high",
"zipcode": "122003",
"state_prov": "Haryana",
"country_name": "India",
"continent_name": "Asia",
"continent_code": "AS",
"country_code2": "IN",
"country_code3": "IND",
"country_name_official": "Republic of India",
"accuracy_radius": "28.813",
"is_eu": false
},
"security": {
"threat_score": 90,
"is_tor": false,
"is_proxy": true,
"proxy_type": "VPN",
"proxy_provider": "",
"is_anonymous": true,
"is_known_attacker": true,
"is_spam": true,
"is_bot": false,
"is_cloud_provider": false,
"cloud_provider": ""
},
"validIpAddress": true
}
}
Handle Accept-All, Risky, and Unknown Results
Not every address resolves to a clean yes or no. Catch-all domains return their own accept_all verdict rather than being folded into valid, and unresponsive mail servers produce risky or unknown. Treating any of these as a confirmed valid is how bounces sneak back in. Check reason and domain.catchAll to decide: queue for double opt-in, retry later, or reject.
curl -X 'POST' \
'https://api.apifreaks.com/v1.0/email-validation/single?apiKey=API-KEY' \
-H 'Content-Type: application/json' \
-d '{
"email": "random12345@yahoo.com"
}'
# Response
{
"success": true,
"email": "random12345@yahoo.com",
"validEmail": "accept_all",
"validSyntax": true,
"reason": "domain accepts all addresses.",
"domain": {
"name": "yahoo.com",
"disposable": false,
"spam": false,
"free": true,
"validDomain": true,
"catchAll": true
},
"account": {
"role": false,
"fullMailBox": false
},
"dns": {
"mxRecord": [
"mta5.am0.yahoodns.net.",
"mta6.am0.yahoodns.net.",
"mta7.am0.yahoodns.net."
]
}
}
Clean an Existing List
When you inherit a database of thousands of addresses, validating them one call at a time is the wrong tool for the job. Use the single endpoint for real-time checks at the point of capture, and switch to the Bulk Email Validation API to process up to 10 addresses per request - each item in the batch returns its own result, so one malformed entry never fails the rest.
curl -X 'POST' \
'https://api.apifreaks.com/v1.0/email-validation/bulk?apiKey=API-KEY' \
-H 'Content-Type: application/json' \
-d '{
"emailData": [
{
"email": "someone@gmail.com"
},
{
"email": "test@example.com"
}
]
}'
# Response
{
"emailResponse": [
{
"success": true,
"email": "someone@gmail.com",
"validEmail": "invalid",
"validSyntax": true,
"reason": "email is invalid.",
"domain": {
"name": "gmail.com",
"disposable": false,
"spam": false,
"free": true,
"validDomain": true,
"catchAll": false
},
"account": {
"role": false,
"fullMailBox": false
},
"dns": {
"mxRecord": [
"gmail-smtp-in.l.google.com.",
"alt1.gmail-smtp-in.l.google.com.",
"alt2.gmail-smtp-in.l.google.com.",
"alt3.gmail-smtp-in.l.google.com.",
"alt4.gmail-smtp-in.l.google.com."
]
}
},
{
"success": false,
"email": "test@example.com",
"validEmail": "invalid",
"validSyntax": true,
"reason": "domain does not accept mail.",
"domain": {
"name": "example.com",
"disposable": true,
"spam": false,
"free": false,
"validDomain": true,
"catchAll": false
},
"account": {
"role": false
},
"dns": {
"mxRecord": [
"."
]
}
}
]
}
Frequently Asked Questions
validEmail (valid, accept_all, invalid, unknown, risky, or app_server_blocked), validSyntax, a domain object (disposable, catch-all, free-provider, spam-listed, and DNS validity flags), an account object (role detection, full-mailbox status), and a dns object with the domain's MX and A records. If you include an IP address, the response adds geolocation and security enrichment.valid means the recipient is confirmed deliverable. accept_all means the domain accepts mail for any address, so this specific mailbox was never confirmed - treat it as probably deliverable, not verified. invalid means the address was rejected, failed syntax, or the domain accepts no mail at all - the reason field explains why. unknown means checks were inconclusive, most often for domains with no MX record that only get a probe against their address record. risky means the address may accept mail but deliverability is uncertain, such as a full mailbox or a greylisting deferral. app_server_blocked means the recipient mail server blocked our verification request, so no verdict could be reached for that address.ip field in the request body and the response includes city-level location plus is_tor, is_proxy, proxy_type, is_bot, is_known_attacker, and a numeric threat_score - so one API to verify an email address also screens the connection it came from.format=xml as a query parameter to receive XML. Request bodies are always JSON.Pricing
To use the Email Checker API, you will need API credits. We only charge for successful queries, defined by a 2xx status code. If your request results in a 4xx or 5xx status code, no credits will be charged, and any deducted credits will be returned.
For each successful request, 15 credits are charged.
Utilize the Credits Usage API to efficiently monitor your recent consumption of both one-off and subscription credits. This API provides a streamlined way to track and manage your credit usage, ensuring you stay informed about your remaining balance and can optimize your resource allocation effectively.