Email Verifier — Bulk Verification with Catch-All Detection

What does Email Verifier do?

Paste a list of email addresses and get back, for each one, whether it is deliverable, risky, undeliverable or unknown, a 0–100 deliverability score, and the exact reasons. It runs syntax, disposable-domain and role-address checks, resolves MX/SPF/DMARC, then opens a real SMTP conversation with the mail server to ask whether the mailbox exists — and probes a random address on the same domain so a catch-all server (which says "yes" to everything) is never reported as a verified mailbox. No email is ever sent.

Between 15 % and 28 % of B2B domains are catch-all. Verifiers that stop at "the server accepted it" mark those as valid and you bounce anyway. This one tells you.

What you get per address

Field	Meaning
status	deliverable · risky · undeliverable · unknown
deliverabilityScore	0–100
safeToSend	true only for deliverable
reasons[]	e.g. smtp-accepted, catch-all-domain, smtp-rejected-550, role-address, disposable-domain, no-mx-record, greylisted-451, gateway-proofpoint-accepts-all
catchAll	domain accepts any local part
isRoleAddress, isFreeProvider, isDisposable	list-hygiene flags
mailProvider, mxHosts, spf, dmarc, dmarcPolicy	domain intel
smtpCode, smtpReason, smtpTls	raw server reply for auditing

How to use it

1. Paste emails (one per line) or send emails[] via API.
2. For mailbox-level verdicts (deliverable / catch-all / rejected), set SMTP probe endpoint — see below. Without it the run is DNS-only: syntax, disposable, role, MX/SPF/DMARC; mailbox-level results come back unknown and are not charged.
3. Filter the dataset on safeToSend = true for your send list; keep risky for a second-pass tool or manual review.

Why a probe endpoint?

Apify (like every cloud sandbox) blocks outbound port 25, so no Actor can talk SMTP directly — any verifier on the Store that claims mailbox-level checks is relaying through a server somewhere. We make that explicit: you run a 30-line probe service on any VPS with port 25 open and paste its URL. Your list never leaves your own infrastructure for the SMTP step, and you're not paying a middleman per probe.

// probe-server/server.mjs  —  PROBE_TOKEN=change-me PORT=8080 node server.mjs   (put HTTPS in front)
import http from 'node:http';
import { smtpProbe } from './smtp.js';           // same probe code this Actor uses
const TOKEN = process.env.PROBE_TOKEN;
http.createServer(async (req, res) => {
  if (req.method !== 'POST' || (TOKEN && req.headers.authorization !== `Bearer ${TOKEN}`)) return res.writeHead(401).end();
  let b = ''; for await (const c of req) b += c;
  const { email, mxHost, timeoutMs, heloDomain, fromAddress } = JSON.parse(b);
  res.writeHead(200, { 'content-type': 'application/json' })
     .end(JSON.stringify(await smtpProbe({ email, mxHost, timeoutMs, heloDomain, fromAddress })));
}).listen(process.env.PORT ?? 8080);

The full smtp.js (EHLO → STARTTLS → MAIL FROM → RCPT TO → random-address catch-all check, never DATA) ships in this Actor's source. Hetzner, OVH and Vultr open port 25 on request; a $4/month box handles ~50k probes/day.

How much does it cost?

Event	Price
verified-email — any address with a definitive verdict (deliverable, risky, undeliverable)	$0.0006 ($0.60 per 1,000)
unknown (mail server unreachable or refused to answer)	free
Actor start	$0.00005

1,000 addresses ≈ $0.60. Set Maximum cost per run to cap spend.

Sample output

{ "email": "jane.doe@apify.com", "status": "deliverable", "deliverabilityScore": 95, "safeToSend": true,
  "reasons": ["smtp-accepted"], "catchAll": false, "isRoleAddress": false, "isFreeProvider": false, "isDisposable": false,
  "mailProvider": "Google Workspace", "mxHosts": ["aspmx.l.google.com"], "spf": true, "dmarc": true, "dmarcPolicy": "reject",
  "smtpChecked": true, "smtpStatus": "deliverable", "smtpCode": 250, "smtpTls": true, "checkedAt": "2026-09-25T04:50:00.000Z" }

FAQ

Why "risky" instead of a yes/no? Catch-all domains, greylisting (451/450 "try later") and security gateways like Proofpoint or Mimecast — which accept every RCPT and filter later — cannot be resolved by any SMTP verifier. We say so rather than guess, and don't charge for unknown.

Does it send anything? No. The conversation stops after RCPT TO; DATA is never issued.

Is it GDPR-safe? It processes only the addresses you already hold and stores nothing beyond your run's dataset.

Can I pair it with enrichment? Yes — run Reverse Email Lookup — Email to Name, LinkedIn & Company by the same author on the deliverable rows to get the person and company behind each address.

---

Built by Creator Fusion LLC.