Email Verifier — Bulk SMTP & MX Validation, Catch-all Detection

Verify email deliverability in bulk without ever sending a single message. Feed it a list of email addresses and get back a score, status, and detailed flags for each one — whether you're cleaning a B2B lead list, validating a signup form, or scrubbing a cold-outreach database before you burn your sender reputation.

What it does

The actor runs each email through six verification layers in sequence:

Layer 1 — Syntax

Validates the address against a strict RFC-compliant regex. Catches typos, missing @ signs, double-dots, overly long local-parts, and other malformed addresses before any network round-trip. Invalid syntax → undeliverable immediately.

Layer 2 — Disposable domain detection

Checks the email's domain against a bundled blocklist of ~300 known temporary/throwaway mail providers: Mailinator, YOPmail, Guerrilla Mail, 10MinuteMail, Trashmail, and hundreds more. Disposable emails are flagged with is_disposable: true. They may still be syntactically valid and even have MX records — you decide whether to reject them.

Layer 3 — Role account detection

Identifies generic role-based addresses that are unlikely to belong to an individual: info@, support@, admin@, noreply@, sales@, webmaster@, postmaster@, abuse@, and ~40 more patterns. Role accounts are flagged is_role: true. They deliver mail (often to a shared inbox), but bounce rates and engagement are typically low — useful signal for lead scoring.

Layer 4 — MX lookup (DNS)

Queries the domain's DNS for MX records via dnspython. If no MX record exists, falls back to an A-record check (some small domains skip MX). No MX + no A record → domain can't receive mail → undeliverable. The highest-priority MX host is returned in mx_host.

Layer 5 — SMTP probe (no mail sent)

Connects to the top MX host on port 25 and runs:

HELO verify.example.com
MAIL FROM: <verify@verify.example.com>
RCPT TO: <the-email-being-checked>

The connection is closed immediately after reading the response code — no DATA command, no message ever delivered. Response codes:

• 250 → mail server accepts the address → deliverable
• 5xx → permanent rejection → undeliverable
• 4xx → temporary failure / greylisting → risky

Layer 6 — Catch-all detection

After a 250 response, the actor sends a second RCPT to a randomly-generated non-existent address on the same domain (e.g. xk7m2q9r4j@domain.com). If that is also accepted, the domain is a catch-all — it accepts mail for any local-part regardless of whether the mailbox exists. Catch-all addresses get is_catch_all: true and status: risky because we can't confirm the specific mailbox exists.

---

Output fields

Field	Type	Description
email	string	Normalized (lowercased) email address
status	string	deliverable / undeliverable / risky / unknown
score	integer	Deliverability confidence 0–100
syntax_valid	boolean	Passes RFC syntax check
is_disposable	boolean	Known throwaway/temp-mail domain
is_role	boolean	Generic role address (info@, support@, …)
mx_found	boolean	Domain has a working mail server
mx_host	string	Highest-priority MX hostname
smtp_code	integer	Raw SMTP response code (null if unreachable)
smtp_message	string	Raw SMTP response message
is_catch_all	boolean	Domain accepts mail for any address (null = unknown)
checked_at	string	ISO 8601 UTC timestamp

Status values

• deliverable — syntax OK, MX found, SMTP accepted the address, domain is not catch-all
• undeliverable — syntax invalid, no MX record, or SMTP permanently rejected the address
• risky — domain is catch-all (can't confirm the specific mailbox) OR SMTP returned 4xx (greylisting)
• unknown — SMTP unreachable (port-25 blocked or timeout) and domain is not a known big provider

Score (0–100)

Score	Meaning
100	SMTP 250 + not catch-all → high confidence deliverable
80	Known provider (Gmail/Outlook/…), MX found, port-25 unreachable → heuristic
60	MX found, SMTP unreachable, unknown domain → can't confirm
35–40	Catch-all or greylisting → deliverable but risky
0	Syntax fail, no MX, or hard SMTP rejection

---

Port-25 limitation (important)

Many cloud providers (AWS, GCP, Azure) block outbound TCP port 25 by default. Apify's cloud infrastructure may or may not have port-25 open depending on the instance type and region.

When port-25 is blocked, the actor handles it gracefully:

1. The SMTP probe returns smtp_code: null and marks the connection as unreachable
2. For well-known providers (Gmail, Outlook, Yahoo, iCloud, Proton, etc.) the actor falls back to a heuristic: if MX exists, status = deliverable at score 80
3. For all other domains: status = unknown at score 60
4. You can use skipSmtp: true to skip SMTP entirely and run MX-only mode

The syntax, disposable, role, and MX layers work correctly regardless of port-25 access. On Apify infrastructure, port-25 availability may vary — test with skipSmtp: false first; if you see many unknown results, the port is likely blocked on that instance.

---

Accuracy notes

• B2B domains: SMTP probes work well; most corporate mail servers respond reliably
• Gmail / Microsoft 365: Block SMTP probes from cloud IPs. The heuristic gives score 80
• Catch-all domains: Common in B2B (many companies accept all mail). risky is correct — the address format is valid but the mailbox may not exist
• Greylisting: Some servers return 451 on first contact and accept on retry. The actor marks these risky (score 35); re-verify later or send anyway and watch bounce rates
• False negatives: SMTP probing is not 100% reliable. Servers that accept 250 may still bounce silently later. Combined with catch-all detection this is rare but possible
• Rate limits: Running at high concurrency against one domain may trigger rate-limiting. The default concurrency of 10 is conservative; reduce if you see many risky 4xx responses

---

Pricing

Pay-per-result: charged once per verified email (email-verification event). You are only charged for emails that complete the verification pipeline — not for errors.

---

Example input

{
  "emails": [
    "cto@openai.com",
    "noreply@github.com",
    "throwaway@mailinator.com",
    "test@nonexistent-xyz-domain.com",
    "info@stripe.com"
  ],
  "concurrency": 10,
  "smtpTimeoutSecs": 10,
  "skipSmtp": false
}

Also accepts objects with an email key — useful when piping from a lead-gen actor:

{
  "emails": [
    {"email": "cto@openai.com", "name": "Sam Altman"},
    {"email": "info@stripe.com", "company": "Stripe"}
  ]
}

Usage statistics

This Actor creates a small, content-free summary at the end of each run. It is used only to monitor reliability and improve this Actor. A copy is saved as USAGE_STATS in your own Apify key-value store, so you can see the exact record created for your run.

Set disableUsageStats to true in the input to opt out. Nothing is sent then; your USAGE_STATS record only says that statistics were disabled.

Only these fields are recorded:

• schema version, Actor name and build number;
• UTC start and finish hour (not a precise timestamp);
• run duration, number of results and time to the first result, each as a coarse range;
• whether the result was empty, the end status, and an error type from a fixed list;
• memory setting and counts of charged events;
• names of the input fields you set, never their values;
• the selected option for input fields that offer a fixed list of choices (for example a sort order).

We do not collect input text, search terms, URLs, domains, usernames, email addresses, names, proxy credentials, tokens, scraped records, output items, raw error messages, stack traces, or hashes of any of those values. Records are kept for no longer than 13 months, used only as aggregated operational statistics, and never sold or shared.

Additional fields (Phase 2)

This Actor also records your Apify user ID, whether Apify marks the account as paying, the size range of list inputs, the selected country when the input offers a fixed list of countries, and one category from a fixed Actor taxonomy. We use these fields only for aggregate reliability, repeat-use and cross-Actor analysis; reports suppress any cell with fewer than five distinct users.

The same disableUsageStats: true input flag turns these fields off too. The user ID is removed after 13 months; we do not export, sell, share, or attempt to re-identify this data.

Run-outcome signals (v2)

To learn whether a run did what it was asked to do, the record also holds a few more coarse ranges and yes/no flags. None of them contains content:

• the result limit you asked for (a range, when the input has one) and what share of it was delivered;
• results delivered per input item you listed (a range);
• output quality as ranges: how fully the result fields were filled, the share of rows that look like errors, the share of duplicate rows, and how many different fields appeared. These are counted in memory while results are saved; no result content is kept;
• how the run was started (console, API, schedule, webhook, another Actor);
• how it ended: stopped by you, timed out, reached the requested limit, stopped by the charge limit, and how many times the platform moved the run;
• if this Actor reports it: how many items to process worked or failed (ranges) and one failure reason from a fixed list;
• a short code made from the names of the input fields you set, never their values.

Repeat-run fingerprint (v2)

When your Apify user ID is recorded (see above), the record also holds an 8-character one-way code made from your input (proxy settings left out) and this Actor's name. It only lets us see that the same account ran the same input again soon after an unsatisfying run; we never see the input itself. It is stored only in the database, never published, and reports use it in aggregate with the same five-user minimum. It is the one exception to the statement above that no hashes are collected, and disableUsageStats: true turns it off.