Bulk Email Verification API - List Cleaning and Spam Traps

Clean a mailing list before you send to it. Every address is checked at the receiving mail server and comes back with a plain verdict and the exact reason behind it. One flat row per address.

What this actor does

• Verifies the whole list as one job. The list is submitted in a single request and the provider works through it at whatever speed the receiving mail servers allow. That is why a list of ten thousand costs far less time here than ten thousand separate lookups, and why there is no per-address call to make.
• Gives you a verdict and a reason, not one merged score. Every address gets a broad verdict, deliverable, risky, undeliverable or unknown, and a precise status code underneath it. Route on the verdict; diagnose with the status. Forty-two distinct status codes, each its own value and each filterable.
• Separates a bad address from an unanswered one. A server that timed out, grey-listed the check or refused the sender is not the same as a mailbox that does not exist, and those come back as their own status codes rather than as a failure. The run tells you how many, because they are usually good addresses that resolve on a second pass or at a higher quality level.
• Flags spam traps. A honeypot is an address that exists only to catch senders who mail without verifying, and hitting one damages your sending reputation out of all proportion to the single message. It gets its own column and its own filter.
• Separates disposable, role, free mail and catch-all. Four different reasons to be careful, four different decisions, four columns rather than one lumped quality flag.
• Suggests corrections for misspelt addresses. When the provider believes an address is a near miss for a real one, the suggested spelling comes back in its own column. That is the difference between losing a signup to a typo and recovering it.
• Lets you choose how hard to try. Three quality levels, from the everyday setting up to one that keeps retrying the uncooperative mail servers. Higher levels turn timeouts into real verdicts and cost more credits on your own plan, so it is your call rather than a default.
• Filters at the provider, not after the fact. Status filters are sent with the request, so addresses you asked to leave out are never paged over.
• Never submits more than you asked for. This provider charges when a job is submitted rather than when it is read, so the list is trimmed to your result cap before it is sent. The cap limits what you spend on your own plan, not just what you spend here.
• Leaves the job on your account. The results stay readable for free at the provider until their retention period expires, so a second run costs nothing. There is a switch to delete the job immediately when a list is sensitive.
• Never charges for a miss. Only rows carrying a verification result are billed.

Input

Field	What it does
emails	Addresses to verify, one per line.
quality	Standard, High or Extreme effort per address.
deduplication	Off, Safe or Relaxed duplicate detection.
classifications	Keep only deliverable, risky, undeliverable or unknown.
deliverableOnly	Keep only addresses confirmed deliverable.
statuses	Keep only these status codes.
excludeStatuses	Drop these status codes.
excludeDisposable	Drop throw-away addresses.
excludeRoleAccounts	Drop shared mailboxes such as info and sales.
excludeFreeEmail	Drop consumer mail providers.
excludeCatchAll	Drop servers that accept everything.
excludeHoneypots	Drop identified spam traps.
excludeDuplicates	Drop repeats found inside the job.
jobName	A label for the job on your provider account.
retention	How long the provider keeps the job.
deleteJobWhenDone	Delete the job as soon as results are read.
priority	How this job competes with your other jobs.
providerWaitSeconds	How long the provider holds each request open.
jobTimeoutMinutes	Give up waiting after this long.
reportBalance	Log your remaining credits first.
skipNotFound	Leave refused inputs out of the dataset.
maxResults	Cap on rows, and on what the job costs to submit.
username	Your own account user name.
password	Your own account password. Stored as a secret.
apiKey	A bearer token instead, if you already hold one.

Example output

{
  "found": true,
  "query": "j.smith@example.com",
  "email": "j.smith@example.com",
  "classification": "Deliverable",
  "status": "Success",
  "isDeliverable": true,
  "isRisky": false,
  "localPart": "j.smith",
  "domain": "example.com",
  "asciiDomain": "example.com",
  "isDisposable": false,
  "isRoleAccount": false,
  "isFreeEmailAddress": false,
  "isCatchAll": false,
  "isHoneypot": false,
  "isTemporaryFailure": false,
  "hasInternationalMailboxName": false,
  "hasInternationalDomainName": false,
  "syntaxFailureIndex": null,
  "suggestions": [],
  "isDuplicate": false,
  "duplicateOfIndex": null,
  "index": 0,
  "custom": null,
  "completedOn": "2026-08-28T09:14:02.5957669Z",
  "jobId": "18f5a933-af67-421c-b63a-1cbee297fa19",
  "jobQuality": "Standard",
  "jobDeduplication": "Safe",
  "error": null,
  "raw": { }
}

Frequently asked questions

How is this different from a syntax or MX check?

A syntax check tells you the address is well formed. An MX check tells you the domain can receive mail at all. Neither tells you whether that particular mailbox exists, which is the thing that decides whether your message bounces. This verification opens a conversation with the receiving mail server and asks about the specific address. That is why it is slower than a regular expression, and why it is the only check worth running before a send.

What is the difference between the verdict and the status code?

The verdict is the broad grouping: deliverable, risky, undeliverable or unknown. The status code is the precise reason: the mailbox does not exist, the domain has a null MX record, the mail exchanger is a honeypot, the server is catch-all, the address is a duplicate of line 402. There are four verdicts and forty-two status codes. Route your sending on the verdict, because that is the decision. Investigate with the status, because that is the explanation. Both are columns here, and both can be filtered.

What does risky actually mean?

Risky means the address is real enough to accept mail but carries something you should know about before sending. A catch-all server that will accept anything and tell you nothing. A disposable address that will be gone next week. A parked mail exchanger. A server that does not allow multiple recipients and therefore cannot confirm the individual mailbox. These are genuinely different situations, which is why the status code matters more than the verdict here than anywhere else.

Why did some addresses come back unknown?

Because the answer could not be reached, not because it was negative. A DNS query timed out, the mail server was temporarily unavailable, the mailbox check timed out, the receiving server grey-listed the attempt. Grey-listing in particular is a spam defence that refuses a first contact from an unfamiliar sender and accepts the retry, so it is a statement about the check rather than about the address. Treating unknowns as bad is one of the most common ways to throw away good subscribers. Run them again, or run them at a higher quality level, which exists precisely for this.

What do the quality levels change?

How long the provider persists with a mail server that will not give a straight answer. Standard is the everyday setting and resolves the large majority of addresses. High and Extreme retry the awkward cases for longer, which converts some timeouts and grey-listing into real verdicts. Higher levels consume more credits per address on your own plan, so the choice is exposed rather than made for you. A sensible pattern is to run the whole list at Standard and re-run only the unknowns at High.

What is a spam trap and why does it get its own column?

A honeypot, or spam trap, is an address that exists for the sole purpose of catching senders who mail without permission or without verifying. Some are addresses that were abandoned and later recycled as traps; others were never real people. Sending to one can affect your standing with the major mailbox providers far out of proportion to a single message, which is why it is its own flag here rather than being folded into a general risk score.

Should I drop catch-all domains?

It depends on how much bounce risk you can carry. A catch-all server accepts mail addressed to every possible mailbox, so it cannot tell you whether one particular address is real. The result is neither a pass nor a fail. Plenty of legitimate business domains are configured this way, so dropping them all removes real people along with the risk. The flag and the filter are both here so that you decide.

How does duplicate detection work?

Turn it on and the provider marks repeats inside the job rather than silently collapsing them. Safe only marks addresses that are certainly the same mailbox. Relaxed also treats provider-specific aliases, such as dots and plus tags on modern mail services, as the same person, which catches the duplicates a plain text comparison misses. Either way a duplicate still comes back as a row, flagged, with the index of the line it repeats, so you can see what was merged instead of guessing.

Why does the result cap also limit what I spend at the provider?

Because this provider bills when a job is submitted, not when the results are read. Submitting a thousand addresses to return a hundred would spend your credits on nine hundred rows you never see. So the address list is trimmed to the result cap before it is sent, and the run says how many were left out. Raise the cap to include them.

What happens to my list after the run?

The job stays on your own provider account until its retention period expires, and its results can be read again for free while it does. That is usually what you want. Set a retention period in the input to shorten it, or turn on the delete switch to have the job and the addresses in it removed as soon as this run has read them.

Do I need my own API key?

Yes. This actor does not include data access. You use your own account with Verifalia, the provider whose email verification API this actor calls, and supply either the account user name and password or a bearer token you already hold. They are stored as Apify secrets. Use a dedicated user rather than the account administrator and grant it only the email verification permissions, so a leaked credential costs as little as possible. Your own plan, allowance and terms apply.

Why would a correct password still be refused?

This provider lets an account restrict which network addresses may use it, and a request from outside that list is refused in exactly the same way as a wrong password. If the credential works from your own machine but not here, check the account firewall rules before you go looking for a typo. The run says so in its error message for that reason.

How much does a run cost?

Pricing is pay per result: you are charged for each address verified into the dataset, and never for inputs refused before submission, for rows dropped by the filters, or for repeated lines in your own input. Apify platform usage is included in the per-result price. Your own provider credits are separate and billed by them.

Keyword map

bulk email verification API, email validation API, mailing list cleaning, email list hygiene, mailbox verification, SMTP verification, bounce rate reduction, deliverability check, spam trap detection, honeypot detection, disposable email detection, DEA detection, throwaway address check, catch all server detection, role account detection, free mail detection, duplicate email detection, email typo correction, did you mean email, sender reputation protection, list scrubbing API, email hygiene automation, cold email list cleaning, newsletter list cleaning, signup form validation