Email Verifier - Verify Email Address, MX and Disposable Check

This email verifier checks email addresses and domains for a working mail server, disposable or temporary email providers, SPF and DMARC policy, and returns a transparent 0–100 risk score per lookup. Use it to verify an email address before you import a lead list, accept a sign-up or send a campaign. Supply a list of addresses, a list of domains, or both; the actor returns one result for each unique valid input, in the original order, with a combined maximum of ten lookups per run.

The checks describe the domain behind an address. They help identify missing mail servers and temporary email services before importing a contact list or reviewing registrations. A positive domain result does not prove that a particular mailbox exists. The actor does not make an SMTP connection and does not send email to the supplied addresses, so verifying an address never alerts its owner.

What the email verifier checks

Check	Field	What it tells you
Mail server (MX)	valid_mail_server, mail_servers	Whether the domain can receive email at all, and which servers handle it
Disposable provider	disposable, is_disposable	Whether the domain is a temporary or throwaway email service
SPF policy	spf_strict	Whether the domain publishes a strict sender policy
DMARC policy	dmarc_enforced	Whether the domain rejects or quarantines spoofed mail
Provider	email_provider, free_provider, is_free_provider	The mail provider and whether it is a free mailbox service, when established
Verdict	status, risk_score	A summary label and a 0–100 score, lower is better

How to verify email addresses

1. Open the actor and add one address per line under Email Addresses, or one domain per line under Domains.
2. Start the run. A full run of ten lookups normally finishes in well under a minute.
3. Download the dataset as JSON, CSV or Excel, or read it through the Apify API, and filter on status or risk_score.

Email Verifier input

emails is an optional array of strings containing the addresses to check. domains is an optional array of strings containing domain names. Each list accepts at most ten values; the combined list is capped at ten after normalization and deduplication. Neither field has a default. The form's prefilled address is an example, so a run with empty input does not automatically check it.

Field	Type	Required	Default	Description
emails	array of strings	No	none	Email addresses to verify, at most 10
domains	array of strings	No	none	Domains to verify, at most 10

Addresses are trimmed and converted to lowercase. Domain inputs are also trimmed and converted to lowercase; a leading http:// or https:// and trailing slashes are removed. A www. prefix remains part of the domain. A URL with a path is skipped rather than treated as its root domain. Duplicate normalized values are checked once. Invalid strings among valid values are skipped. Results for addresses appear first, followed by results for domains, maintaining order within each list.

This input comes from an actual successful run:

{
  "emails": [
    "  Info@Coolblue.NL ",
    "info@coolblue.nl",
    "user@mailinator.com",
    "test@spamok.nl",
    "not-an-email",
    "x@yopmail.com",
    "hello@protonmail.com",
    "a@outlook.com"
  ],
  "domains": [
    "https://zalando.de/",
    "guerrillamail.com",
    "apple.com",
    "nu.nl",
    "bad domain",
    "gmail.com"
  ]
}

If no valid address or domain remains, the run finishes without dataset rows and reports No valid email addresses or domains provided. Invalid list types or oversized lists are rejected as invalid input. Non-paying users receive at most ten rows, matching the actor's existing cap.

Output

Every completed lookup returns success, either email or domain, status, risk_score, and the verification signals. Each row also carries source, fetched_at and lookup_type so records can be identified and joined, next to the existing fields. Successful address records additionally expose is_disposable and, when positively established, is_free_provider alongside their original field names.

The following row was obtained on 2 October 2026 from the input above. Its timing and DNS records are observations from that run and may vary later:

{
  "success": true,
  "email": "info@coolblue.nl",
  "lookup_type": "email",
  "source": "email-verifier",
  "fetched_at": "2026-10-02T11:47:09.961Z",
  "status": "safe",
  "deliverable": null,
  "valid_mail_server": true,
  "catch_all": null,
  "disposable": false,
  "privacy_alias": null,
  "email_forwarder": false,
  "sources_checked": [
    "dns",
    "blocklist",
    "check-mail"
  ],
  "risk_score": 0,
  "processing_time_seconds": 18.92,
  "mail_servers": [
    {
      "hostname": "aspmx.l.google.com",
      "priority": 1
    },
    {
      "hostname": "alt1.aspmx.l.google.com",
      "priority": 5
    },
    {
      "hostname": "alt2.aspmx.l.google.com",
      "priority": 5
    },
    {
      "hostname": "alt3.aspmx.l.google.com",
      "priority": 10
    },
    {
      "hostname": "alt4.aspmx.l.google.com",
      "priority": 10
    }
  ],
  "spf_strict": true,
  "dmarc_enforced": true,
  "email_provider": "Google Workspace",
  "is_disposable": false
}

A disposable address from the same run looks like this. The domain receives mail, but the disposable signal raises the score to 60:

{
  "success": true,
  "email": "user@mailinator.com",
  "lookup_type": "email",
  "source": "email-verifier",
  "fetched_at": "2026-10-02T11:47:09.961Z",
  "status": "risky",
  "deliverable": null,
  "valid_mail_server": true,
  "catch_all": null,
  "disposable": true,
  "privacy_alias": null,
  "email_forwarder": false,
  "sources_checked": [
    "dns",
    "blocklist",
    "check-mail"
  ],
  "risk_score": 60,
  "processing_time_seconds": 18.92,
  "mail_servers": [
    {
      "hostname": "mail.mailinator.com",
      "priority": 1
    },
    {
      "hostname": "mail2.mailinator.com",
      "priority": 1
    }
  ],
  "spf_strict": true,
  "dmarc_enforced": true,
  "is_disposable": true
}

Output fields

Field	Type	When present
success	boolean	always
email / domain	string	the input that was checked
lookup_type, source, fetched_at	string	always
status	string	successful rows: safe, risky, unsafe, invalid or unknown
risk_score	integer	successful rows, 0–100
valid_mail_server	boolean or null	successful rows
disposable, is_disposable	boolean	successful rows
deliverable, catch_all, privacy_alias	boolean or null	successful rows, normally null
email_forwarder	boolean or null	successful rows
sources_checked	array of strings	successful rows
mail_servers	array of {hostname, priority}	when MX hostnames exist
spf_strict, dmarc_enforced, free_provider, is_free_provider	boolean	only when true
email_provider	string	when the provider is identified
processing_time_seconds	number	successful rows
reputation, server_locations, suspicious, credentials_leaked, data_breach, spoofable, domain_age_days, references	various	historical optional fields; kept for compatibility, currently not filled
error	string	only when success is false

valid_mail_server is true when the domain publishes MX records or an implicit A mail server, false for an authoritative negative result, and null when the check could not be completed. An explicit null MX means the domain does not accept mail. This fixes an earlier version that incorrectly treated such a domain as valid by using its A record.

disposable indicates whether the domain appears in either of two public disposable-domain lists or is positively classified as disposable by an additional domain check. A subdomain also inherits a matching parent-domain entry. A negative list match alone cannot override a positive disposable classification. sources_checked shows which checks actually answered.

mail_servers, when available, contains hostnames and numeric priorities, ordered by priority. spf_strict appears only when strict SPF is found. dmarc_enforced appears only when the domain publishes a reject or quarantine policy. free_provider appears only when positively established. Provider names and email-forwarder flags are included when the source actually reports them.

deliverable, catch_all and privacy_alias normally remain null because the active sources do not establish mailbox delivery, catch-all acceptance or privacy aliases. The actor does not provide data-breach or leaked-credential checks. Historical optional fields remain compatible, but an absent field does not mean a negative finding.

Status and risk score

The score starts at 20. A working mail server subtracts 15; a confirmed missing server adds 60. A disposable domain adds 65. Strict SPF and enforcing DMARC each subtract 5. A confirmed catch-all adds 15. The result is bounded to 0–100.

A missing mail server gives invalid, and an unavailable server lookup gives unknown. Otherwise scores up to 25 are safe, scores 26–60 are risky, and higher scores are unsafe. These labels summarize the established domain signals, rather than promising delivery to the mailbox. A disposable provider with strict SPF and DMARC may score 60 and therefore be risky; that behavior is retained.

Use cases

• Lead list hygiene. Remove addresses on domains without a mail server before importing them into a CRM or a cold email tool, so bounces do not hurt your sender reputation.
• Sign-up screening. Flag registrations from disposable or temporary email providers before granting a free trial, a coupon or a download.
• Form and API validation. Call the actor from your backend or an automation tool to verify an email address at the moment it is entered.
• Domain due diligence. Check whether a partner or supplier domain receives mail and publishes strict SPF and DMARC before you rely on it.

Email verifier compared with other options

Option	What it checks	Notes
This email verifier	MX, disposable lists, SPF, DMARC, provider, risk score	No SMTP connection, so no mailbox-level answer; nothing is sent to the address
Syntax check or regex	Address format only	Does not know whether the domain accepts mail
SMTP mailbox verification services	Mailbox existence, catch-all	Contacts the mail server; results vary per provider and often need a paid plan
Sending a confirmation email	Real delivery and ownership	The most certain, but slow and only works after the user has signed up

Use this actor as a fast, low-cost first filter. Where you need proof that a specific mailbox exists, combine it with a confirmation email.

Pricing

The Store lists a pay-per-event price of $0.002 for the email event. The current version does not charge that event, just like the versions before it: you pay only the Apify platform usage of the run, according to your plan. No start event or dataset-item charge is added. An empty result never triggers a verification charge. Any future change to this pricing would be announced on the Store page first.

Partial results and source failures

A domain that does not exist still produces a successful lookup row with a negative verdict. It is different from a source failure. If every verification source is unavailable, the lookup produces a row with success: false and error: "No verification source could be reached". Other lookup rows can still succeed. Run output reports partial and warnings when a source or requested check could not be completed, including a reached time or request budget. Do not interpret an unavailable DNS check as proof that a domain cannot receive mail.

FAQ

Does a safe result prove that the mailbox exists?

No. The actor checks domain-level signals without contacting the mailbox by SMTP. A safe domain can contain a nonexistent address. Keep the null delivery signal as unknown rather than replacing it with true in your integration.

Can I verify an email address without sending an email?

Yes. That is exactly how this email verifier works: it reads public DNS records and disposable-domain lists and never sends a message or opens a mail session, so the owner of the address is not notified.

Can I supply both addresses and domains?

Yes. Both optional arrays remain supported. They are normalized, deduplicated and capped at ten combined lookups. Address rows come first. Repeating a domain as an address and a domain input can produce two different rows, because they are distinct input values.

How do I verify a larger list?

Split the list into batches of ten and start one run per batch, for example from the Apify API, a schedule or an integration. Each run returns its rows in the same order as its input.

Why is an email's status unknown?

The mail-server check could not be completed. Other available checks may still identify disposable or provider signals. Consult sources_checked, run warnings and the nullable fields before deciding whether to retry.

Why does example.com return invalid?

The domain publishes an explicit null MX, which means it does not accept email. The older version's A-record fallback masked that declaration. The corrected result preserves the old field names and JSON types while reporting the actual DNS meaning.

Does the actor check data breaches or leaked passwords?

No. The fields data_breach and credentials_leaked are kept for compatibility with older integrations, but no source fills them. Use a dedicated breach-lookup service for that question.