Email Verifier

A confidence score, not a lie dressed up as a checkmark.

What this actor CAN prove

• Syntax — RFC-ish local/domain validation: length limits (64/253/254), illegal characters, quoted local parts ("john doe"@example.com), internationalised domains (café.fr -> xn--caf-dma.fr, via Node's own IDNA implementation).
• Normalisation — Gmail dot-insensitivity and +tag stripping, the googlemail.com alias, generic +tag handling for any provider (via the shared normalizeEmail engine).
• Typo detection — edit distance against ~70 popular providers, so user@gmial.com gets suggested gmail.com and user@hotmial.com gets hotmail.com.
• Disposable/temporary domains — matched against a bundled, offline list of 400+ known throwaway-email providers (mailinator, guerrillamail, yopmail, 10minutemail and their many mirror domains), including subdomains.
• Role/generic accounts — info@, sales@, admin@, support@, noreply@ and ~75 other non-personal local parts.
• Free vs. corporate domain — a heuristic against a bundled list of well-known free webmail providers, not a directory lookup.
• DNS deliverability — a live MX lookup over DNS-over-HTTPS (Cloudflare's resolver), falling back to an A record per the RFC 5321 implicit-MX rule. No MX and no A means the domain cannot receive mail at all — the single strongest "invalid" signal this actor has.

What this actor CANNOT prove — and says so

Mailbox existence. The only way to know whether jane.doe@acme.com is a real, active inbox is an SMTP RCPT TO handshake on port 25. Apify, like almost every cloud host, blocks outbound port 25 to fight spam abuse. So this actor never attempts it, and every single result carries mailboxVerified: false with a mailboxVerifiedReason explaining exactly why. Any tool that answers "valid ✅" without that caveat is either guessing or lying about what it checked — the honesty is the whole point of this actor.

Catch-all domains. Telling "accepts everything" apart from "accepts this one address" also needs an SMTP probe. Stage 8 reports catchAll.status: "unknown" with the reason, rather than fabricating a guess.

How the confidence score works

Each stage adds or subtracts evidence-weighted points from a neutral baseline (syntax validity, typo suspicion, disposable/role/domain-type, MX reachability, plus small fixed penalties for the two things that can never be resolved: catch-all and mailbox existence). The result is clamped 0-100 and capped below 100 — a perfect score is never awarded, because two things are always unverifiable. The verdict (valid / risky / invalid / unknown) and the full signals array — every contributing factor with its weight and a human-readable reason — are both returned, so nothing about the score is a black box.

Input

{
  "emails": ["jane.doe@gmail.com", "sales@acme-corp.com", "user@gmial.com", "x@mailinator.com"],
  "checkDns": true,
  "checkTypos": true,
  "maxItems": 0
}

Also accepts sourceDatasetIds, objects with an email field (configurable via emailField), customDisposableDomains, customRoleLocalParts, onlyFlagged (skip valid rows in the dataset), and DNS concurrency/dnsTimeoutMs.

Output (per address)

email, normalizedEmail, domain, syntax, typoCheck, disposable, role, domainType, dns, catchAll, mailboxVerified, mailboxVerifiedReason, verdict, confidence, signals.

Honest limitations

• Disposable and popular-provider lists are curated snapshots, not a live feed — brand new burner domains won't be caught until the list is refreshed.
• Free-vs-corporate is a list lookup, not a WHOIS/registry classification.
• DNS checks depend on Cloudflare's DoH resolver being reachable from the run; if it isn't, the verdict becomes unknown rather than a guessed valid.
• Nothing here, ever, confirms a mailbox actually exists.