Bulk Email Verifier — MX, SPF, DMARC and disposable-domain checks, without sending a thing

You have a list of email addresses and no idea how many of them will bounce. Some are typos. Some are mailinator.com throwaways someone used to get past a signup form. Some point at domains that were sold, parked or shut down two years ago. Send to that list and you burn your sender reputation on the first campaign.

This Actor takes the list and returns one clean row per address — MX records, mailbox provider, SPF and DMARC policy, disposable/role/free-provider flags, a typo correction, and a 0–100 score — using only DNS lookups and offline rules.

sales@stripe.com        ─┐                    ┌─ status: risky   (role address)
paul@personio.de        ─┼──►  one row each ──┼─ status: accepts_mail, score 100, Google Workspace
someone@gmial.com       ─┼──►                 ├─ status: risky   → did you mean someone@gmail.com
test@mailinator.com     ─┘                    └─ status: invalid (disposable)

Bulk email verifier that never opens an SMTP connection

Most email verifiers work by opening an SMTP session to the recipient's mail server and issuing RCPT TO without ever sending the message. It is the only way to test whether a specific mailbox exists — and it comes with real costs that are rarely mentioned on the tin:

• Large providers (Google, Microsoft) answer 250 OK for every address, so the result is meaningless on the domains most of your list uses.
• Greylisting and rate limiting produce false "invalid" verdicts on perfectly good addresses.
• The probing IP accumulates a reputation. On a shared cloud platform, that reputation is not yours alone.

This Actor deliberately does none of that. Every check here is a DNS query or a rule applied offline. Nothing connects to a mail server, so running it cannot get an IP blocklisted and cannot damage your sending reputation. What it gives you in exchange is the part of list hygiene that is both reliable and where most of the bounces actually come from: domains that cannot receive mail at all, throwaway providers, role inboxes, and typos.

isCatchAllUnknown is true on every row, permanently, as a standing reminder of the boundary: this Actor never claims a specific mailbox exists.

What it checks

Check	Field	How
Syntax	isValidSyntax, syntaxError	Practical RFC 5322 subset — deliberately stricter than the RFC, because quoted local parts and IP-literal domains never appear in real CRM data
Domain exists	domainExists	NXDOMAIN detection
Can receive mail	hasMxRecord, mxHosts, mxCount, nullMx	MX lookup, including RFC 7505 null-MX ("this domain accepts no mail")
Mailbox provider	mailProvider	45+ MX fingerprints: Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, Mimecast, Proofpoint, Barracuda, IONOS, OVH, Rackspace, Amazon SES, Migadu, Cloudflare Email Routing and more
Disposable	isDisposable	180+ throwaway providers — Mailinator, Guerrilla Mail, 10minutemail, YOPmail, temp-mail, Trashmail …
Role address	isRoleAddress	90+ shared-inbox local parts — info@, sales@, support@, noreply@, hr@ …
Free consumer mailbox	isFreeProvider	130+ consumer domains, so you can tell a company contact from a personal Gmail
Typo	suggestedCorrection, suggestedEmail	Damerau-Levenshtein against the domains typos actually land next to (gmial.com → gmail.com)
SPF	hasSpfRecord, spfRecord, spfPolicy	TXT lookup, plus the qualifier on the all mechanism
DMARC	hasDmarcRecord, dmarcRecord, dmarcPolicy	_dmarc TXT lookup, plus the p= value
MTA-STS	hasMtaSts	_mta-sts TXT lookup

DNS results are cached per domain, so a 10,000-row list of 400 companies costs 400 domains' worth of lookups, not 10,000.

Input

{
  "emails": [
    "sales@stripe.com",
    "info@apify.com",
    "someone@gmial.com",
    "test@mailinator.com",
    "hello@this-domain-does-not-exist-9x8y7z.com"
  ],
  "domains": ["nvidia.com"],
  "checkSpfDmarc": true,
  "treatDisposableAsInvalid": true,
  "treatRoleAddressAsRisky": true,
  "deduplicate": true,
  "onlyStatuses": [],
  "concurrency": 10,
  "dnsTimeoutSeconds": 5,
  "dnsResolvers": ["1.1.1.1", "8.8.8.8", "9.9.9.9"]
}

domains is for when you want a domain's mail setup without a specific mailbox — the row comes back with email: null and every DNS field filled in.

Output

{
  "input": "someone@gmial.com",
  "email": "someone@gmial.com",
  "localPart": "someone",
  "domain": "gmial.com",
  "status": "risky",
  "score": 30,
  "reasons": [
    "no MX record; mail would fall back to the A record, which often fails",
    "looks like a typo for gmail.com",
    "domain publishes no DMARC record"
  ],
  "isValidSyntax": true,
  "syntaxError": null,
  "isDisposable": false,
  "isRoleAddress": false,
  "isFreeProvider": false,
  "isCatchAllUnknown": true,
  "suggestedCorrection": "gmail.com",
  "suggestedEmail": "someone@gmail.com",
  "domainExists": true,
  "domainResolves": true,
  "hasMxRecord": false,
  "mxHosts": [],
  "mxCount": 0,
  "mailProvider": null,
  "nullMx": false,
  "aRecords": ["51.79.68.169"],
  "hasSpfRecord": false,
  "spfRecord": null,
  "spfPolicy": null,
  "hasDmarcRecord": false,
  "dmarcRecord": null,
  "dmarcPolicy": null,
  "hasMtaSts": false,
  "dnsError": null,
  "checkedAt": "2026-09-10T17:12:05.740860+00:00"
}

What the four statuses mean

status	Meaning	What to do
accepts_mail	The domain has valid MX and no risk flags. Mail will reach the server.	Send. The mailbox itself is unverified — see the limitations below.
risky	Deliverable in principle, but flagged: a role inbox, a free consumer mailbox, a probable typo, or a domain with no MX at all.	Review. reasons says exactly which.
invalid	Syntax failure, NXDOMAIN, a null MX, or a disposable provider.	Remove from the list.
unknown	DNS timed out or returned SERVFAIL.	Re-run. A DNS failure never produces a false invalid.

Honest limitations

• Mailbox existence is not checked. jane.doe@stripe.com and zzzz@stripe.com both come back accepts_mail, because both would be accepted by the same MX hosts. If you need per-mailbox verification, this Actor is the wrong tool and says so rather than guessing.
• Catch-all detection is impossible here for the same reason. isCatchAllUnknown is always true.
• The disposable list is a snapshot, not a live feed. New throwaway domains appear constantly; 180+ of the most common ones are covered.
• isFreeProvider is not a quality judgement. Plenty of real sole traders run their business on Gmail. It is there so you can segment, not so you can delete.
• Typo correction is conservative. It only fires within two edits of a domain that typos genuinely land near, and never on domains shorter than six characters, where a one-character difference is usually a different company rather than a mistake.

Works with

• Website Tech Stack & Email Finder — finds the addresses on a company's own site. Feed its emails array straight into this Actor's emails input and you have a found-and-verified list in two runs.
• SEC EDGAR Form D — Startup Funding Rounds API — companies that just raised money, with the officers named on the filing.

FAQ

Does this send test emails? No. Nothing is sent and no SMTP connection is opened. Only DNS is queried.

Why is sales@stripe.com "risky" when Stripe obviously exists? Because sales@ is a role address that reaches a shared inbox rather than a person. Set treatRoleAddressAsRisky: false if that is what you want in your list.

How many addresses can it handle? Up to 10,000 per run. Because results are cached per domain, throughput is governed by how many unique domains the list contains, not how many addresses.

Can I use my own DNS resolver? Yes — put its IP in dnsResolvers, or use the single entry "system" to use the container's own resolver.

Will an address that comes back accepts_mail definitely not bounce? No, and nothing that does not open an SMTP session can promise that. It means the domain will accept the connection. Whether that specific mailbox exists is not knowable from DNS.

What does it cost? Pay per event: a fixed fee to start the run, plus a small fee per address checked. No proxy costs — DNS is free.