Email Validation API: How It Works + 7 Options Compared

Email Validation API: How It Works + 7 Options Compared

Last updated: September 25, 2026

01Introduction

An email validation API checks whether an email address is correctly formed and whether its domain can receive mail. You send one address, and the API returns a pass/fail result or a status such as deliverable, risky, or invalid.

Teams use it at signup, at checkout, and before a campaign goes out. A bad address caught at the form costs nothing. The same address in your list costs a bounce, and repeated bounces hurt your sender reputation.

This guide covers what each check catches, how validation differs from verification, and seven APIs worth comparing. Each option gets real request and response examples, free-tier details, and an honest note on where it falls short.

02Email validation vs email verification

The two terms are often used as synonyms. In practice, vendors use them for two different depths of checking.

Validation answers "could this address work?" It checks the address format, looks up the domain's MX records, and screens the domain against disposable-email lists. No connection is made to the recipient's mail server.

Verification answers "does this mailbox exist?" On top of validation, it opens an SMTP conversation with the recipient's mail server and asks whether it would accept mail for that address, without sending a message.

Validation is cheap, returns in milliseconds, and is safe to run on every keystroke or form submit. Verification is slower, costs more per call, and runs into catch-all domains (see below). Most signup flows need validation. Most list-cleaning jobs need verification.

03What each check catches

Two notes on the table.

Catch-all domains can't be fully verified. Some company mail servers accept mail for any address at their domain and bounce later. An SMTP check against them always "passes," so good APIs label these addresses catch_all or accept-all instead of valid.

Role addresses are valid but often unwanted. [email protected] exists, but a person rarely owns it. Whether to block role addresses depends on your product. A B2B trial might accept them. A consumer app usually shouldn't.

04Why bounce rates matter more since 2024

In October 2023, Google announced new requirements for bulk senders to Gmail, effective February 2024. Anyone sending more than 5,000 messages a day to Gmail addresses must authenticate their mail, support one-click unsubscribe, and stay under a spam-rate threshold (Google, "New Gmail protections for a safer, less spammy inbox", October 3, 2023).

Google's sender guidelines FAQ says senders should keep their spam rate below 0.1% and never let it reach 0.3% or higher (Google Workspace Admin Help, "Email sender guidelines FAQ"). Bounces are a separate metric from spam complaints, but both come from the same root problem: sending to addresses that shouldn't be on your list. Validating at the point of capture is the cheapest place to fix it.

Email infrastructure providers now build validation into their sending platforms. Amazon SES added an email validation API and an automatic validation mode for all outbound mail in December 2025 (AWS What's New, "Amazon SES announces email validation", December 18, 2025).

05What makes a good email validation API

1. It returns a status richer than true/false when you need it. A pass/fail boolean is fine for a signup gate. For list cleaning, you need to tell invalid apart from catch_all and unknown, because you handle each one differently.
2. It separates each check in the response. Field-level results (syntax, MX, disposable, role) let you set your own rules instead of trusting one opaque score.
3. Its latency fits the place you call it. A form validation call should come back in well under a second. A three-second SMTP check belongs in a background job.
4. Its free tier is enough to test real traffic. You should be able to run a few hundred real addresses from your own signups before paying.
5. It suggests typo corrections. A "did you mean gmail.com?" prompt recovers a real user instead of rejecting them.

067 email validation APIs compared

Prices and free tiers were checked on each vendor's site in September 2026. They change often, so confirm before you commit.

1. ZeroBounce

ZeroBounce is a dedicated email verification company. Its API sorts addresses into more than 30 types, including valid, invalid, catch-all, disposable, "do not mail," and several spam-trap categories.

Where it shines

• Spam-trap detection (pristine, typo, and recycled traps) that most APIs don't attempt
• 100 free credits every month on a free account
• No rate limit on the single-email and bulk-file endpoints, per ZeroBounce

Where it lags

• ZeroBounce quotes about 3 seconds for a single validation, which is slow for an inline form check
• The batch endpoint caps at 200 emails per call and 5 calls per minute
• Paid credits start at a 2,000-credit minimum

2. Kickbox

Kickbox focuses on verification for marketing and product teams. Each result comes back as deliverable, undeliverable, risky, or unknown, with a reason code and a Sendex quality score.

Where it shines

• Clear four-way result that maps directly to "keep, drop, review, retry"
• Typo suggestions and a sandbox mode for testing
• Pay-as-you-go credits, no subscription required

Where it lags

• Credit-based pricing adds up for high-volume signup flows
• The Sendex score is Kickbox's own metric, so it doesn't carry over if you switch providers

3. Mailgun Validate

Mailgun offers validation as part of its email platform through GET or POST /v4/address/validate. It returns a result (deliverable, undeliverable, do_not_send, catch_all, unknown), a risk level, and flags for disposable and role addresses.

A response looks like this (abridged to the documented fields):

json

{
  "address": "[email protected]",
  "result": "undeliverable",
  "risk": "high",
  "is_disposable_address": false,
  "is_role_address": false,
  "reason": ["no_mx"],
  "did_you_mean": "[email protected]"
}

Where it shines

• did_you_mean typo correction built into the response
• do_not_send separates risky-but-real addresses from dead ones
• 5,000 validations included on the Foundation and Scale plans

Where it lags

• Only an add-on on the Free and Basic plans; extra validations cost from $0.80 to $1.20 per 100
• Makes most sense if you already send through Mailgun

4. Twilio SendGrid Email Address Validation

SendGrid's validation API runs in real time for single addresses and in bulk for up to one million addresses per CSV upload.

Where it shines

• Same vendor and API key as your sending if you're on SendGrid
• Bulk mode handles very large lists asynchronously

Where it lags

• Not available on the Free Trial or Essentials plans; Pro includes 2,500 validations and Premier includes 5,000
• Tied to a SendGrid sending plan, so it's a poor fit as a standalone validator

5. Amazon SES email validation

Amazon SES added email validation in December 2025. The GetEmailAddressInsights operation runs six checks: syntax, DNS records, mailbox existence, role address, disposable domain, and random-string patterns. Each check returns a confidence verdict of HIGH, MEDIUM, or LOW.

aws --region us-east-1 sesv2 get-email-address-insights \
  --email-address [email protected]

Where it shines

• Auto Validation can screen every outbound send with no code change
• Random-input detection catches keyboard-mash signups like [email protected]
• $0.01 per validation à la carte, or 2,500 per month included on the SES Pro plan

Where it lags

• Requires an AWS account, IAM permissions, and the SES v2 SDK
• Confidence verdicts need your own rules to turn into a keep/drop decision

6. Abstract Email Validation

Abstract's API combines format, MX, and SMTP checks with flags for disposable, role, catch-all, and free-provider addresses. Higher tiers add domain age, breach history, and risk levels.

Where it shines

• Abstract quotes response times under 300 ms, fast enough for inline form checks
• 100 free requests a month with no credit card
• Enrichment data (domain age, breaches) in the same response

Where it lags

• Free tier of 100 requests a month is small for production traffic
• Paid tiers are capped at 3 requests per second

7. ApyHub catalog

ApyHub takes a different approach. Instead of one validation API, the catalog offers several email APIs from ApyHub and verified providers, all under one API key and one subscription. You pick the depth you need per call.

• Validate Email DNS API (ApyHub): syntax, MX, and optional disposable check. Returns one boolean.
• Email Deliverability Score API (Dosvak): syntax, MX, and disposable as separate fields, plus a 0 to 3 score.
• Disposable Email Checker API, Email MX Lookup API, and Email Syntax Validator API (Dosvak): each check as its own endpoint.
• Advanced Email Verification API (Quadlem): verification from a single query parameter.
• Email and IP Risk Analyzer (Fraudox OSINT): risk score from 0 to 100 and an ALLOW, REVIEW, or BLOCK verdict, with checks for DNS, typo-squats, disposable domains, Gravatar, and proxy ports.
• Validate Academic Email API (ApyHub): checks whether an address belongs to an academic institution, for student discounts and education access.

Where it shines

• One key covers basic validation, field-level scoring, and fraud risk, so you can layer checks without a second vendor
• Free Starter plan with no credit card
• Every endpoint is callable by AI agents through ApyHub MCP (see below)

Where it lags

• ApyHub's own Validate Email DNS API doesn't run an SMTP mailbox check, so it won't catch a nonexistent mailbox at a real domain
• No spam-trap detection; for list cleaning at scale, a dedicated verifier like ZeroBounce or Kickbox goes deeper
• The free Starter plan allows 5 calls a day, which is enough to test but not to run production signups

Explore the email APIs in the catalog →

07How to validate an email with an API

The pattern is the same for every vendor: send the address, read the result, decide. Here it is with ApyHub's Validate Email DNS API.

Request (curl):

curl -X POST "https://api.eu.apyhub.com/apyhub/verify-email-validity-and-deliverability" \
  -H "apy-token: $APY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "disposable_checks": true}'

Response:

{
  "data": true
}

true means the address has valid syntax, its domain has MX records, and (with disposable_checks on) the domain isn't on a disposable list.

Node.js:

async function isValidEmail(email) {
  const res = await fetch(
    "https://api.eu.apyhub.com/apyhub/verify-email-validity-and-deliverability",
    {
      method: "POST",
      headers: {
        "apy-token": process.env.APY_TOKEN,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ email, disposable_checks: true }),
    }
  );
  if (!res.ok) throw new Error(`Validation failed: ${res.status}`);
  const { data } = await res.json();
  return data;
}

Python:

python

import os
import requests

def is_valid_email(email: str) -> bool:
    res = requests.post(
        "https://api.eu.apyhub.com/apyhub/verify-email-validity-and-deliverability",
        headers={"apy-token": os.environ["APY_TOKEN"]},
        json={"email": email, "disposable_checks": True},
        timeout=5,
    )
    res.raise_for_status()
    return res.json()["data"]

When you need to know why an address failed, use a field-level response instead. The Email Deliverability Score API takes the address as a query parameter:

curl "https://api.eu.apyhub.com/dosvak/[email protected]" \
  -H "apy-token: $APY_TOKEN"

{
  "max": 3,
  "email": "[email protected]",
  "level": "high",
  "score": 3,
  "has_mx": true,
  "disposable": false,
  "valid_syntax": true
}

Each boolean maps to one check, so your form can show "that domain doesn't receive mail" instead of a generic error.

For full walkthroughs, see the Node.js email validation tutorial, the Go tutorial, and running DNS email validation on Cloudflare Workers.

08Layering checks at signup

Running every check on every address wastes money and slows the form. A layered flow runs the cheap checks first and saves the expensive ones for addresses that pass.

Steps 1 and 2 run while the user waits. Step 4 runs after signup, so a three-second SMTP check or a fraud-risk call never blocks the form. The confirmation email in step 3 is still the final proof of ownership: no API can confirm that the person typing the address controls the inbox.

For the disposable-email side of this flow in more depth, see the guide to the disposable email API for developers.

09Email validation for AI agents

Agents that create accounts, qualify leads, or clean CRM records need to check addresses too. Every endpoint in the ApyHub catalog, including the email APIs above, is accessible through ApyHub MCP. An agent can discover the Validate Email DNS API, read its schema, and call it directly without a hand-written wrapper or tool definition. That means an agent can pick the Email Deliverability Score API for field-level results or the Email and IP Risk Analyzer for fraud screening, based on the task.

10Which one should you pick?

It depends on where the check runs and what you already use.

• Signup forms that need a fast yes/no: a validation API with MX and disposable checks. ApyHub's Validate Email DNS API or Abstract fit here.
• Cleaning an existing marketing list: a dedicated verifier with SMTP checks and catch-all handling. ZeroBounce and Kickbox are built for this.
• You already send through Mailgun, SendGrid, or SES: use their built-in validation first. It shares your billing and API key.
• Fraud and trial abuse: a risk-scoring API like the Email and IP Risk Analyzer, which looks beyond the address itself.
• AI agents or multi-step flows: a catalog with MCP access, so one integration covers several checks.

11Conclusion

Email validation and email verification solve different parts of the same problem. Validation (syntax, MX, disposable) is cheap and fast enough for every signup. Verification (SMTP, catch-all, traps) goes deeper and belongs in background jobs and list cleaning. Most teams end up using both, in layers.

Pick the API by where you'll call it: inline at the form, in a background job, or inside the sending platform you already use.

Try ApyHub's email validation APIs free →

12FAQ

What is an email validation API? An email validation API checks whether an email address is correctly formatted and whether its domain can receive mail. Most also flag disposable domains. You send an address and get back a pass/fail result or a status.

What's the difference between email validation and email verification? Validation checks syntax, MX records, and disposable domains without contacting the mail server. Verification adds an SMTP check that asks the recipient's server whether the mailbox exists. Verification is deeper but slower and more expensive.

Is there a free email validation API? Yes. ZeroBounce gives 100 free credits a month, Abstract gives 100 free requests a month, and ApyHub has a free Starter plan with no credit card. Free tiers are sized for testing, so plan for a paid tier in production.

Can an email validation API confirm a mailbox exists? Only APIs that run an SMTP check can, and even they can't confirm mailboxes at catch-all domains. A confirmation email is the only way to prove the user controls the inbox.

What does an email validation API return in JSON? It depends on the API. Simple validators return a boolean, like {"data": true}. Detailed ones return a status (deliverable, undeliverable, catch_all) plus per-check fields for syntax, MX, disposable, and role addresses.

Should I block role-based addresses like info@ or support@? It depends on your product. B2B tools often accept them because small companies sign up with shared inboxes. Consumer apps usually block them because no single person owns the inbox.

How fast is an email validation API? Validation-only checks usually return fast enough for a signup form; Abstract quotes under 300 ms. SMTP verification is slower, and ZeroBounce quotes about 3 seconds for a single address, so run it in a background job.

Can I validate emails in bulk? Yes. SendGrid's bulk API accepts up to one million addresses per CSV, and ZeroBounce's batch endpoint takes 200 per call. For bulk jobs through a single-address API, queue the calls and respect the rate limit.

How do I test an email validation API before integrating it? Start in the vendor's playground or sandbox with a handful of known-good, known-bad, and disposable addresses. For repeatable tests, save the requests in an API client. Voiden stores each request as a plain Markdown file in your Git repo, so your team can rerun the same test cases after any change. Postman and curl scripts also work.

Can AI agents use an email validation API? Yes. Every email API in the ApyHub catalog is available through ApyHub MCP, so an agent can discover, evaluate, and call it directly without a custom wrapper.

13About ApyHub

ApyHub is a curated API catalog and trusted operational layer for developers and AI agents. It gives teams access to a growing catalog of over 1,500 endpoints and capabilities through a single subscription, priced in atoms (a per-call unit that reflects the actual compute work of each request). Every API carries machine-readable certification covering GDPR, SOC 2, and ISO 27001, and every endpoint is MCP-ready by default, so AI agents can call it without extra integration work. ApyHub is headquartered in Amsterdam, with offices in the Netherlands, Greece, and India, and supports 65,000+ monthly developer workspaces. The free tier requires no credit card. API providers can publish on ApyHub at apyhub.com/api-provider.