Email Validator

Email validation checks whether an address is properly formed, points to a domain that can receive mail, and — with deeper verification — whether the specific mailbox exists, all without sending an actual message. It works in layers, each one catching problems the previous layer cannot see.

• Syntax validation. Checks the address against RFC 5322, the internet message format specification: correct placement of the @ symbol, no invalid characters, no consecutive dots, and a properly structured local part and domain. This catches typos and malformed entries, and nothing else.
• Domain and MX validation. Performs a DNS lookup to confirm the domain exists and publishes active MX (Mail Exchange) records, meaning it is configured to receive mail. A domain with no MX records cannot accept email no matter how perfectly the address is spelled.
• Mailbox verification (SMTP check). Connects to the destination mail server and issues the standard SMTP handshake defined in RFC 5321 — HELO/EHLO, then MAIL FROM and RCPT TO — to ask whether a specific mailbox exists, without delivering anything. A 250 response generally means the mailbox will accept mail; 550 or 553 generally means it will not; 451 and 452 signal a temporary failure worth retrying rather than treating as a hard invalid.

Each layer narrows the risk. None of them, individually or together, can promise that a message will arrive — which is why interpreting the result correctly matters as much as running the check.

Most validation tools return a status and leave you to decide what to do with it. Deleting everything that is not marked "valid" is the most common and most expensive mistake in list cleaning. Here is what each status means and the action it warrants.

The catch-all row deserves particular attention in B2B. Catch-all configurations are common on business domains, so a rule that discards every catch-all result can quietly remove a large share of your legitimate prospect list. Risk-rank them; don't delete them.

Validation used to be housekeeping. It is now closer to a compliance requirement, because the major mailbox providers set and enforce measurable thresholds.

Since February 2024, Google and Yahoo have enforced requirements on domains sending roughly 5,000 or more messages per day to their users: SPF, DKIM, and DMARC authentication, one-click unsubscribe, and a spam complaint rate that must stay below 0.3%. Google advises staying under 0.1% and treats 0.3% as the point where enforcement begins, not a safe operating target. Microsoft began enforcing comparable requirements in May 2025. Non-compliant mail is not quietly filtered to a spam folder — it can be rejected outright at the SMTP level.

Sending to dead addresses feeds directly into those numbers. Hard bounces signal poor list hygiene, depress your sender reputation, and make every subsequent send less likely to land. At scale the margins are thin: a domain delivering 10,000 messages needs only 30 spam complaints to reach the 0.3% threshold. Beyond compliance, validation also protects the basics — catching a typo like "gmial.com" recovers a real lead that would otherwise vanish silently, and flagging disposable signups keeps your list focused on people who can actually be reached again.

Most email validation services described as free are free up to a credit allowance, and nearly all of them require an account before you can validate anything. These are the published free-tier terms on widely used tools at the time of writing.

Free-tier terms change frequently, so check each provider's current page before relying on these figures. The paid services in this list are capable products with published accuracy benchmarks and API access — if you are validating millions of addresses or need SLA-backed results, they earn their price. For cleaning a list before a campaign, an ungated tool does the job.

1. Add your addresses. Enter a single email address, or upload a CSV to validate an entire list at once.
2. Run the validation layers. The tool checks RFC 5322 syntax, looks up MX records, and flags disposable domains, role-based addresses, catch-all configurations, and likely typos.
3. Review results by category. Every address returns a status and a reason. Use the status table above rather than treating anything that is not "valid" as a deletion.
4. Export and act. Download the categorized results, remove hard invalids, apply typo corrections, and segment role-based and catch-all addresses instead of discarding them.

• Checking syntax and stopping there. An address can be perfectly formatted and still point to a domain with no mail server. Syntax validation alone catches neither dead domains nor missing mailboxes — pair it with an MX check at minimum.
• Treating "valid" as a guarantee. Full mailboxes, greylisting, spam filtering, and temporary outages all cause previously valid addresses to bounce. Validation lowers risk; it does not remove it.
• Deleting everything that is not marked valid. Catch-all and role-based results are not invalid addresses — they are addresses that need a different strategy. Blanket deletion is the most expensive mistake in list cleaning.
• Discarding a typo instead of fixing it. "gmial.com" is a slip of the finger, not a fake address. Applying the suggested correction recovers a lead that blanket deletion would lose.
• Validating once and never again. Lists decay continuously as people change jobs and abandon addresses. A list validated a year ago is not a validated list.

• Validate every new signup in real time at the point of collection
• Run syntax checks to catch obvious formatting errors before anything else
• Confirm domain existence and MX records before every send
• Set an explicit policy for disposable domains — flag, block at signup, or remove
• Segment role-based and catch-all addresses rather than excluding them automatically
• Apply typo suggestions before discarding any near-miss address
• Re-validate existing lists before major campaigns and before any ESP migration
• Monitor your provider's actual bounce and complaint dashboards, and re-validate when they climb
• Confirm SPF, DKIM, and DMARC are configured — validation cannot compensate for missing authentication
• Keep records accurate in line with your data protection obligations, such as the GDPR data accuracy principle in Article 5