What is an email verification API?
An email verification API is a web service endpoint that accepts an email address as input and returns a structured result indicating whether the address is valid, invalid, disposable, role-based, catch-all, or one of several other classifications. Instead of uploading CSV files and waiting for batch results, developers integrate the API directly into their applications for real-time verification at the point of entry: signup forms, checkout pages, CRM imports, and lead capture workflows.
For a broader overview of the verification process, see what is email verification. The typical API call takes 1-3 seconds per address and returns a JSON response with the verification result, confidence score, and supplementary data (free vs business domain, MX record details, SMTP response code). This speed makes it suitable for inline form validation where users wait for the result before proceeding.
Why use an API instead of batch verification?
| Aspect | API (real-time) | Batch (file upload) |
|---|---|---|
| When it runs | At the moment the address is submitted | After the address is already in your database |
| Speed | 1-3 seconds per address | Minutes to hours for large files |
| Best for | Signup forms, checkout, CRM imports, webhooks | Cleaning an existing list before a campaign |
| Prevents bad data | Yes: blocks bad addresses before they enter your system | No: cleans bad data after the fact |
| User experience | Instant feedback (“this email is invalid, please check”) | No user feedback (backend process) |
| Integration effort | Medium (HTTP call + response handling) | Low (upload CSV, download results) |
| Cost efficiency | Pay only for signups (lower volume, higher value) | Pay for entire list (higher volume, includes already-verified) |
The ideal setup uses both: API verification at signup to prevent bad addresses from entering, plus quarterly batch verification to catch addresses that decayed since the last check. This two-layer approach keeps your list continuously clean.
Common API integration patterns
| Pattern | How it works | Best for | Latency tolerance |
|---|---|---|---|
| Inline form validation | Call API on form submit; block submission if invalid | Signup pages, lead magnets, checkout | Must be under 3s |
| Async form validation | Accept the submission; verify in background; flag or delete bad entries | High-traffic forms where latency matters | Seconds to minutes |
| CRM webhook | Trigger verification when a new contact is added to CRM | HubSpot, Salesforce, Pipedrive integrations | Seconds |
| Import pipeline | Verify each row during CSV/database import | Data migration, list purchases, partner data | Batch processing (minutes) |
| ESP pre-send hook | Verify at send time; skip invalid addresses | Custom-built sending infrastructure | Milliseconds (cached results) |
Anatomy of an API response
A good verification API returns structured data that your code can act on programmatically. Here is a typical response structure from SMTPing’s API:
| Field | Description | Example value |
|---|---|---|
| The address that was verified | john@example.com | |
| result | The primary verification result | valid, invalid, catch-all, disposable, role, unknown |
| score | Confidence score (0-100) | 95 |
| is_free | Whether the domain is a free provider (Gmail, Yahoo) | true / false |
| is_disposable | Whether the domain is a temporary email service | true / false |
| is_role | Whether the local part is a role address (info@, admin@) | true / false |
| is_catch_all | Whether the domain accepts all addresses | true / false |
| mx_found | Whether the domain has MX records | true / false |
| smtp_code | The SMTP response code from the mail server | 250, 550, 450 |
SMTPing’s API returns 13 distinct result types, giving you granular control over which addresses to accept, reject, or flag for review. The boolean flags (is_disposable, is_role, is_catch_all) allow you to build nuanced acceptance policies. Learn more about how each check type works in our guide on SMTP verification.
What to look for in a verification API
| Feature | Why it matters | SMTPing |
|---|---|---|
| Response time | Under 3s for inline form validation; over 5s causes user abandonment | Under 2 seconds average |
| Result granularity | More result types = more control over your acceptance policy | 13 distinct result types |
| Catch-all detection | Differentiates “server accepted” from “address confirmed valid” | Yes (separate result type) |
| Disposable detection | Blocks temporary/self-destructing addresses | 30,000+ DEA domains tracked |
| Role address detection | Flags info@, admin@, abuse@ before they generate complaints | 500+ role prefixes |
| Pricing model | Per-verification credits vs monthly subscription | $1 per 1,000 credits, no subscription required |
| Free tier | Test the API before committing | 25 free verifications daily |
| Rate limits | How many concurrent requests you can make | Generous rate limits for production use |
| Uptime SLA | The API must be available when your forms are live | 99.9% uptime |
API integration best practices
| Practice | Why |
|---|---|
| Cache results for 24-72 hours | The same user may submit the same form multiple times; caching saves API calls and reduces latency on retry |
| Set a timeout of 5 seconds | If the API does not respond in 5s, accept the address provisionally and verify it asynchronously; never block the user forever |
| Handle “unknown” results gracefully | Some addresses cannot be verified due to greylisting or anti-verification servers; accept them provisionally rather than rejecting real users |
| Show user-friendly error messages | This email address appears invalid. Please check for typos.” is better than “Verification failed: 550 5.1.1” |
| Log the full API response | Store the result type, confidence score, and timestamp for debugging and audit trails |
| Never expose API keys client-side | Call the API from your backend, not from JavaScript in the browser; client-side API keys will be stolen |
| Re-verify on import, not just on signup | CRM imports, CSV uploads, and partner data feeds bypass your signup form; verify them too |
Frequently asked questions
How much does an email verification API cost?
Most verification APIs charge per verification, typically $1-5 per 1,000 verifications. SMTPing charges $1 per 1,000 credits with no monthly subscription required. Higher-volume plans offer lower per-verification costs. Most services also offer a free tier for testing (SMTPing provides 25 free checks daily).
Can I verify emails in real time on a signup form?
Yes. A well-built verification API returns results in 1-3 seconds, which is fast enough for inline form validation. Call the API on form submit, check the result, and show an error message if the address is invalid. Always set a timeout (5 seconds recommended) so users are never stuck waiting if the API is slow.
What happens if the API is down when a user signs up?
Your integration should include a fallback: if the API does not respond within your timeout window, accept the address provisionally and queue it for asynchronous verification. Never block a real user from signing up because of a temporary API issue. Log the unverified address and verify it in a background job within minutes.
Should I call the verification API from the frontend or backend?
Always from the backend. API keys exposed in client-side JavaScript can be stolen and used to exhaust your credits. Your frontend form sends the email to your backend, your backend calls the verification API, and your backend returns the result to the frontend. This also prevents users from bypassing the check by disabling JavaScript.
Don’t forget to clean your list. Boost your inbox rate.
SMTPing catches what regex misses: disposable addresses, role-based emails, catch-all domains, syntax errors, and 9 more invalid types. Free tier renews every day, no card required.
About the Author
Alaa · LinkedIn
Email infrastructure specialist with 8+ years of hands-on experience in SMTP, deliverability, and email verification. I’ve configured and troubleshot mail systems across Postfix, Exchange, and cloud relays, managed IP reputation and warmup campaigns, and built verification pipelines processing millions of addresses. My work spans DNS authentication (SPF, DKIM, DMARC, BIMI), bounce handling, blocklist monitoring, and compliance frameworks including CAN-SPAM and GDPR. I write every article on SMTPedia to give email professionals, developers, and marketers the accurate, RFC-grounded reference they need.
About SMTPedia
SMTPedia is an independent email industry reference covering SMTP, IMAP, POP3, email deliverability, marketing platforms, DNS authentication, and email verification. Every article is researched from official provider documentation, IETF RFCs, and industry best practices. Settings and configurations are verified quarterly.
We are cited as a source by ChatGPT, Microsoft Copilot, and thousands of email professionals worldwide. Learn more about our editorial process.
