Email verification that tells you the truth
Clean your list before you send. Ten distinct result statuses, a score you can audit, and an honest unknown when the answer genuinely cannot be known — never billed, never dressed up as a guess.
What actually happens to an address
Six checks run in order, and each one can settle the answer on its own. Anything ambiguous falls through to unknown rather than a guess.
Mailbox-level SMTP verification
We open a real SMTP session and ask the mail server about the exact address — then close it. No message is ever delivered to the address being checked.
Catch-all detection
A second probe for a mailbox that cannot exist tells us whether the domain accepts everything, on the same connection. Guessing here is how lists get ruined.
Disposable detection that keeps up
Throwaway providers register new domains weekly. We fingerprint the mail servers behind them, so we catch domains that no list has seen yet.
A score you can audit
Every address gets 0-100 from a published rule table, returned with the individual adjustments that produced it. Not a black box you have to trust.
Role and spam-trap flags
Function mailboxes and known complainers are separated out, so a single careless send does not cost you your sender reputation.
Greylisting handled properly
Servers that defer an unfamiliar sender get retried after a wait, which is the only thing that actually works. Most verifiers just report unknown.
An API you can migrate to in an afternoon
Field names match what the category already uses, so an existing integration usually needs nothing but a new base URL and key.
curl "https://api.mailproof.dev/api/v1/verify\
?email=jane@acme.io&mode=power" \
-H "Authorization: Bearer $MAILPROOF_KEY"
{
"email": "jane@acme.io",
"status": "safe",
"overall_score": 97,
"is_safe_to_send": true,
"is_catch_all": false,
"is_role_account": false,
"is_disposable": false,
"mx_records": ["mx1.acme.io"],
"reasons": ["mailbox_accepted"]
}Two modes
Quick answers in about half a second using syntax, DNS and list checks — built for live signup forms.
Power adds the SMTP mailbox probe, catch-all detection and greylist retries. Slower, and the one to use before a campaign.
Bulk
Submit up to 50,000 addresses per task, or upload a CSV. Your original columns come back untouched with the verification columns appended, and you can download any single status on its own.
Pricing
One credit per completed verification. Daily credits are spent before purchased ones, so a subscription never eats into a pack you bought.
Free
- 20 credits every day
- 100 credits on signup
- Single and bulk verification
- Full API access
- No card required
Credit packs
- 10k credits for $11.90
- 100k credits for $116
- Down to $0.00096 per verification
- Credits never expire
- No monthly commitment
Daily
- 500 credits every day
- $0.0006 per verification if fully used
- Renews daily, no rollover
- Purchased credits untouched
- Cancel any time
Questions
How credits, statuses and data retention work.
What is a credit?
One credit is one completed verification. Every status except unknown costs exactly one credit, whether the answer is safe, invalid, disposable, catch-all or anything else.
Am I charged for unknown results?
Never. An unknown means our engine could not determine the answer — our failure, not yours. In bulk tasks the credits are refunded automatically the moment the task finishes, and you can see the refund in your credits history. You never have to ask for it.
Do credits expire?
Purchased credits never expire. Daily credits renew every day and do not accumulate — an unused daily allowance is gone at UTC midnight.
If I have both kinds, which is used first?
Daily credits are always spent first. If you stay within your daily allowance, your purchased balance is never touched.
What does catch-all mean, and why is it not a yes or no?
A catch-all domain accepts mail for every address, including ones that do not exist. No amount of probing can reveal whether a specific mailbox is real, so we label it Catch-all rather than guess. Roughly 15-20% of corporate domains are configured this way.
Why do some Yahoo and Outlook addresses come back as catch-all?
Yahoo, consumer Microsoft and several security gateways accept every recipient at the SMTP stage and bounce later. A 250 from them proves the domain exists and nothing more, so reporting Safe would be a fabricated answer. We report those as Catch-all, and the result explains that the provider accepts every address.
Can you catch every spam trap?
No, and neither can anyone else. Pristine traps — addresses that have never belonged to a real person — are undetectable by design. We match against known recycled traps and serial complainers.
Do you send email to the addresses I verify?
No. The SMTP session ends after asking about the recipient; the DATA command that would deliver a message is never issued. Nothing arrives in anyone inbox.
Can I upload a spreadsheet with other columns?
Yes. Upload a CSV and the email column is detected automatically, by header name or by inspecting the values. Every original column is preserved in the download, in its original order, with the verification columns appended.
How long does a list take?
Quick mode is roughly half a second per address and runs highly parallel. Power mode depends on the receiving servers: some are slow, and greylisted addresses are deliberately retried after a wait, which is what turns them into real answers instead of unknowns.
What happens to my uploaded data?
It is deleted automatically 15 days after a task completes, and you can delete any task yourself at any time. Deleting removes the addresses immediately; only the billing record is kept.
What is the difference between quick and power mode?
Quick checks syntax, DNS and our disposable, role and free-provider lists. Power adds the SMTP mailbox probe, catch-all detection and greylist retries. Use quick on signup forms and power before a campaign.
What we will not claim
Every verifier hits the same walls. We would rather say so than sell you a number that quietly turns into a bounce.
Catch-all domains are unknowable
If a domain accepts every recipient, no amount of probing reveals whether one mailbox exists. We label it Catch-all instead of guessing.
Some providers accept everything
Yahoo, consumer Microsoft and several security gateways accept every address and bounce later. We say so rather than reporting a confident result we cannot support.
Pristine spam traps are invisible
Traps that have never been used cannot be detected by design. We catch the recycled ones and known complainers, and we do not pretend to catch the rest.