// get /v1/email-verifier
Email Verifier API
Verify email deliverability in real-time with SMTP checks, MX validation, and catch-all detection via our RESTful API.
1 verification credit
// api console
ExampleExample response from the API reference
ab@tomba.io
deliverableProvider · Google Workspace
- Syntax
- MX records
- Mail server
- Mailbox (SMTP)
- Not catch-all
- Not disposable
- Not webmail
- Not gibberish
// 01 · request
Email Verifier is one HTTPS request
Send the parameters with your key and secret. Every SDK, the CLI and the MCP server make this same call.
GET
/email-verifieremailrequired- The address to verify
enrich_mobilefalse- Also return phone numbers
curl -G https://api.tomba.io/v1/email-verifier \
--data-urlencode "email=richard@piedpiper.com" \
-H "X-Tomba-Key: $TOMBA_API_KEY" \
-H "X-Tomba-Secret: $TOMBA_SECRET_KEY"const params = new URLSearchParams({
email: "richard@piedpiper.com"
});
const res = await fetch(`https://api.tomba.io/v1/email-verifier?${params}`, {
headers: {
"X-Tomba-Key": process.env.TOMBA_API_KEY,
"X-Tomba-Secret": process.env.TOMBA_SECRET_KEY
}
});
const { data } = await res.json();import os, requests
res = requests.get(
"https://api.tomba.io/v1/email-verifier",
params={
"email": "richard@piedpiper.com",
},
headers={
"X-Tomba-Key": os.environ["TOMBA_API_KEY"],
"X-Tomba-Secret": os.environ["TOMBA_SECRET_KEY"],
},
)
data = res.json()["data"]// 02 · response
What comes back
JSON, the same in every language. Fields Tomba doesn't know are null, never guessed.
GET
/email-verifierdata.email.resultstring- deliverable, risky or undeliverable; empty for a disposable domain
data.email.statusstring- valid, accept_all, invalid, unknown or disposable (compare case-insensitively: a live check can return Valid)
data.email.scoreinteger- Confidence: 99 for valid, 77 or more for accept_all, 2 for disposable
data.email.smtp_providerstring | null- Mail provider from the MX records, such as Google
data.email.mx.recordsarray | null- The domain's MX hosts
data.email.mx_check, data.email.smtp_checkboolean- The domain has MX records (smtp_check is the same check; status says whether the mailbox exists)
data.email.accept_all, data.email.greylisted, data.email.blockboolean- Catch-all domain, check deferred, check refused by the server
data.email.disposable, data.email.webmail, data.email.gibberish, data.email.regexboolean- Disposable or webmail domain, random-looking address, valid syntax
data.sources[]array- Where the address was found
data.phone_data[]array | null- Phone numbers, when you send enrich_mobile
GET /email-verifier
200 OK· 1 verification credit
{
"data": {
"email": {
"email": "richard@piedpiper.com",
"result": "deliverable",
"status": "valid",
"score": 99,
"smtp_provider": "Google",
"mx": {
"records": [
"aspmx.l.google.com",
"alt1.aspmx.l.google.com"
]
},
"mx_check": true,
"smtp_server": true,
"smtp_check": true,
"accept_all": false,
"greylisted": false,
"block": false,
"gibberish": false,
"disposable": false,
"webmail": false,
"regex": true,
"whois": {
"registrar_name": null,
"referral_url": null,
"created_date": null
}
},
"sources": [
{
"uri": "https://piedpiper.com/blog/engineering",
"website_url": "piedpiper.com",
"extracted_on": "2024-06-01T09:14:07+01:00",
"last_seen_on": "2025-01-10T17:02:44+01:00",
"still_on_page": true
}
],
"phone_data": null
}
}// 03 · cost and limits
What a call costs
A call is charged only under the condition below. Rate limits depend on your plan.
// cost
1verification credit
Charged when: The status is not disposable or unknown. Phone numbers returned with enrich_mobile cost 5 search credits each, from the search allowance.
Errors, 429 and 451 responses, and the same request again within your usage window cost nothing.
How credits work// rate limits
Requests per second / minute / day| Free | Basic | Growth | Pro | |
|---|---|---|---|---|
| Search, finder, similar, technology | 1 / 2 / 5 | 3 / 50 / 500 | 5 / 80 / 1,000 | 8 / 150 / 4,000 |
| Email verifier | 1 / 2 / 10 | 2 / 40 / 500 | 3 / 60 / 1,000 | 5 / 100 / 4,000 |
Scroll sideways for every column
Pro Plus, Scale and credit packs of 50,000 or more: no limit on these endpoints. Enterprise: no per-second or per-minute limit, 100,000 requests a day. Daily limits reset at 00:00 UTC. Rate limits
Format validation, MX records, SMTP mailbox check, catch-all detection, disposable detection, role-based flag, free provider check, and greylisting handling.
Yes. Every plan includes matching verification credits at no extra cost.
Yes. Bulk Email Verifier API processes thousands of emails at once.
Limits are per plan, in requests a second / a minute / a day: Free 1 / 2 / 10, Basic 2 / 40 / 500, Growth 3 / 60 / 1,000, Pro 5 / 100 / 4,000. Pro Plus and Scale have no limit, and Enterprise allows 100,000 requests a day with no per-second limit. Every response carries rate-limit headers; see Rate limits.
Deliverable means the mailbox exists and accepts mail. Undeliverable means the address bounces. Risky covers catch-all domains or temporary issues. Unknown means the server didn't respond.
Yes. Flags temporary addresses from providers like Mailinator, Guerrilla Mail, and 3,000+ other disposable domains.
Syntax checks only verify format. Tomba performs a full SMTP handshake with the mail server, checks MX records, and detects catch-all, disposable, and role-based addresses.
Yes. Response times vary by endpoint and by how hard an address is to verify, so set a generous timeout (the docs suggest up to 180 seconds) and use bulk jobs or webhooks for large volumes.