What checks does the Email Verifier perform?

Format validation, MX records, SMTP mailbox check, catch-all detection, disposable detection, role-based flag, free provider check, and greylisting handling.

Are verification credits free?

Yes. Every plan includes matching verification credits at no extra cost.

Can I verify in bulk?

Yes. Bulk Email Verifier API processes thousands of emails at once.

What is the rate limit?

Limits are per plan, in requests a second / a minute / a day: Free 1 / 2 / 10, Basic 2 / 40 / 500, Growth 3 / 60 / 1,000, Pro 5 / 100 / 4,000. Pro Plus and Scale have no limit, and Enterprise allows 100,000 requests a day with no per-second limit. Every response carries rate-limit headers; see Rate limits .

What does each verification status mean?

Deliverable means the mailbox exists and accepts mail. Undeliverable means the address bounces. Risky covers catch-all domains or temporary issues. Unknown means the server didn't respond.

Does it detect disposable emails?

Yes. Flags temporary addresses from providers like Mailinator, Guerrilla Mail, and 3,000+ other disposable domains.

How is this different from syntax-only validation?

Syntax checks only verify format. Tomba performs a full SMTP handshake with the mail server, checks MX records, and detects catch-all, disposable, and role-based addresses.

Can I verify a single email in real-time?

Yes. Response times vary by endpoint and by how hard an address is to verify, so set a generous timeout (the docs suggest up to 180 seconds) and use bulk jobs or webhooks for large volumes.

// get /v1/email-verifier

Email Verifier API

Verify email deliverability in real-time with SMTP checks, MX validation, and catch-all detection via our RESTful API.

Get free API key API reference

1 verification credit

// api console

Example response from the API reference

email.email: richard@piedpiper.com
email.result: deliverable
email.status: valid
email.score: 99
email.smtp_provider: Google
email.accept_all: false
email.disposable: false
email.webmail: false
email.greylisted: false

// 01 · request

Email Verifier is one HTTPS request

Send the parameters with your key and secret. Every SDK, the CLI and the MCP server make this same call.

GET/email-verifierParameter

emailrequired: The address to verify
enrich_mobilefalse: Also return phone numbers

GET /email-verifier

curl "https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY"

const res = await fetch("https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com", {
  headers: {
    "X-Tomba-Key": process.env.TOMBA_API_KEY,
    "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY
  }
});
const { data } = await res.json();

import os, requests

res = requests.get(
    "https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com",
    headers={
        "X-Tomba-Key": os.environ["TOMBA_API_KEY"],
        "X-Tomba-Secret": os.environ["TOMBA_SECRET_KEY"],
    },
)
data = res.json()["data"]

// 02 · response

What comes back

JSON, the same in every language. Fields Tomba doesn't know are null, never guessed.

GET/email-verifierField

data.email.resultstring: deliverable, risky or undeliverable; empty for a disposable domain
data.email.statusstring: valid, accept_all, invalid, unknown or disposable (compare case-insensitively: a live check can return Valid)
data.email.scoreinteger: Confidence: 99 for valid, 77 or more for accept_all, 2 for disposable
data.email.smtp_providerstring | null: Mail provider from the MX records, such as Google
data.email.mx.recordsarray | null: The domain's MX hosts
data.email.mx_check, data.email.smtp_checkboolean: The domain has MX records (smtp_check is the same check; status says whether the mailbox exists)
data.email.accept_all, data.email.greylisted, data.email.blockboolean: Catch-all domain, check deferred, check refused by the server
data.email.disposable, data.email.webmail, data.email.gibberish, data.email.regexboolean: Disposable or webmail domain, random-looking address, valid syntax
data.sources[]array: Where the address was found
data.phone_data[]array | null: Phone numbers, when you send enrich_mobile

GET /email-verifier

200 OK· 1 verification credit

{
  "data": {
    "email": {
      "email": "richard@piedpiper.com",
      "result": "deliverable",
      "status": "valid",
      "score": 99,
      "smtp_provider": "Google",
      "mx": {
        "records": [
          "aspmx.l.google.com",
          "alt1.aspmx.l.google.com"
        ]
      },
      "mx_check": true,
      "smtp_server": true,
      "smtp_check": true,
      "accept_all": false,
      "greylisted": false,
      "block": false,
      "gibberish": false,
      "disposable": false,
      "webmail": false,
      "regex": true,
      "whois": {
        "registrar_name": null,
        "referral_url": null,
        "created_date": null
      }
    },
    "sources": [
      {
        "uri": "https://piedpiper.com/blog/engineering",
        "website_url": "piedpiper.com",
        "extracted_on": "2024-06-01T09:14:07+01:00",
        "last_seen_on": "2025-01-10T17:02:44+01:00",
        "still_on_page": true
      }
    ],
    "phone_data": null
  }
}

// 03 · cost and limits

What a call costs

A call is charged only under the condition below. Rate limits depend on your plan.

// cost

1verification credit

Charged when: The status is not disposable or unknown.

Errors, 429 and 451 responses, and the same request again within your usage window cost nothing.

How credits work

// rate limits

Requests per second / minute / day

	Free	Basic	Growth	Pro
Search, finder, similar, technology	1 / 2 / 5	3 / 50 / 500	5 / 80 / 1,000	8 / 150 / 4,000
Email verifier	1 / 2 / 10	2 / 40 / 500	3 / 60 / 1,000	5 / 100 / 4,000

Pro Plus, Scale and credit packs of 50,000 or more: no limit on these endpoints. Enterprise: no per-second or per-minute limit, 100,000 requests a day. Daily limits reset at 00:00 UTC. Rate limits

// faq

Email Verifier API Questions

Still have questions? Visit the help center

const res = await fetch("https://api.tomba.io/v1/email-finder?domain=piedpiper.com&first_name=Richard&last_name=Hendricks", { headers: { "X-Tomba-Key": process.env.TOMBA_API_KEY, "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY } }); const { data } = await res.json();

import os, requests res = requests.get( "https://api.tomba.io/v1/email-finder?domain=piedpiper.com&first_name=Richard&last_name=Hendricks", headers={ "X-Tomba-Key": os.environ["TOMBA_API_KEY"], "X-Tomba-Secret": os.environ["TOMBA_SECRET_KEY"], }, ) data = res.json()["data"]

{ "data": { "email": "richard@piedpiper.com", "first_name": "Richard", "last_name": "Hendricks", "full_name": "Richard Hendricks", "website_url": "piedpiper.com", "company": "Pied Piper", "pattern": "{first}", "department": "executive", "type": "personal", "position": "CEO", "country": "US", "gender": "male", "twitter": null, "linkedin": "https://www.linkedin.com/in/richard-hendricks", "score": 100, "accept_all": false, "phone_number": true, "verification": { "date": "2025-01-15T10:32:00+01:00", "status": "valid" }, "sources": [ { "uri": "https://piedpiper.com/blog/engineering", "website_url": "piedpiper.com", "extracted_on": "2024-06-01T09:14:07+01:00", "last_seen_on": "2025-01-10T17:02:44+01:00", "still_on_page": true } ], "phone_data": [] } }

Email Verifier API

Email Verifier is one HTTPS request

What comes back

What a call costs

Related endpoints

Email Verifier API Questions

Make your first call in a minute