Why do standard verifiers fail on catch-all domains?

Catch-all servers accept all incoming email regardless of the recipient. Standard verifiers only check if the server accepts the address which it always does. This produces false valid results for every address, including non-existent ones. Tomba solves this with deep SMTP analysis and AI scoring.

How is Tomba's catch-all verification different?

Tomba combines advanced SMTP probing, pattern analysis across known employees, cross-referencing against 450M+ verified contacts, and AI scoring to determine if a mailbox is actively monitored not just accepted by the server. Trusted by 150,000+ professionals for accurate results.

What results will I get?

Each email receives a clear status (valid, risky, invalid), a confidence score (0-100), and detailed risk flags (catch-all, role-based, disposable, etc.). Filter by confidence threshold before using results so you only send to verified addresses.

Should I send to catch-all emails with low confidence?

Send only to catch-all addresses with confidence scores above 70. Below that threshold, bounce risk increases significantly. For cold outreach, stick to 80+ to protect your sender reputation and maximize deliverability.

Do catch-all verification credits cost extra?

Never. All verification credits including catch-all verification are included free on every Tomba plan. No separate purchase, no hidden fees. Guaranteed.

What is the rate limit for catch-all verification?

Limits are per plan, in requests a second / a minute / a day: Free 1 / 2 / 10, Basic 2 / 40 / 500, Growth 3 / 60 / 1,000, Pro 5 / 100 / 4,000. Pro Plus and Scale have no limit, and Enterprise allows 100,000 requests a day with no per-second limit. Every response carries rate-limit headers; see Rate limits .

Can I get webhook notifications for bulk catch-all verification?

Yes. Set a webhook URL when creating a bulk operation. Tomba sends a POST notification with the operation ID and result summary when processing completes.

How are credits calculated for catch-all verification?

Each verification attempt uses 1 credit. If the verification fails or returns no result, no credit is consumed. Catch-all verification uses the same credit pool as standard verification no separate charges.

// catch-all verification

Verify Emails That Other Tools Can't Check

Standard verifiers fail on catch-all domains because the server accepts everything. Tomba delivers accurate deliverability verdicts using deep SMTP analysis, pattern matching, and AI scoring trusted by 150,000+ professionals.

Get free API key API reference

// api console

GET /email-verifier

curl "https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY"

const res = await fetch("https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com", {
  headers: {
    "X-Tomba-Key": process.env.TOMBA_API_KEY,
    "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY
  }
});
const { data } = await res.json();

import os, requests

res = requests.get(
    "https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com",
    headers={
        "X-Tomba-Key": os.environ["TOMBA_API_KEY"],
        "X-Tomba-Secret": os.environ["TOMBA_SECRET_KEY"],
    },
)
data = res.json()["data"]

Example response from the API reference

email.email: richard@piedpiper.com
email.result: deliverable
email.status: valid
email.score: 99
email.smtp_provider: Google
email.accept_all: false
email.disposable: false
email.webmail: false
email.greylisted: false

Based on verified reviews

// 01 · request

Catch-all Verifier is one HTTPS request

Send the parameters with your key and secret. Every SDK, the CLI and the MCP server make this same call.

GET/email-verifierParameter

emailrequired: The address to verify
enrich_mobilefalse: Also return phone numbers

// official sdks

The same call from 13 official libraries, each one a thin wrapper over the REST API.

C#
Dart
Deno
Elixir
Go
Lua
Node.js
Perl
PHP
Python
R
Ruby
Rust

Libraries in the docs

// 02 · response

What comes back

JSON, the same in every language. Fields Tomba doesn't know are null, never guessed.

GET/email-verifierField

data.email.resultstring: deliverable, risky or undeliverable; empty for a disposable domain
data.email.statusstring: valid, accept_all, invalid, unknown or disposable (compare case-insensitively: a live check can return Valid)
data.email.scoreinteger: Confidence: 99 for valid, 77 or more for accept_all, 2 for disposable
data.email.smtp_providerstring | null: Mail provider from the MX records, such as Google
data.email.mx.recordsarray | null: The domain's MX hosts
data.email.mx_check, data.email.smtp_checkboolean: The domain has MX records (smtp_check is the same check; status says whether the mailbox exists)
data.email.accept_all, data.email.greylisted, data.email.blockboolean: Catch-all domain, check deferred, check refused by the server
data.email.disposable, data.email.webmail, data.email.gibberish, data.email.regexboolean: Disposable or webmail domain, random-looking address, valid syntax
data.sources[]array: Where the address was found
data.phone_data[]array | null: Phone numbers, when you send enrich_mobile

GET /email-verifier

200 OK· 1 verification credit

{
  "data": {
    "email": {
      "email": "richard@piedpiper.com",
      "result": "deliverable",
      "status": "valid",
      "score": 99,
      "smtp_provider": "Google",
      "mx": {
        "records": [
          "aspmx.l.google.com",
          "alt1.aspmx.l.google.com"
        ]
      },
      "mx_check": true,
      "smtp_server": true,
      "smtp_check": true,
      "accept_all": false,
      "greylisted": false,
      "block": false,
      "gibberish": false,
      "disposable": false,
      "webmail": false,
      "regex": true,
      "whois": {
        "registrar_name": null,
        "referral_url": null,
        "created_date": null
      }
    },
    "sources": [
      {
        "uri": "https://piedpiper.com/blog/engineering",
        "website_url": "piedpiper.com",
        "extracted_on": "2024-06-01T09:14:07+01:00",
        "last_seen_on": "2025-01-10T17:02:44+01:00",
        "still_on_page": true
      }
    ],
    "phone_data": null
  }
}

// 03 · cost and limits

What a call costs

A call is charged only under the condition below. Rate limits depend on your plan.

// cost

1verification credit

Charged when: The status is not disposable or unknown.

Errors, 429 and 451 responses, and the same request again within your usage window cost nothing.

How credits work

// rate limits

Requests per second / minute / day

	Free	Basic	Growth	Pro
Search, finder, similar, technology	1 / 2 / 5	3 / 50 / 500	5 / 80 / 1,000	8 / 150 / 4,000
Email verifier	1 / 2 / 10	2 / 40 / 500	3 / 60 / 1,000	5 / 100 / 4,000

Pro Plus, Scale and credit packs of 50,000 or more: no limit on these endpoints. Enterprise: no per-second or per-minute limit, 100,000 requests a day. Daily limits reset at 00:00 UTC. Rate limits

// 04 · use it anywhere

Catch-all Verifier beyond the API

The same endpoint, and the same credits, behind the app and every integration.

// 05 · capabilities

Why Professionals Trust Tomba's Catch-All Verification

Go beyond accept-all status with proven deliverability intelligence.

Deep SMTP Handshake
Goes beyond basic MX lookups. Advanced SMTP probing detects whether a specific mailbox is actively receiving mail giving you verified results, not guesses.
AI-Powered Risk Assessment
Machine learning trained on millions of catch-all results scores each address for actual deliverability risk so you send with confidence.
Instant Confidence Score
Every result includes a 0-100 confidence score. Set your own threshold to guarantee only verified, deliverable emails reach your outreach lists.
Comprehensive Risk Flags
Identifies hidden threats disposable domains, role-based addresses, honeypots, and spam traps lurking behind catch-all configurations.
Bulk Verification at Scale
Upload a CSV of catch-all emails and verify them all at once. Our latest engine processes lists 400% faster than before.
Free Verification Credits Included
Catch-all verification credits are included free on every Tomba plan. No separate tool, no extra charges guaranteed.

// use cases

What teams build with Catch-all Verifier

// faq

Catch-All Email Verification Questions

Still have questions? Visit the help center

Verify Emails That Other Tools Can't Check

Catch-all Verifier is one HTTPS request

What comes back

What a call costs

Catch-all Verifier beyond the API

Why Professionals Trust Tomba's Catch-All Verification

Deep SMTP Handshake

AI-Powered Risk Assessment

Instant Confidence Score

Comprehensive Risk Flags

Bulk Verification at Scale

Free Verification Credits Included

What teams build with Catch-all Verifier

Catch-All Email Verification Questions

Make your first call in a minute