Why do standard verifiers fail on catch-all domains?

Catch-all servers accept all incoming email regardless of the recipient. Standard verifiers only check if the server accepts the address: which it always does. This produces false valid results for every address, including non-existent ones. Tomba solves this with deep SMTP analysis and AI scoring.

How is Tomba's catch-all verification different?

Tomba combines advanced SMTP probing, pattern analysis across known employees, cross-referencing against 450M+ verified contacts, and AI scoring to determine if a mailbox is actively monitored: not just accepted by the server. Trusted by 150,000+ professionals for accurate results.

What results will I get?

Each email receives a clear status (valid, risky, invalid), a confidence score (0-100), and detailed risk flags (catch-all, role-based, disposable, etc.). Filter by confidence threshold before using results: so you only send to verified addresses.

Should I send to catch-all emails with low confidence?

Send only to catch-all addresses with confidence scores above 70. Below that threshold, bounce risk increases significantly. For cold outreach, stick to 80+ to protect your sender reputation and maximize deliverability.

Do catch-all verification credits cost extra?

Never. All verification credits: including catch-all verification: are included free on every Tomba plan. No separate purchase, no hidden fees. Guaranteed.

What is the rate limit for catch-all verification?

Limits are per plan, in requests a second / a minute / a day: Free 1 / 2 / 10, Basic 2 / 40 / 500, Growth 3 / 60 / 1,000, Pro 5 / 100 / 4,000. Pro Plus and Scale have no limit, and Enterprise allows 100,000 requests a day with no per-second limit. Every response carries rate-limit headers; see Rate limits .

Can I get webhook notifications for bulk catch-all verification?

Yes. Set a webhook URL when creating a bulk operation. Tomba sends a POST notification with the operation ID and result summary when processing completes.

How are credits calculated for catch-all verification?

Each verification attempt uses 1 credit. If the verification fails or returns no result, no credit is consumed. Catch-all verification uses the same credit pool as standard verification: no separate charges.

// catch-all verifier

Verify addresses on domains that accept everything

A catch-all server accepts every address, so a plain mailbox check can't tell a real inbox from a typo. Tomba marks these addresses accept_all and scores them.

Get free API key API reference

// api console

GET /email-verifier

curl -G https://api.tomba.io/v1/email-verifier \
  --data-urlencode "email=ab@tomba.io" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY"

const params = new URLSearchParams({
  email: "ab@tomba.io"
});
const res = await fetch(`https://api.tomba.io/v1/email-verifier?${params}`, {
  headers: {
    "X-Tomba-Key": process.env.TOMBA_API_KEY,
    "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY
  }
});
const { data } = await res.json();

import os, requests

res = requests.get(
    "https://api.tomba.io/v1/email-verifier",
    params={
        "email": "ab@tomba.io",
    },
    headers={
        "X-Tomba-Key": os.environ["TOMBA_API_KEY"],
        "X-Tomba-Secret": os.environ["TOMBA_SECRET_KEY"],
    },
)
data = res.json()["data"]

ExampleExample response from the API reference

ab@tomba.io

deliverableProvider · Google Workspace

Syntax
MX records
Mail server
Mailbox (SMTP)
Not catch-all
Not disposable
Not webmail
Not gibberish

// teams at these companies use tomba

// 01 · in the app

Catch-all Verifier in the Tomba app

Verify an address in the web app: on a catch-all domain it shows as accept_all with its score, never as valid.

app.tomba.io/verify/gavin@hooli.com

Email Verifier

gavin@hooli.com

Accept all77% Google

hooli.com accepts mail for any address, so the Catch-all Verifier checks this mailbox further.

Format validation

Valid syntax Yes
Gibberish No

Domain type

Webmail No
Disposable No

// also in

// 02 · the api

Catch-all Verifier is one HTTPS request

Send the parameters with your key and secret. Every SDK, the CLI and the MCP server make this same call.

GET/email-verifier

emailrequired: The address to verify
enrich_mobilefalse: Also return phone numbers

// cost

Rate limits by plan

1verification credit

Charged when: The status is not disposable or unknown. Phone numbers returned with enrich_mobile cost 5 search credits each, from the search allowance.

Errors, 429 and 451 responses, and the same request again within your usage window cost nothing.

13 official SDKs: C#, Dart, Deno, Elixir, Go, Lua, Node.js, Perl, PHP, Python, R, Ruby, Rust. Libraries in the docs

GET /email-verifier

200 OK· 1 verification credit

{
  "data": {
    "email": {
      "email": "richard@piedpiper.com",
      "result": "deliverable",
      "status": "valid",
      "score": 99,
      "smtp_provider": "Google",
      "mx": {
        "records": [
          "aspmx.l.google.com",
          "alt1.aspmx.l.google.com"
        ]
      },
      "mx_check": true,
      "smtp_server": true,
      "smtp_check": true,
      "accept_all": false,
      "greylisted": false,
      "block": false,
      "gibberish": false,
      "disposable": false,
      "webmail": false,
      "regex": true,
      "whois": {
        "registrar_name": null,
        "referral_url": null,
        "created_date": null
      }
    },
    "sources": [
      {
        "uri": "https://piedpiper.com/blog/engineering",
        "website_url": "piedpiper.com",
        "extracted_on": "2024-06-01T09:14:07+01:00",
        "last_seen_on": "2025-01-10T17:02:44+01:00",
        "still_on_page": true
      }
    ],
    "phone_data": null
  }
}

GET/email-verifier

data.email.resultstring: deliverable, risky or undeliverable; empty for a disposable domain
data.email.statusstring: valid, accept_all, invalid, unknown or disposable (compare case-insensitively: a live check can return Valid)
data.email.scoreinteger: Confidence: 99 for valid, 77 or more for accept_all, 2 for disposable
data.email.smtp_providerstring | null: Mail provider from the MX records, such as Google
data.email.mx.recordsarray | null: The domain's MX hosts
data.email.mx_check, data.email.smtp_checkboolean: The domain has MX records (smtp_check is the same check; status says whether the mailbox exists)
data.email.accept_all, data.email.greylisted, data.email.blockboolean: Catch-all domain, check deferred, check refused by the server
data.email.disposable, data.email.webmail, data.email.gibberish, data.email.regexboolean: Disposable or webmail domain, random-looking address, valid syntax
data.sources[]array: Where the address was found
data.phone_data[]array | null: Phone numbers, when you send enrich_mobile

// 03 · verdicts

What each status means

Every check returns a status and a result. Disposable and unknown answers are free.

valid1 verification credit
The mailbox exists and accepts mail.
Send.
accept_all1 verification credit
The server accepts mail for any address, so this mailbox can’t be confirmed.
Send with care, or verify again later.
unknownFree
The check was inconclusive: the server blocked it or didn’t answer.
Verify again later.
invalid1 verification credit
The mailbox doesn’t exist.
Remove it from your list.
disposableFree
The domain is a disposable email provider.
Treat it as undeliverable.

status	result	Meaning	What to do	Cost
`valid`	deliverable	The mailbox exists and accepts mail.	Send.	1 verification credit
`accept_all`	risky	The server accepts mail for any address, so this mailbox can’t be confirmed.	Send with care, or verify again later.	1 verification credit
`unknown`	risky	The check was inconclusive: the server blocked it or didn’t answer.	Verify again later.	Free
`invalid`	undeliverable	The mailbox doesn’t exist.	Remove it from your list.	1 verification credit
`disposable`	(empty)	The domain is a disposable email provider.	Treat it as undeliverable.	Free

Status values in the docs

// 04 · customers

What customers say

Tomba is my go-to to validate emails. Even though I might have others to do a waterfall process with, Tomba is usually the top choice in it.
Nuno PocoSales Automation Architect, clickworks.io
Great Value for Money! The Data Accuracy rating and insights as to where and when they found the data. The responsiveness of their help team.
Leon W.Sales Directorvia G2

// 05 · capabilities

What you learn about a catch-all address

Accept-all isn't valid. Tomba shows what it knows so you can choose.

Never passed off as valid
The status reads accept_all, so a catch-all yes is never mistaken for a confirmed mailbox.
A score from 0 to 100
Set your own threshold for what gets sent.
Mail server and provider
See the MX records and the provider behind them, such as Google Workspace.
Disposable and webmail flags
Throwaway and free webmail addresses are marked whatever the server says.
Bulk verification
Upload a CSV and get each row's status and score back.
The same API call
The Email Verifier endpoint returns accept_all: one verification credit, no separate tool.

// 06 · use cases

What teams build with Catch-all Verifier

// 07 · questions

Catch-all Verifier: quick answers

Still have questions? Visit the help center

// verify before you send

Check every address before it bounces

Verify one address in the app or the extension, or a whole list in a bulk job. Verification credits come with every paid plan, separate from search credits.

Compare plans Create a free account

Paid plans from $49 a month. Cancel anytime.

Verify addresses on domains that accept everything

Catch-all Verifier in the Tomba app

Catch-all Verifier is one HTTPS request

What each status means

What customers say

What you learn about a catch-all address

Never passed off as valid

A score from 0 to 100

Mail server and provider

Disposable and webmail flags

Bulk verification

The same API call

What teams build with Catch-all Verifier

Catch-all Verifier: quick answers

Check every address before it bounces