What does an email verifier do?

An email verifier confirms that an email address exists and can receive messages without sending a test email. Tomba's Email Verifier runs 7 comprehensive checks including SMTP verification, MX validation, catch-all detection, and disposable filtering to give you a clear deliverability verdict.

How does Tomba verify emails without sending them?

Tomba connects directly to the email's SMTP server and simulates a delivery handshake. This confirms the mailbox exists without actually sending a message accurate, instant, and non-intrusive.

What checks does the Email Verifier perform?

Each email goes through 7 checks: format validation, domain and MX record verification, SMTP server connection, mailbox existence test, disposable email detection, block list screening, and catch-all domain analysis. The result is a clear confidence score from 0 to 100.

What is the bounce rate for emails marked Valid?

If an address Tomba returned as valid hard-bounces, the credit comes back under the data-quality guarantee (verifier result deliverable or finder score of 60 or more, sent within 30 days from a domain with SPF, DKIM and DMARC).

What does Accept All status mean?

Accept All means the email server accepts all addresses on its domain, whether or not a specific mailbox exists. These addresses carry higher risk than Valid ones. For best results, prioritize Accept All addresses with confidence scores above 80%.

Can I verify emails in bulk?

Yes. Upload a CSV to the Bulk Email Verifier and process thousands of addresses at once. Typical speeds are 1,000 emails in under 5 minutes and 20,000+ in a few hours.

How much does email verification cost?

Each verification uses one credit. If verification fails, no credit is consumed. Free accounts can verify up to 50 email addresses per month. Need more? Check our pricing plans for higher limits.

What is the rate limit for the Email Verifier?

Limits are per plan, in requests a second / a minute / a day: Free 1 / 2 / 10, Basic 2 / 40 / 500, Growth 3 / 60 / 1,000, Pro 5 / 100 / 4,000. Pro Plus and Scale have no limit, and Enterprise allows 100,000 requests a day with no per-second limit. Every response carries rate-limit headers; see Rate limits .

Can I use the Email Verifier with n8n, Make, or Zapier?

Yes. Tomba has native apps for n8n , Make , and Zapier , so you can verify an address inside any automated workflow without writing code. Common setups: verify every new signup before it reaches your CRM, clean a list on a schedule, or block invalid addresses at the form. If you would rather build it yourself, use the Email Verifier API , the CLI , or our MCP server for AI agents.

How does catch-all detection work?

A catch-all (accept-all) domain accepts mail sent to any address, so an ordinary SMTP check reports valid even for mailboxes that do not exist. Tomba detects catch-all domains as part of every verification and reports them as their own status rather than a false Valid. Unlike verifiers that stop there and return unknown, Tomba goes further to resolve many catch-all addresses see the Catch-All Verifier and the Catch-All Finder .

// free email verifier

Verify Any Email Address Before You Hit Send

Stop guessing. Tomba's email verifier runs seven checks (syntax, MX, SMTP mailbox, catch-all, greylisting, disposable and webmail), so you know what will deliver and protect your sender reputation.

Get free API key API reference

// api console

GET /email-verifier

curl "https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com" \
  -H "X-Tomba-Key: $TOMBA_API_KEY" \
  -H "X-Tomba-Secret: $TOMBA_SECRET_KEY"

const res = await fetch("https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com", {
  headers: {
    "X-Tomba-Key": process.env.TOMBA_API_KEY,
    "X-Tomba-Secret": process.env.TOMBA_SECRET_KEY
  }
});
const { data } = await res.json();

import os, requests

res = requests.get(
    "https://api.tomba.io/v1/email-verifier?email=richard%40piedpiper.com",
    headers={
        "X-Tomba-Key": os.environ["TOMBA_API_KEY"],
        "X-Tomba-Secret": os.environ["TOMBA_SECRET_KEY"],
    },
)
data = res.json()["data"]

Example response from the API reference

email.email: richard@piedpiper.com
email.result: deliverable
email.status: valid
email.score: 99
email.smtp_provider: Google
email.accept_all: false
email.disposable: false
email.webmail: false
email.greylisted: false

Based on verified reviews

// 01 · request

Email Verifier is one HTTPS request

Send the parameters with your key and secret. Every SDK, the CLI and the MCP server make this same call.

GET/email-verifierParameter

emailrequired: The address to verify
enrich_mobilefalse: Also return phone numbers

// official sdks

The same call from 13 official libraries, each one a thin wrapper over the REST API.

C#
Dart
Deno
Elixir
Go
Lua
Node.js
Perl
PHP
Python
R
Ruby
Rust

Libraries in the docs

// 02 · response

What comes back

JSON, the same in every language. Fields Tomba doesn't know are null, never guessed.

GET/email-verifierField

data.email.resultstring: deliverable, risky or undeliverable; empty for a disposable domain
data.email.statusstring: valid, accept_all, invalid, unknown or disposable (compare case-insensitively: a live check can return Valid)
data.email.scoreinteger: Confidence: 99 for valid, 77 or more for accept_all, 2 for disposable
data.email.smtp_providerstring | null: Mail provider from the MX records, such as Google
data.email.mx.recordsarray | null: The domain's MX hosts
data.email.mx_check, data.email.smtp_checkboolean: The domain has MX records (smtp_check is the same check; status says whether the mailbox exists)
data.email.accept_all, data.email.greylisted, data.email.blockboolean: Catch-all domain, check deferred, check refused by the server
data.email.disposable, data.email.webmail, data.email.gibberish, data.email.regexboolean: Disposable or webmail domain, random-looking address, valid syntax
data.sources[]array: Where the address was found
data.phone_data[]array | null: Phone numbers, when you send enrich_mobile

GET /email-verifier

200 OK· 1 verification credit

{
  "data": {
    "email": {
      "email": "richard@piedpiper.com",
      "result": "deliverable",
      "status": "valid",
      "score": 99,
      "smtp_provider": "Google",
      "mx": {
        "records": [
          "aspmx.l.google.com",
          "alt1.aspmx.l.google.com"
        ]
      },
      "mx_check": true,
      "smtp_server": true,
      "smtp_check": true,
      "accept_all": false,
      "greylisted": false,
      "block": false,
      "gibberish": false,
      "disposable": false,
      "webmail": false,
      "regex": true,
      "whois": {
        "registrar_name": null,
        "referral_url": null,
        "created_date": null
      }
    },
    "sources": [
      {
        "uri": "https://piedpiper.com/blog/engineering",
        "website_url": "piedpiper.com",
        "extracted_on": "2024-06-01T09:14:07+01:00",
        "last_seen_on": "2025-01-10T17:02:44+01:00",
        "still_on_page": true
      }
    ],
    "phone_data": null
  }
}

// 03 · cost and limits

What a call costs

A call is charged only under the condition below. Rate limits depend on your plan.

// cost

1verification credit

Charged when: The status is not disposable or unknown.

Errors, 429 and 451 responses, and the same request again within your usage window cost nothing.

How credits work

// rate limits

Requests per second / minute / day

	Free	Basic	Growth	Pro
Search, finder, similar, technology	1 / 2 / 5	3 / 50 / 500	5 / 80 / 1,000	8 / 150 / 4,000
Email verifier	1 / 2 / 10	2 / 40 / 500	3 / 60 / 1,000	5 / 100 / 4,000

Pro Plus, Scale and credit packs of 50,000 or more: no limit on these endpoints. Enterprise: no per-second or per-minute limit, 100,000 requests a day. Daily limits reset at 00:00 UTC. Rate limits

// 04 · use it anywhere

Email Verifier beyond the API

The same endpoint, and the same credits, behind the app and every integration.

// 05 · capabilities

What Email Verifier does for you

SMTP Verification
Connect directly to the mail server to confirm the mailbox exists and can receive messages the most reliable deliverability check available.
Syntax Validation
Catch malformed addresses before they waste your credits. Validates format, characters, and structure against RFC standards.
Domain & MX Validation
Confirm the domain is active, properly configured, and has valid MX records to accept incoming email.
SMTP Provider Detection
Identify the exact email provider behind each address Google Workspace, Microsoft 365, Yahoo, and more for smarter segmentation.
Misspelled Domain Detection
Catch common typos (gmial.com, yahho.com) and suggest corrections automatically. Recover contacts that would otherwise bounce.
Disposable Email Detection
Identify temporary and throwaway services like Guerrilla Mail, Temp-Mail, and 500+ others. Keep fake signups out of your list.
Role-Based Detection
Flag generic group addresses (info@, support@, sales@) that do not belong to a specific person so you only contact real decision-makers.
Accept-All Detection
Identify catch-all servers that appear to accept everything but may still bounce. Tomba goes deeper to assess actual deliverability.
Mailbox Full Detection
Detect email addresses with full mailboxes that cannot receive new messages avoid wasting sends on unreachable contacts.
No-Reply Detection
Identify no-reply addresses that should never be contacted or added to outreach lists. Keep your campaigns clean.
Tag & Alias Detection
Detect addresses with tags (user+tag@domain) that may indicate test accounts or filtered addresses.
Secure Gateway Detection
Identify addresses protected by Proofpoint, Mimecast, Barracuda, or other secure email gateways for accurate verification.
Email Quality Score
Every email receives a quality score from 0 to 100 based on all verification checks combined one number, clear decision.
Name & Gender Enrichment
Enrich email addresses with first name, last name, and gender based on pattern analysis add context to every contact.
Email Verification API
Integrate real-time verification into your app with our REST API or official SDKs for Node.js, Python, PHP, Ruby, Go, and more.
API Keys for Every App
Create named API keys for each app or environment, with expiry dates, rotation and reminders.
50+ Integrations
Connect with ActiveCampaign, Brevo, HubSpot, Mailchimp, Salesforce, Zapier, Make, and many more your workflow, your way.
Team Accounts & Permissions
Share credits, manage usage, set granular permissions, and collaborate across your organization with full control.
Automatic Deduplication
Automatically detect and remove duplicate email addresses from your verification lists pay only for unique contacts.
Anti-Greylisting Technology
Greylisting servers ask senders to retry later; the verifier retries instead of returning unknown straight away.

// use cases

What teams build with Email Verifier

// customers

Teams that run Email Verifier every day

The verification accuracy is outstanding. We reduced our bounce rate from 12% to under 2% after switching to Tomba.
Aristotle MalichettyBusiness Intelligence Analyst
Tomba is my go-to to validate emails. Even in a waterfall process with multiple tools, Tomba is usually the top choice.
Nuno PocoSales Automation Architect

// have a question?

Email Verifier

Still have questions? Visit the help center

Verify Any Email Address Before You Hit Send

Email Verifier is one HTTPS request

What comes back

What a call costs

Email Verifier beyond the API

What Email Verifier does for you

SMTP Verification

Syntax Validation

Domain & MX Validation

SMTP Provider Detection

Misspelled Domain Detection

Disposable Email Detection

Role-Based Detection

Accept-All Detection

Mailbox Full Detection

No-Reply Detection

Tag & Alias Detection

Secure Gateway Detection

Email Quality Score

Name & Gender Enrichment

Email Verification API

API Keys for Every App

50+ Integrations

Team Accounts & Permissions

Automatic Deduplication

Anti-Greylisting Technology

What teams build with Email Verifier

Teams that run Email Verifier every day

Email Verifier

Make your first call in a minute