Email Validation
What is Email Validation?
The syntactic and structural check of an email string against RFC 5322 formatting rules (verifying the local-part, `@` symbol, domain labels, and TLD), which serves as the fast first stage before deeper DNS MX and SMTP mailbox verification.
Why Email Validation Matters in Production
Client-side regex or basic syntax validation catches obvious typos like `john@@gmail..com`, but cannot tell you whether `[email protected]` actually exists. Relying on syntax validation alone still leaves your application exposed to hard bounces and burner domains.
Engineering & Sender Best Practices
- • Use lightweight RFC 5322 syntax validation on the frontend for instant user feedback on typos (`gmial.com` -> `gmail.com`).
- • Always pair frontend validation with backend MailVeri API verification to check MX records, disposable status, and live SMTP existence.
- • Normalize provider-specific alias syntax (such as Gmail dots and `+tag` suffixes) before checking uniqueness in your database.
- • Support internationalized domain names (IDN punycode) and valid `+` addressing for legitimate users.
Two-Tier Frontend Syntax Validation + Backend SMTP Verification
A developer tools platform relied solely on a standard HTML5 type="email" input and an RFC 5322 regex in their Node.js backend. Attackers bypassed it effortlessly using syntactically valid addresses on dead domains ([email protected]) and disposable burners. Replacing regex-only checks with instant frontend typo hints plus a backend MailVeri API call eliminated 100% of dead-domain and burner registrations.
Technical Implementation & Wire Example
POST https://api.mailveri.com/v1/verify-mail/ HTTP/1.1
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
{
"email": "[email protected]"
}
HTTP/1.1 200 OK
Content-Type: application/json
{
"email": "[email protected]",
"syntax_valid": true,
"mx_found": true,
"status": "INVALID",
"reason": "smtp_550_mailbox_not_found"
}An address can pass regex syntax validation and MX lookup yet still be INVALID when probed via SMTP.
MailVeri 7-Status Verification Reference & Sender Action Matrix
Keep Campaign Bounces < 2%| Status | Technical Meaning | Bounce Risk | Recommended Sender Action |
|---|---|---|---|
| VALID | Mailbox exists and actively accepts mail | < 0.5% (Safe) | Safe for cold outbound, newsletters, and transactional sends |
| INVALID | Syntax error, dead MX, or 550 mailbox does not exist | 100% Hard Bounce | Suppress immediately; block at signup |
| DISPOSABLE | Temporary burner address (100,000+ tracked domains) | High / Fake User | Reject at signup form; purge from CRM |
| CATCH_ALL | Domain accepts all mail regardless of local-part | 12–28% Deferred | Isolate to secondary sending domains; allow on SaaS signup |
| ROLE_ACCOUNT | Verified shared inbox (info@, support@, sales@) | Complaint Risk | Skip in 1-on-1 cold email; allow if opted in |
| FULL_INBOX | Recipient mailbox exceeded storage quota (452 / 552) | Soft / Hard Bounce | Pause sends for 30 days and re-verify before mailing |
| UNKNOWN | Transient mail server deferral or timeout (0 credits billed) | Unverified | Fail open on signup; re-verify via bulk batch before cold blast |
Email Verification vs. Email Validation: What Is the Difference? →
Understand why regex syntax validation is only Step 1 and how deep SMTP verification prevents hard bounces.
Free Verification & Address Types Tools & Workflows
Frequently Asked Questions About Email Validation
Why is regex email validation not enough for production web applications?
Regex only checks character formatting (e.g., whether there is an @ symbol and a dot). It cannot check whether the domain exists in DNS, whether it has live MX servers, whether it is a disposable burner, or whether the mailbox actually exists on the mail server.
How do Gmail dot and plus-address normalization work during validation?
Gmail and ProtonMail ignore periods in the local-part ([email protected] routes to [email protected]) and ignore everything after a plus sign ([email protected]). Microsoft Outlook, Yahoo, and custom corporate domains treat dots as distinct mailboxes—so normalization rules must be provider-aware.
What should my signup form do if the verification API returns status="UNKNOWN"?
Always fail open on signup forms when status is UNKNOWN (which happens when a recipient mail server temporarily times out or defers). Allow the user to register and require email link/OTP confirmation, while blocking deterministic INVALID and DISPOSABLE statuses.
Closely Related Terms
Explore All Email Verification Terms (A–Z)
Glossary Index →Ready to start verifying emails?
Get 1,000 free credits when you sign up. No credit card required.