✉ validmail.dev
no signup · no keys · deterministic · free

Email validation with
nothing to hide.

Syntax, MX, disposable-domain, free-provider, role-based and typo checks in a single GET. Built for signup forms, list cleaning and CRM hygiene: no black-box scoring, every check visible, free tier with no card.

Try it live Read the docs

One call, 6 checks

Every response field is documented and deterministic — no opaque scores.

✉️Syntax (RFC 5322)structure, quoted locals, length limits
📡MX lookupdoes the domain actually accept mail
🔥Disposable domainsthrowaway inboxes and alias services, subdomains included
🏠Free providersconsumer mailboxes flagged — 120+ providers, regional variants
👥Role mailboxesinfo@, support@, billing@ — token-aware, no false positives
✏️Typosgmial.com → gmail.com, Damerau-matched and popularity-ranked

Try it

Live demoreal endpoint
try:
result appears here

That was the real API, no signup needed — free tier is 50 checks/day per IP (resets 00:00 UTC). See the docs for the full reference.

Use it

# verdict, score, suggestion and per-check detail in one GET — no key needed
curl "https://validmail.dev/v1/[email protected]"

Free tier: 50 validations/day per IP, no signup, no card. Full reference in the docs below.

Where teams use it

Validate emails on signup forms

Catch typos and throwaways at the door, before they enter your users table.

 Clean newsletter lists before you send

Flag dead domains and throwaway signups before your sender reputation pays for them.

 Keep CRM contact data clean

Normalize and verify contacts at import time instead of paying for them forever.

 Filter contact-form spam

Throwaway addresses in your contact form usually mean throwaway messages.

 Qualify SaaS trial signups

Know at signup whether a trial is a business inbox or a burner.

 Verify purchased marketing lists

Audit a list's quality before you spend a campaign on it.

FAQ

What's the difference between valid, risky and invalid?

invalid fails hard (bad syntax, no MX, or a disposable domain). risky is deliverable-looking but worth a second look — role mailboxes, typo suggestions, transient DNS errors. valid passed everything.

Can I allow disposable emails after all?

Yes — pass allow_disposable=true and disposable domains downgrade from invalid to risky instead of hard-failing.

Do you store the addresses I check?

No. Usage logging stores the request path only — never the query string, never the address. Rate limiting uses a one-way hash of your IP, never the raw address.

Do I need an API key or account?

Not right now. The free tier is 50 checks/day per IP, open to everyone. Accounts and keys (for higher volumes and attribution) come later — the endpoint already accepts optional x-api-key headers, so you can adopt one without changing your integration.

How are typo suggestions ranked?

Damerau-Levenshtein distance (transpositions count as one edit, like real typing), then same-TLD candidates, then provider popularity. Same input, same answer — always.