Email Validation API vs Email Verification API — 2026 comparison — SignupDoggy Blog

Email validation API vs email verification API: what is the difference, what each checks, and when to use which. The 2026 developer playbook for choosing between free email validation APIs (SignupDoggy, AbstractAPI, ZeroBounce, Mailcheck). Plus the third problem — signup fraud detection — that nobody talks about.

Email validation vs email verification: what is the difference?

These two terms get used interchangeably in marketing copy and they should not be. Email validation checks the format. Email verification checks the mailbox. They solve different problems, they cost different amounts, and they are used at different points in the signup flow.

This post is the one-pager that explains the difference, when to use which, and why signup fraud detection is a third, separate problem.

Short answer

Email validation = does the email address look like a valid email address? Is the format right? Does the domain exist? This is a regex + DNS lookup, takes ~10ms, costs $0.

Email verification = does the email address actually receive mail? Does the mailbox exist? Is the user actively reading it? This is an SMTP probe, takes 5-30 seconds, costs $0.001-$0.05 per check.

Signup fraud detection = is the user a bot, a throwaway-email user, a VPN user, or a real human? This is a server-side API call against a database of known-bad signals, takes ~50ms, costs $0.01 per call.

You need all three, for different reasons. But you definitely need signup fraud detection, and you probably don't need email verification.

Email validation: format + domain

Email validation is the cheap, fast check you should be doing on every signup. It catches typos, made-up addresses, and obvious garbage.

What it does:
• Checks the format: is there a local part? An @? A domain? A TLD?
• Checks the domain: does the domain have MX records? (Mail servers configured)
• Optionally checks for typos: did the user mean `gmial.com` instead of `gmail.com`?

What it does not do:
• Does not check if the mailbox exists
• Does not check if the user is a real person
• Does not check if the email is from a disposable provider

Tools: ZeroBounce's free tier, Mailcheck.ai's free tier, the `email-validator` npm package, or a 5-line regex.

A working implementation in 30 seconds:

// validation.js
const EMAILRE = /^[^s@]+@[^s@]+.[^s@]+$/;

export function isValidFormat(email) {
  return EMAILRE.test(email);
}

export async function hasMxRecord(domain) {
  try {
    const records = await (await fetch('https://dns.google/resolve?name=' + domain + '&type=MX')).json();
    return records.Answer && records.Answer.length > 0;
  } catch {
    return false;
  }
}

This is a 30-line module. It catches `asdf@asdf`, `user@`, `@example.com`, and made-up domains like `user@thisisnotarealdomain12345.com`. It does not catch `tempmail.com`, `guerrillamail.com`, or any of the 200,000 disposable-email providers.

Email verification: the mailbox actually exists

Email verification is the slow, expensive check that probes the SMTP server to see if the mailbox exists. It catches dead mailboxes, full mailboxes, and typo'd addresses that pass format validation.

What it does:
• Connects to the mail server via SMTP
• Issues an `RCPT TO` command for the address
• The server responds with 250 (mailbox exists) or 550 (mailbox does not exist)
• The verifier returns a verdict

What it does not do:
• Does not check if the user is a real person
• Does not check if the email is from a disposable provider
• Does not check if the email is a real human's primary inbox

Tools: ZeroBounce, BriteVerify, NeverBounce, Kickbox. Typical cost: $0.001-$0.05 per check. Typical latency: 5-30 seconds.

Why you probably don't need it: the use case is 'cleaning a mailing list before a big campaign.' For signup-time validation, the latency is too high (you can't make the user wait 30 seconds for their account to be created) and the false-positive rate is non-trivial (catch-all domains, graylisting, and rate-limited SMTP servers all produce false positives).

Signup fraud detection: is this user legitimate?

Signup fraud detection is the API call that scores a signup for fraud risk. It checks disposable email, VPN/Tor, role-based email patterns, and known bot signatures. It returns a 0-1 risk score and an allow/review/block recommendation.

What it does:
• Checks if the email is from a disposable provider (200,000+ domains)
• Checks if the IP is a Tor exit node, VPN, or hosting ASN
• Checks if the email is a role-based address (admin@, support@, info@)
• Checks if the user-agent is a known bot signature
• Returns a single risk score + recommendation in ~50ms

What it does not do:
• Does not check email format (assumes you've already validated)
• Does not check if the mailbox exists (different problem)
• Does not check device fingerprint (different problem)

Tools: SignupDoggy, IPQualityScore, MaxMind minFraud, Sift. Typical cost: $0.005-$0.10 per call. Typical latency: 50-200ms.

Why you need it: 30-50% of 'signups' on a typical SaaS are bots, throwaway-email users, or abuse accounts. The format-validation pass-through rate is 100% (all of these have valid-format email addresses). The mailbox-exists check is 95% (most throwaway email providers have working SMTP). Neither catches the actual problem.

The signup-time stack

Here's the stack you should run on every signup, in order:

async function validateSignup(email, ip) {
  // 1. Format validation: free, fast, catches typos
  if (!isValidFormat(email)) return { ok: false, reason: 'invalidformat' };

  // 2. Domain has MX records: free, fast, catches made-up domains
  const domain = email.split('@')[1];
  if (!await hasMxRecord(domain)) return { ok: false, reason: 'nomx' };

  // 3. Disposable email check: $0.01, 50ms, catches the actual problem
  const fraud = await checkDisposableEmail(email, ip);
  if (fraud.recommendation === 'block') return { ok: false, reason: 'disposableemail' };

  return { ok: true };
}

Total cost per signup: $0.01. Total latency: 60ms. Bot catch rate: 99%+.

Skip email verification unless you have a specific use case (mailing list cleaning, B2B lead validation). It is too slow for signup-time use and the false-positive rate is non-trivial.

FAQ

Q: Do I need all three?
A: You need format validation (free) and signup fraud detection ($0.01/call). You probably don't need email verification unless you have a specific mailing-list-cleaning use case.

Q: What about email verification services that promise 'real-time' verification?
A: They are lying. SMTP probing takes 5-30 seconds. Anything claiming sub-second verification is doing format + DNS only, which you can do yourself for free.

Q: Can I do signup fraud detection with a free API?
A: No. The disposable-email blocklist is large, churns quickly, and requires maintenance. A free API will give you a stale list and miss 30%+ of disposable emails.

Q: How does Apple Hide My Email fit?
A: Apple Hide My Email is a real human with a real Apple ID. It is technically disposable (the alias can be revoked) but the user is a real person. Most SaaS companies whitelist it.

Q: What about role-based emails like admin@ or support@?
A: These are not real inboxes — they are shared mailboxes. Block them at signup or flag them for manual review. The conversion rate of `admin@` signups is near zero anyway.

---

About the author

Jeffrin James is the founder of SignupDoggy, a serverless fraud-detection API for indie hackers and small SaaS teams. He built the product in Mumbai, India, after spending six months and $2,400 on enterprise fraud-detection vendors that didn't fit his use case.

Tags:** Email validation, Email verification, Disposable email