Email Validator - Syntax, MX & Deliverability

Why validation is a funnel, not a boolean

A valid-looking address can still bounce: the user mistyped a lookalike domain, the domain expired yesterday, or the mailbox is full. A “risky” address might still be legitimate (corporate gateways, strict greylisting). Good products combine syntax, DNS, and behavioral signals—opens, clicks, payment success—rather than rejecting aggressively at signup. Validation’s job is to stop obvious garbage and surface configuration errors before you pay your ESP for useless sends.

Syntax: RFC reality versus product choices

RFCs allow surprising local-parts; many SaaS products intentionally restrict characters to reduce fraud. Document your rules: are +tags allowed? Internationalized domain names? Quoted strings? If your regex is stricter than SMTP reality, say so in UI copy to avoid support tickets. Normalization matters: lowercasing the domain, punycode for IDNs, and consistent trimming prevent duplicate accounts.

DNS, MX, and the hosting migration footgun

Mail moves when MX points elsewhere—often forgotten during DNS provider changes while A records for the website were updated perfectly. A validator that resolves MX highlights “domain exists, mail mispointed” instantly. Also verify that MX hostnames resolve to A/AAAA records and that those hosts answer on port 25 from the internet (some firewalls block outbound checks). For deeper domain ownership questions, domain WHOIS complements DNS: registration might be active while MX is simply wrong.

SMTP probes, greylisting, and ethics

Some validators SMTP-handshake without delivering mail. Recipients may greylist transient failures, causing flaky results if you do not retry politely. Respect rate limits; do not use validation as a cover for harvesting addresses. Catch-all domains accept arbitrary local-parts, so RCPT TO success does not prove a human inbox exists—track engagement instead. Some environments block SMTP probes entirely; in that case, rely on syntax plus MX existence and monitor hard bounces after the first send. That is a legitimate operational mode for privacy-sensitive or highly locked-down recipients. Document the limitation for your support team so they do not promise “verified inbox” when you only verified DNS.

Deliverability, reputation, and abuse prevention

Even perfect addresses fail on blacklisted IPs or missing SPF/DKIM/DMARC. Run IP blacklist checks on your sending egress when campaigns suddenly underperform. Align From domains with authenticated DNS; the DNS lookup tool is the quickest way to confirm TXT records for SPF and DMARC. Validation is the first gate; authentication and reputation are the long game. High-assurance flows (payments, account recovery) benefit from correlation: does the domain’s registration look fresh or parked? Domain WHOIS plus MX checks catches throwaway brands used for credential phishing. For bulk imports, validate in batches with backoff so you do not resemble a spam cannon to someone else’s MX. Log validation outcomes to tune thresholds—if 5% of “risky” addresses convert and never bounce, your rules are miscalibrated.