MailSift
Features

Checks built for real list-cleaning workflows.

Use MailSift when you need more than a regex and less hand-holding than an enterprise implementation project. The product is shaped for developers, revops teams, and operators who need fast answers at batch scale.

Start free API Docs
The verification pipeline

15+ checks. Every request.

Each call runs a comprehensive pipeline that goes far beyond basic syntax and MX validation.

Syntax & normalization

RFC-compliant local part and domain checks plus provider-aware normalization for Gmail-style aliases.

"syntax": true

MX lookup

Pull live MX records and ignore null-MX domains so undeliverable hosts never enter your funnel.

"mx": true

Disposable detection

Catch throwaway addresses from 500k+ known providers. MX heuristics detect new ones automatically.

"disposable": false

Relay & forwarding

Unmask SimpleLogin, AnonAddy, Apple Hide My Email, and Firefox Relay that hide the real sender.

"relay": false

Domain intelligence

Check domain age, MX provider, and whether the domain is routable, disposable, or parked.

"domain_age_days": 4823

Typo correction

Suggest corrections for common domain typos like gmial.com — before they turn into hard bounces.

"did_you_mean": "gmail.com"

SPF & DMARC

Validate SPF and DMARC records to confirm the domain has proper email security configuration.

"spf": true, "dmarc": true

Role-based detection

Flag info@, sales@, and other inboxes that route to teams instead of a single human.

"role": false

Free provider check

Identify gmail, yahoo, outlook, and other free providers for clean segmentation downstream.

"free": true

Catch-all detection

Spot domains that accept every address so you can route catch-all hits to a separate workflow.

"catch_all": false

MX provider attribution

Map every domain to its hosting provider — Google, Microsoft, Proofpoint, Mimecast, and more.

"mx_provider": "Google"

Local-part anomalies

Detect synthetic patterns like long-digit prefixes that often slip past basic regex validators.

"score": 82

Trust scoring

All 15+ signals combine into a single 0-100 score. Route by risk, not guesswork. Tune per environment.

"score": 95

Normalized email

Canonical address form for deduplication — strips plus-aliases, dots, and provider-specific noise.

"normalized_email": "[email protected]"
Verification modes

Two modes. One credit balance.

Standard is the default on every endpoint. Deep adds one thing: an SMTP conversation with the recipient’s mail server about the mailbox itself. Same endpoints, same credit balance, one parameter apart.

Default

Standard

mode=fast
1credit per email

Everything MailSift can establish from DNS, reputation data, and a domain-level probe.

Speed

Under 100 ms on average.

Answers

Every check in the pipeline above, plus the 0–100 trust score.

Won’t answer

Whether your recipient’s mailbox exists. Standard can prove an address is unreachable. It never proves a mailbox is real.

Pick it when

Signup and checkout validation, inline field checks, list hygiene, routine bulk cleaning.

Opt in per request

Deep Verification

mode=deep
up to5credits per email

Everything in Standard, plus an SMTP conversation with the receiving mail server about the mailbox itself.

Speed

Slower. It waits on a third-party mail server, so no completion time is promised.

Answers

Mailbox acceptance, recipient-specific rejection, catch-all resolution, greylisting detection, and provider-specific interpretation.

Won’t answer

Mailbox existence at providers that conceal it. Those come back as unknown, not as a guess.

Pick it when

Cold outreach, re-engagement sends, high-value signups, anything where a bounce is expensive.

Billing

Deep costs 5 credits only when the SMTP conversation produced real mailbox- or domain-level intelligence. If the standard checks already settled the address, or the conversation was defeated by a timeout, throttling, or a policy block, it costs 1 credit or less. You are never charged 1 plus 5, and there is no separate Deep subscription.

Deep requested, standard checks settled it first:"mode": "deep", "credits_used": 1

Deep reports what the server actually revealed.

Some providers will not confirm mailbox existence. Yahoo and AOL accept recipients they cannot vouch for. Secure gateways like Proofpoint, Mimecast and Barracuda accept every recipient at the perimeter. For those, MailSift returns unknown, usually with catch_all true, instead of dressing an acceptance up as proof. The raw result stays in the response so you can route on it yourself.

Server answeredgmail.com
"smtp": {
  "status": "deliverable",
  "response_code": 250,
  "catch_all": false,
  "mx_host": "gmail-smtp-in.l.google.com",
  "provider": "google"
}
Provider concealed ityahoo.com
"smtp": {
  "status": "unknown",
  "sub_reason": "provider_unverifiable",
  "response_code": 250,
  "catch_all": true,
  "provider": "yahoo"
}

Same request, same response shape. The second address is not an error and not a failed check. It is a mailbox the provider will not discuss, reported as exactly that. Full smtp field and status reference →

Built for shipping

Three surfaces, one platform.

Pick the right entry point for the job — call us inline, run a batch, or listen for events.

Real-time API

Single-call verification

A single GET request returns disposable status, domain reputation, risk score, and 15+ checks. Sub-second median response times in every region.

  • GET /verify with one URL parameter
  • Per-API-key rate limits, predictable quotas
  • Cached results for repeat hits inside a window
  • JSON response includes full check breakdown
Bulk CSV

Stream millions of rows

Upload a CSV, get a job id back instantly, and stream progress over SSE. Read parsed rows for in-app filtering or download the finalized output.

  • Multipart upload up to 32MB per job
  • SSE progress stream for live dashboards
  • Paginated parsed rows for filtering
  • Final CSV download when the job completes
Webhooks

Push results into your stack

Signed webhooks deliver bulk job events to your endpoints so you can wire them into a CRM, queue, or warehouse without polling.

  • HMAC-SHA256 signature on every payload
  • Webhook secret available from /account
  • Fired on bulk job completion and failure
  • Stable event schema versioned with the API
Drop-in API

One request. Complete intelligence.

Choose your language. The request shape stays the same in every SDK.

curl "https://mailsift.dev/api/v1/[email protected]" \
  -H "X-API-Key: msk_your_api_key_here"
Ready when you are

Ship cleaner lists in a single afternoon.

Sign up, generate a key, and run your first verification in under five minutes. Credits never expire.

Start free See pricing