# Check if an e-mail mailbox exists

> Find out whether an e-mail address has a live mailbox at a major webmail provider before you send a code or accept a sign-up. Unknowns are free.

Canonical: https://mobilevalidate.com/services/email-verification · Last updated: 2026-09-25

![An e-mail envelope routed to mail servers found in DNS; two mailboxes are confirmed and one answer is unknown.](https://mobilevalidate.com/images/email-mailbox-verification.svg)

*E-mail checks look up the domain's mail servers, then whether the mailbox exists.*


The mailbox check answers one question: does this e-mail address have a working mailbox at its provider? You get `registered: true`, `false` or `null` (unknown), plus the time we checked. It covers major webmail providers, runs in real time or in bulk jobs, and never sends mail to the address or reads the mailbox.

## What does the mailbox check tell you?

It tells you whether the mailbox behind an address exists at the provider that hosts it. A syntax check only proves that an address is well formed. `jane.doe@gmail.com` and `jane.dooe@gmail.com` both pass syntax, but only one of them may exist.

- `registered: true`: the provider has a mailbox at this address.
- `registered: false`: we got a conclusive answer, and there is no such mailbox.
- `registered: null`: no conclusive answer. `status` and `reason` explain why, and you are not charged.

Coverage is intentionally narrow. The check answers only for **major webmail providers**, where most consumer sign-ups come from. Company and custom domains run their own mail servers with their own rules, so they answer `unknown` with `reason: UNSUPPORTED_PROVIDER`. That result is free. Addresses on a typo domain, such as a misspelled provider name, also fall outside coverage. A format check or a domain allow-list in your form catches those.

## Who uses it, and why?

Teams use the mailbox check at the moment an address first enters their system. That is when a mistake or a fake is cheapest to catch.

- **Sign-up and OTP protection.** Fake accounts are often created with made-up addresses at big webmail providers. A `false` answer before you send a confirmation link keeps them out. See [OTP and sign-up fraud](/use-cases/otp-and-signup-fraud).
- **Deliverability.** Sending to mailboxes that don't exist produces hard bounces, which hurt sender reputation. Checking first keeps receipts and password-reset mail flowing.
- **Lead verification.** A form lead whose address has no mailbox is either a typo you can fix while the person is still on the page, or a lead that isn't worth a sales call. See [lead verification](/use-cases/lead-verification).

The per-provider account checks, such as the [Gmail check](/services/gmail-email-check), answer a different question: whether an account exists at that one provider. The mailbox check is the general-purpose, real-time option.

## What do you get back?

Every address becomes one result row with `kind: "email"`. Each requested check gets one entry in `checks`.

| Field | Type | Meaning |
|---|---|---|
| `email` | string or null | The normalized address (trimmed, lowercased); `null` when invalid |
| `email_status` | enum | `valid`, `invalid_email`, `duplicate` or `suppressed` |
| `checks["email.valid"].registered` | boolean or null | `true` mailbox exists, `false` no mailbox, `null` unknown |
| `…status` | enum | `completed`, `pending`, `unknown`, `unsupported_country` or `failed` |
| `…reason` | string or null | e.g. `UNSUPPORTED_PROVIDER`, `UPSTREAM_TIMEOUT` |
| `…confidence`, `…checked_at` | enum, timestamp | How sure the answer is, and when it was obtained |
| `…cached`, `…billed` | boolean | Whether it came from your cache, and whether it was charged |

`e164` and `country` are always `null` on e-mail rows. When you read results back later, the input is masked (for example `re•••@test.mobilevalidate.com`).

## How is it billed?

You pay per address checked, and only for conclusive answers. You're not charged for inconclusive results (unknown, unsupported country, timeout, invalid, duplicate). That covers addresses outside provider coverage too. They answer `unknown` with `UNSUPPORTED_PROVIDER`, so a list full of company domains doesn't cost you anything for those rows. Real-time and bulk have separate per-check prices. See [pricing](/pricing).

Repeat checks of the same address inside the freshness window can come from your account's cache. Cache hits are free and marked `cached: true, billed: false`. `max_age: 0` forces a fresh check, which is billed. `max_cost` puts a ceiling on a request.

## What are the limits?

The mailbox check runs in real time (`POST /v1/lookup`, up to 100 numbers and e-mails together) and in bulk jobs (`POST /v1/jobs`, up to 50,000 per job). Put addresses in `emails`, not `numbers`. A request with e-mails but no e-mail check is refused with `invalid_request`.

- Up to 20 checks per request. The total of identifiers × applicable checks is capped at 2,000 per lookup and 100,000 per job.
- Requests that look like sequential number ranges or generated e-mail lists are rejected. For e-mail, that means 20 or more addresses in one request on one domain whose local parts differ only by digits or separators (`john1@`, `john.2@`, `john_3@`). Live keys are also limited to 50 addresses of one such pattern per account per UTC day.
- The account's daily cap counts e-mail addresses the same way as phone numbers (see `GET /v1/limits`).
- Test-domain addresses work only with test keys. Live keys get `test_number_only`.

## How do I use it responsibly?

Check addresses that people gave you, or that you otherwise have a lawful reason to process. Examples are a sign-up form, a checkout or an existing customer record. We never read mailboxes and never send e-mail to the address. The answer is only yes, no or unknown, and never includes a name, avatar or profile.

Don't use the check to guess addresses, to test variations of a name, or to build lists for unsolicited e-mail. The [acceptable use policy](/legal/acceptable-use) forbids all three, and the anti-enumeration rules above block the most common patterns. Anyone can object to having their address checked through the [opt-out form](/opt-out). Suppressed addresses answer `email_status: suppressed` and are never charged.

## Example request

With a test key (`mv_test_…`), addresses on `test.mobilevalidate.com` return fixed answers: `registered@` answers yes, `unsupported@` shows the `UNSUPPORTED_PROVIDER` case. See [test mode](/docs/test-mode).

```bash
curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"emails": ["registered@test.mobilevalidate.com"], "checks": ["email"]}'
```

Response (excerpt, test mode: the first item of `results`):

```json
{
  "kind": "email",
  "input": "registered@test.mobilevalidate.com",
  "email": "registered@test.mobilevalidate.com",
  "email_status": "valid",
  "e164": null,
  "country": null,
  "checks": {
    "email.valid": {
      "service": "email.valid",
      "status": "completed",
      "registered": true,
      "attributes": null,
      "confidence": "high",
      "confidence_score": 0.99,
      "checked_at": "2026-09-25T14:25:31.473Z",
      "cached": false,
      "age_seconds": 0,
      "billed": false,
      "reason": null,
      "poll_after_ms": null
    }
  },
  "test": true
}
```

## Frequently asked questions

### Does the check send an e-mail to the address?

No. Nothing is sent to the address and no mailbox is opened or read. The check only answers whether the mailbox exists: yes, no or unknown.

### Which addresses can be checked?

Addresses at major consumer webmail providers. Addresses on other domains, such as company or custom domains, come back as unknown with the reason UNSUPPORTED_PROVIDER, and you are not charged for them.

### Is this the same as checking the address format?

No. A format check only tells you an address could exist. This check tells you whether the mailbox does exist at the provider. Addresses with an invalid format are marked invalid_email and are never checked or charged.

### Do you treat j.doe@ and jdoe@ as the same address?

No. We only trim spaces and lowercase the address. We never remove dots or plus tags, because on many providers those are different mailboxes that can belong to different people.

### Can I use the result to build a mailing list?

No. The acceptable use policy forbids unsolicited bulk messaging and list building. Use the check to protect sign-up forms and to keep transactional e-mail deliverable for people who gave you their address.

## Service code and modes

- Code: `email.valid` (input: e-mail address)
- Modes: realtime and bulk · worldwide

## Price (live)

- Realtime (POST /v1/lookup): $0.002 per check ($2.00 per 1,000)
- Bulk (POST /v1/jobs): $0.0015 per check ($1.50 per 1,000)
- You're not charged for inconclusive results (unknown, unsupported country, timeout, invalid, duplicate).

## Response fields (from the public catalog)

| Field | Type | Meaning |
|---|---|---|
| registered | boolean or null | true = found, false = not found, null = unknown (not charged) |
| status | enum | completed, pending, unknown, unsupported_country, failed |
| checked_at | timestamp | When the answer was obtained |