TL;DR
- The form widget checks every email field as the visitor types: typos like gmial.com, throwaway inboxes and dead domains.
- The API lets you check server-side before the account is created, so nothing gets around the form.
- Both are in early access. Ask for a key and we'll set you up with free credits to test.
What bad signups cost you
- Lost real users. Someone who types [email protected] never gets the confirmation email, and you never hear from them again.
- Trial and free-tier abuse. Disposable inboxes make it easy to sign up again and again.
- Bounces on your product email. Welcome, onboarding and billing emails to dead addresses hurt the reputation of the domain you send them from.
- Bad numbers. Fake accounts inflate signups and drag down activation and conversion rates.
Option 1: the form widget
Add one script tag to the page. The widget finds every email input and checks it as the visitor finishes typing.
<script src="https://mailexchange.com/widget.js" data-key="mx_pub_xxxxxxxx" defer></script>- Catches typos in common domains and suggests the fix.
- Flags disposable inboxes so you can ask for a permanent address.
- Rejects domains with no mail server.
- Works with any HTML form, with no backend changes. The public key can only verify, so it's safe in your HTML.
Option 2: check server-side with the API
Client-side checks can be skipped by anyone determined enough. For the decision that matters, call the verification API from your backend when the signup is submitted:
POST https://mailexchange.com/api/v1/verify
{"email": "[email protected]"}The JSON response gives a state, a reason, a score, and disposable, role, free and
accept_all flags. A simple policy:
| Result | Suggested signup action |
|---|---|
| deliverable | Accept |
| risky: disposable | Ask for a permanent address |
| risky: catch-all or role | Accept. Many real businesses use them. Optionally require email confirmation |
| undeliverable | Ask the user to check the address |
| unknown | Accept and rely on your confirmation email. The credit is refunded |
Catch-all and role addresses are a judgement call for signups. A catch-all company domain is often a real customer, so blocking them would cost you sign-ups. What's a risk for cold email isn't always a risk here.
Where to put the check
- Signup and trial forms. The obvious one. Catch the typo before the account is created, so the confirmation email arrives.
- Lead magnets and demo requests. Marketing forms collect fake addresses too, and those leads go straight into your CRM and nurture emails.
- Invite and referral flows. When users type in a colleague's address, a typo means a lost invite.
- Imports. If customers upload contact lists into your product, verify them with the bulk API before your app emails them.
Run the widget for instant feedback and the API on submit if you want both a smooth form and a check that can't be bypassed. Keep the message friendly. A clear "Did you mean gmail.com?" fixes most typos without the visitor feeling blocked.
How the check works
Each address goes through syntax, DNS and MX, risk lists (including disposable providers), an SMTP mailbox check, a catch-all test and a final verdict. We never send an email to the address. Details in how verification works.
Pricing
Each check uses one credit, and unknowns and duplicates are refunded. Packs start at $29 for 5,000 and drop to $0.0017 per check at 1 million. Credits never expire, so a slow signup month doesn't waste them, and monthly plans are 15% off.
Clean the users you already have
Bulk upload works today. Export your user or lead table as a CSV, verify it in the web app, and suppress the undeliverable addresses before your next product email or newsletter. Pricing starts at $29 for 5,000 checks, and credits never expire (pricing).