DEV Community: Arjun CS

Building an Email Verification Middleware for Express.js Signup Forms

Arjun CS — Mon, 07 Sep 2026 17:59:11 +0000

Signup forms are one of those things that look simple until you actually run one in production. You end up scattering the same email-checking logic across every route that touches user creation — signup, invite-a-friend, admin-adds-a-user — and eventually one of those routes forgets the check entirely.

The fix is boring but effective: pull the validation into middleware, run it once, and let every route that needs it just plug it in.

Here's how I set it up.

Step 1: The Problem with Inline Validation

A typical first pass looks like this, copy-pasted into every route that creates a user:

app.post('/signup', async (req, res) => {
  const { email } = req.body;

  if (!email || !email.includes('@')) {
    return res.status(400).json({ error: 'Invalid email' });
  }

  // create user...
});

This works until you have a second route. Then a third. Then someone adds a new "invite teammate" endpoint six months later and forgets the check entirely, because it's not enforced anywhere central — it's just a convention everyone has to remember.

Step 2: Pulling It Out into Middleware

Express middleware is the natural fix here. Define it once, attach it to any route that needs it:

// middleware/verifyEmail.js
function isValidFormat(email) {
  const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return regex.test(email);
}

async function verifyEmailMiddleware(req, res, next) {
  const { email } = req.body;

  if (!email || !isValidFormat(email)) {
    return res.status(400).json({ error: 'Please provide a valid email address' });
  }

  next();
}

module.exports = verifyEmailMiddleware;

Now every route that needs email validation just declares it:

const verifyEmailMiddleware = require('./middleware/verifyEmail');

app.post('/signup', verifyEmailMiddleware, async (req, res) => {
  // by the time we get here, email format is already confirmed
  res.status(200).json({ message: 'Signed up successfully' });
});

app.post('/invite', verifyEmailMiddleware, async (req, res) => {
  // same guarantee, no copy-pasted logic
  res.status(200).json({ message: 'Invite sent' });
});

One place to update the rule, every route inherits it. No route can silently skip the check.

Step 3: Leveling It Up Past Format Checks

Format-only middleware stops garbage input, but it won't stop someone signing up with test@test.com or a domain that doesn't accept mail. To catch that, the middleware needs to do an async lookup before calling next():

const dns = require('dns').promises;

async function verifyEmailMiddleware(req, res, next) {
  const { email } = req.body;

  if (!email || !isValidFormat(email)) {
    return res.status(400).json({ error: 'Please provide a valid email address' });
  }

  const domain = email.split('@')[1];

  try {
    const mxRecords = await dns.resolveMx(domain);
    if (mxRecords.length === 0) {
      return res.status(400).json({ error: 'This domain cannot receive email' });
    }
  } catch {
    return res.status(400).json({ error: 'This domain cannot receive email' });
  }

  next();
}

This is the same MX-lookup approach I covered in my last post on Node.js email validation — it plugs neatly into the middleware pattern here.

Step 4: Handling Timeouts and Failures Gracefully

One thing that bit me early on: DNS lookups can hang or fail for reasons that have nothing to do with the user's email being bad (network blip, DNS server timeout). If your middleware treats every failure as "invalid email," you'll reject real users.

async function verifyEmailMiddleware(req, res, next) {
  const { email } = req.body;

  if (!email || !isValidFormat(email)) {
    return res.status(400).json({ error: 'Please provide a valid email address' });
  }

  const domain = email.split('@')[1];

  try {
    const mxRecords = await dns.resolveMx(domain);
    if (mxRecords.length === 0) {
      return res.status(400).json({ error: 'This domain cannot receive email' });
    }
    req.emailChecked = true;
    next();
  } catch (err) {
    console.error('Email verification lookup failed:', err.message);
    // fail open rather than blocking a legitimate signup on a DNS hiccup
    req.emailChecked = false;
    next();
  }
}

Whether you fail open or closed here is a judgment call — I lean toward failing open for signup forms since blocking a real user over a transient DNS issue is worse than letting one borderline case through.

Step 5: Swapping in a Proper Verification Service

Once you need catch-all detection, disposable-domain filtering, or mailbox-level checks, the DNS-only version above starts running into the same ceiling I hit in my last article. I ended up replacing the MX-lookup block with a call to Gamalogic's verification API, keeping the exact same middleware shape:

async function verifyEmailMiddleware(req, res, next) {
  const { email } = req.body;

  if (!email || !isValidFormat(email)) {
    return res.status(400).json({ error: 'Please provide a valid email address' });
  }

  try {
    const result = await validateWithAPI(email); // returns { status: 'valid' | 'invalid' | 'catch-all' }
    if (result.status === 'invalid') {
      return res.status(400).json({ error: 'This email address doesn\'t look deliverable' });
    }
    next();
  } catch (err) {
    console.error('Verification service error:', err.message);
    next(); // fail open, same reasoning as before
  }
}

Same interface, same routes, no changes anywhere else in the app — just a swapped-out implementation behind the middleware.

Takeaway

Middleware turns "remember to validate the email on every route" into "the route just can't run without it." Start with format + MX checks if you're prototyping, decide deliberately whether to fail open or closed on lookup errors, and swap in a dedicated verification step once DIY checks stop covering your edge cases.

How to Validate Email Addresses in Node.js Before Sending Transactional Emails

Arjun CS — Tue, 01 Sep 2026 19:36:36 +0000

If you've ever shipped a signup form and watched your bounce rate creep up a week later, you already know the problem: not every email address that looks valid is actually deliverable.

I ran into this on a transactional email pipeline — password resets, order confirmations, that kind of thing. Everything passed basic form validation, but a chunk of emails still bounced. Turns out "looks like an email" and "will actually receive an email" are two very different checks.

Here's how I fixed it, step by step.

Step 1: Why Regex Alone Isn't Enough

Most of us start here:

function isValidEmailFormat(email) {
  const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return regex.test(email);
}

console.log(isValidEmailFormat("hello@example.com")); // true
console.log(isValidEmailFormat("hello@fake-domain-xyz123.com")); // also true!

Both of those return true. The problem is regex only checks shape, not existence. fake-domain-xyz123.com might not even resolve to a real mail server. Regex will happily pass it anyway.

Step 2: Checking the Domain Actually Has Mail Servers

The next layer most people add is an MX (Mail Exchange) record lookup — this confirms the domain is actually configured to receive email:

const dns = require('dns').promises;

async function domainHasMailServer(email) {
  const domain = email.split('@')[1];
  try {
    const mxRecords = await dns.resolveMx(domain);
    return mxRecords.length > 0;
  } catch (err) {
    return false; // no MX records = domain can't receive mail
  }
}

(async () => {
  console.log(await domainHasMailServer("hello@gmail.com")); // true
  console.log(await domainHasMailServer("hello@fake-domain-xyz123.com")); // false
})();

This catches a lot more junk than regex alone. Combine both checks and you've got a reasonable first line of defense:

async function basicEmailCheck(email) {
  if (!isValidEmailFormat(email)) return { valid: false, reason: 'bad_format' };
  const hasMx = await domainHasMailServer(email);
  if (!hasMx) return { valid: false, reason: 'no_mail_server' };
  return { valid: true };
}

Step 3: Where This Approach Breaks Down

MX-record checking is a solid start, but it has real limits once you're running this in production:

It doesn't catch full mailboxes or deactivated accounts. The domain can receive mail; that specific inbox might not exist anymore.
Catch-all domains lie to you. Some mail servers accept any address at their domain, even ones that don't exist, then silently drop it. Your MX check says "valid," reality says otherwise.
DNS lookups add latency if you're doing this synchronously on every signup request, and you'll want caching, retries, and rate-limit handling once volume grows.
No disposable-email detection. Temp-mail domains often have valid MX records too.

I hit all four of these within a couple months of shipping the DIY version. At that point, rolling your own becomes a maintenance project instead of a five-line function.

Step 4: Handing the Hard Part to an API

This is where a dedicated email validation API tools like Gamalogic earns its keep — it handles MX checks, catch-all detection, disposable-domain lists, and mailbox-level verification behind one call, so you're not maintaining that logic yourself.

I ended up wiring Gamalogic into this same signup flow, since it covers the catch-all and disposable-domain gaps that MX-only checking misses:

const axios = require('axios');

async function validateWithAPI(email, apiKey) {
  const response = await axios.get('https://api.gamalogic.com/v1/verify', {
    params: { email, api_key: apiKey }
  });
  return response.data; // { status: 'valid' | 'invalid' | 'catch-all', ... }
}

Swap this in wherever your DIY check was, and you get mailbox-level confidence instead of just "the domain exists."

Step 5: Putting It in the Signup Flow

app.post('/signup', async (req, res) => {
  const { email } = req.body;

  const result = await validateWithAPI(email, process.env.EMAIL_API_KEY);

  if (result.status === 'invalid') {
    return res.status(400).json({ error: 'This email address doesn\'t look deliverable.' });
  }

  // proceed with account creation
  res.status(200).json({ message: 'Signed up successfully' });
});

Reject clearly invalid addresses at signup, and you avoid the downstream cost entirely — bounced password resets, wasted sends, and a slowly-tanking sender reputation.

Takeaway

Regex gets you shape. MX lookups get you domain existence. Neither gets you mailbox-level confidence, and that gap is exactly where bounce rates come from. If you're just prototyping, the DIY checks above are fine. If you're sending real transactional volume, it's worth handing that last mile to something built for it rather than re-discovering catch-all domains the hard way, like I did.