DEV Community: Mohammed Samaan

What an MX-only email check can and cannot tell you

Mohammed Samaan — Wed, 07 Oct 2026 10:45:13 +0000

Bad addresses at signup cost you bounces and sender reputation. Full mailbox verification services dial the recipient's mail server to ask whether the mailbox exists. This API does not, and that matters for how you use it. Here is what it returns and where it stops.

It sits next to two other APIs from the same account. The Disposable Email Checker is the list-only version (Stop Mailinator signups with one GET request), and Domain Trust Score judges the domain (Scoring an unknown domain 0 to 100). This one checks the address itself.

The shortest working call

curl --request GET \
  --url 'https://email-verifier38.p.rapidapi.com/v1/verify?email=test@gmail.com' \
  --header 'x-rapidapi-host: email-verifier38.p.rapidapi.com' \
  --header 'x-rapidapi-key: YOUR_RAPIDAPI_KEY'

JavaScript (Node 18+):

const email = 'test@gmail.com';const res = await fetch(
  'https://email-verifier38.p.rapidapi.com/v1/verify?email=' + encodeURIComponent(email),
  {
    headers: {
      'x-rapidapi-host': 'email-verifier38.p.rapidapi.com',
      'x-rapidapi-key': process.env.RAPIDAPI_KEY,
    },
  }
);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
const reject = ['invalid', 'disposable'].includes(data.status);
console.log(reject ? 'reject' : 'accept', data.score);

Python:

import os, requests

r = requests.get(
    "https://email-verifier38.p.rapidapi.com/v1/verify",
    params={"email": "test@gmail.com"},    headers={
        "x-rapidapi-host": "email-verifier38.p.rapidapi.com",
        "x-rapidapi-key": os.environ["RAPIDAPI_KEY"],
    },
    timeout=10,
)
r.raise_for_status()
d = r.json()
print("reject" if d["status"] in ("invalid", "disposable") else "accept", d["score"])

The response, field by field

Captured from the live API on 7 Oct 2026 (HTTP 200, 607 bytes):

{
  "email": "test@gmail.com",  "status": "unknown",
  "score": 72,
  "reason": "mx_only_no_smtp",
  "reason_detail": "Domain accepts mail. This API is MX-only — the mailbox itself was not dialed (SMTP port 25 is blocked on serverless platforms).",
  "method": "mx",
  "syntax_valid": true,
  "domain": "gmail.com",
  "mx_found": true,
  "mx_host": "gmail-smtp-in.l.google.com",
  "is_disposable": false,
  "is_role": false,
  "is_free_provider": true,
  "has_tag": false,
  "base_email": "test@gmail.com",  "typo_suggestion": null,
  "domain_has_spf": true,
  "domain_has_dmarc": true,
  "checked_at": "2026-10-07T10:00:52.056Z",
  "duration_ms": 9,
  "meta": { "user": "..." }
}

status is one of valid, invalid, disposable, risky or unknown. score runs from 0 to 100.
reason and reason_detail explain the verdict. Here the domain accepts mail but the mailbox was not contacted, so the answer is unknown, not valid.
syntax_valid, domain, mx_found and mx_host are the syntax and DNS checks.
is_disposable, is_role (such as info@) and is_free_provider are separate booleans. has_tag and base_email handle plus-addressing.
typo_suggestion offers a correction for misspelled domains, or null.
domain_has_spf and domain_has_dmarc describe the domain's DNS, not the mailbox.
duration_ms is the server-side time (9 ms here, from the response itself). The playground round trip was about 1.5 s.
meta.user holds the caller's account name, shown as "...".

Two more captures from the same day, with the same 21 keys. someone@mailinator.com returned status: "disposable", score: 5, reason: "disposable_domain", mx_found: false. not-an-email returned status: "invalid", score: 0, reason: "bad_syntax", syntax_valid: false and domain: null. Both were HTTP 200, so a bad address is a result and not an error status.

Using it at signup

Reject invalid and disposable, accept the rest, and confirm with a real confirmation email later. Do not reject unknown, because it is the normal answer for a good Gmail address.

What it does not do

It never contacts the mailbox. SMTP port 25 is blocked on serverless platforms, so this API cannot tell you a specific mailbox exists.
It does not detect catch-all domains.
It cannot promise an address will receive mail or will not bounce. valid means the checks it runs passed, nothing more.
A single GET checks one address. A POST to /v1/verify with an emails array checks a small batch, with a maximum of 10 per request.

Errors

A malformed address is a normal 200 with status: "invalid", as shown above. Gateway failures such as a missing or wrong key, or a used-up quota, return RapidAPI's own error before the request reaches the API. I did not re-run other error cases for this post, so check the listing's endpoint documentation for the current ones.

Status	Meaning
200	The address was checked, whatever the verdict
Non-2xx	Gateway or API failure. Throw, log, and let the user continue rather than blocking signup

Plan

The free Basic plan on the listing currently shows 300 requests per month. Pro is $19 per month for 3,000.

Listing and playground: https://rapidapi.com/samaanmohammed/api/email-verifier38

Scoring an unknown domain 0 to 100 from public signals, with every penalty documented

Mohammed Samaan — Wed, 07 Oct 2026 10:13:03 +0000

A lead or signup arrives from a domain you have never seen. Is it a throwaway, a week-old registration, or a company with a valid certificate and a DMARC policy? Checking that by hand means five lookups. This API runs them in one call and returns a score plus the reasons.

If you only need the disposable-domain part, the Disposable Email Checker from the same account does just that: Stop Mailinator signups with one GET request. This one adds domain age, SSL and email DNS on top.

The shortest working call

curl --request GET \
  --url 'https://domain-trust-score.p.rapidapi.com/checkTrust?domain=stripe.com' \
  --header 'x-rapidapi-host: domain-trust-score.p.rapidapi.com' \
  --header 'x-rapidapi-key: YOUR_RAPIDAPI_KEY'

JavaScript (Node 18+):

const res = await fetch(
  'https://domain-trust-score.p.rapidapi.com/checkTrust?domain=stripe.com',
  {
    headers: {
      'x-rapidapi-host': 'domain-trust-score.p.rapidapi.com',
      'x-rapidapi-key': process.env.RAPIDAPI_KEY,
    },
  }
);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
console.log(data.trustScore, data.riskLevel, data.flags);

Python:

import os, requests

r = requests.get(
    "https://domain-trust-score.p.rapidapi.com/checkTrust",
    params={"domain": "stripe.com"},
    headers={
        "x-rapidapi-host": "domain-trust-score.p.rapidapi.com",
        "x-rapidapi-key": os.environ["RAPIDAPI_KEY"],
    },
    timeout=20,
)
r.raise_for_status()
d = r.json()
print(d["trustScore"], d["riskLevel"], d["flags"])

The call does DNS, registry and TLS lookups, so expect a second or two. The captures below took 2.1 s and 0.9 s. Set a timeout.

The response, field by field

Captured from the live API on 7 Oct 2026 (HTTP 200, 795 bytes):

{
  "domain": "stripe.com",
  "trustScore": 100,
  "riskLevel": "low",
  "flags": [],
  "disposable": false,
  "disposableMatchedDomain": null,
  "freeProvider": false,
  "registeredDomain": "stripe.com",
  "domainAgeDays": 11348,
  "registeredAt": "1995-09-12T04:00:00.000Z",
  "registrar": "SafeNames Ltd.",
  "domainAgeStatus": "ok",
  "domainAgeNote": null,
  "ssl": {
    "https": true,
    "valid": true,
    "error": null,
    "issuer": "DigiCert, Inc.",
    "validTo": "2026-12-10T23:59:59.000Z",
    "daysRemaining": 64
  },
  "email": {
    "hasMx": true,
    "mxHosts": [
      "aspmx.l.google.com",
      "alt1.aspmx.l.google.com",
      "alt2.aspmx.l.google.com",
      "aspmx2.googlemail.com",
      "aspmx3.googlemail.com"
    ],
    "spf": true,
    "dmarc": true,
    "dmarcPolicy": "reject",
    "dkimSelectorsFound": ["google", "mandrill", "s1", "s2"],
    "dkimWildcardDns": false
  },
  "listsUpdatedAt": "2026-10-05T10:09:51.295Z",
  "meta": { "user": "..." }
}

trustScore starts at 100 and loses a fixed penalty per flag, never going below 0. riskLevel is low at 75 or more, medium from 45 to 74, high below 45.
flags is the part to read. It lists why the score is what it is. For stripe.com it is empty.
disposable, disposableMatchedDomain, freeProvider come from public disposable-domain lists.
domainAgeDays, registeredAt, registrar come from the public registry (RDAP). domainAgeStatus says ok or why no age is available.
ssl is a TLS check on port 443 of the domain you sent, including days until expiry.
email is DNS only: MX hosts, SPF, DMARC policy and which of 16 common DKIM selectors exist.
meta.user holds the caller's account name, shown as "...".

A bad one, mailinator.com (also 7 Oct 2026, 734 bytes), comes back with trustScore: 30, riskLevel: "high" and flags: ["disposable_domain"]. That is 100 minus the 70-point disposable penalty. The other fields (age 8,497 days, valid SSL, SPF and DMARC present) show the score does not mean the domain is new or broken. It means it is a throwaway mail provider.

The penalties

Flag	Points
`disposable_domain`, `domain_does_not_exist`	70
`domain_does_not_resolve`	40
`domain_under_30_days_old`	30
`ssl_invalid`	25
`domain_under_90_days_old`, `no_https`	15
`no_mx_records`	10
`no_spf`, `no_dmarc`	8
`domain_under_1_year_old`, `ssl_expires_within_14_days`	5
`dmarc_policy_none`	3
`no_dkim_on_common_selectors`	2

free_email_provider and domain_age_unavailable appear as context and cost nothing. If you disagree with these weights, ignore trustScore and apply your own rules to flags, ssl, email and domainAgeDays.

What it does not do

The score is a heuristic from public signals. It is not a guarantee of safety, a certification or a fraud verdict.
Domain age needs a public RDAP service. In the project's tests of 150 business domains, .ae, .io, .co, .me, .ru and .pk had none, and .au returned no date or was rate-limited. domainAgeStatus explains this and no penalty applies.
DKIM cannot be listed from DNS, so 16 common selectors are probed. Finding none does not prove DKIM is absent, which is why the penalty is only 2.
SSL is checked on the domain you send. A mail-only domain with no website gets no_https.
It does not look at page content, reputation feeds or blocklists.

Errors

Status	When	Body
200	Domain read and checked (a domain that does not exist is still 200, with a low score)	The result above
400	`domain` missing	`{"error":"Pass ?domain=<domain>, for example example.com.","code":400}`
400	`domain` not readable	`{"error":"Could not read a valid domain from this input.","code":400}`
405	Any method other than GET	`{"error":"Use GET /checkTrust?domain=<domain>.","code":405}`
502	Unexpected failure inside the API	`{"error":"Check failed: ...","code":502}`

The error bodies are from the API's own documentation and were not re-run on 7 Oct. Gateway failures (bad key, quota used up) return RapidAPI's own error.

Plan

The free Basic plan on the listing currently shows 300 requests per month. Pro is $29 per month for 10,000.

Listing and playground: https://rapidapi.com/samaanmohammed/api/domain-trust-score

Stop Mailinator signups with one GET request

Mohammed Samaan — Wed, 07 Oct 2026 10:08:56 +0000

If your free trial lets anyone in with an email address, someone will sign up as x@mailinator.com forty times. A list lookup at signup is the cheapest first filter. This API does that lookup without you maintaining the lists.

The shortest working call

Subscribe to the free plan on the listing (link at the bottom), copy your key, and run:

curl --request GET \
  --url 'https://disposable-email-checker16.p.rapidapi.com/checkDisposable?email=throwaway@mailinator.com' \
  --header 'x-rapidapi-host: disposable-email-checker16.p.rapidapi.com' \
  --header 'x-rapidapi-key: YOUR_RAPIDAPI_KEY'

JavaScript (Node 18+):

const res = await fetch(
  'https://disposable-email-checker16.p.rapidapi.com/checkDisposable?email=' +
    encodeURIComponent('throwaway@mailinator.com'),  {
    headers: {
      'x-rapidapi-host': 'disposable-email-checker16.p.rapidapi.com',
      'x-rapidapi-key': process.env.RAPIDAPI_KEY,
    },
  }
);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const data = await res.json();
if (data.disposable) console.log('blocked:', data.matchedDomain);

Python:

import os, requests

r = requests.get(
    "https://disposable-email-checker16.p.rapidapi.com/checkDisposable",
    params={"email": "throwaway@mailinator.com"},    headers={
        "x-rapidapi-host": "disposable-email-checker16.p.rapidapi.com",
        "x-rapidapi-key": os.environ["RAPIDAPI_KEY"],
    },
    timeout=10,
)
r.raise_for_status()
data = r.json()
print(data["disposable"], data["matchedDomain"])

The response, field by field

Captured from the live API on 7 Oct 2026 (HTTP 200, 322 bytes):

{
  "input": "throwaway@mailinator.com",  "type": "email",
  "domain": "mailinator.com",
  "disposable": true,
  "freeProvider": false,
  "matchedLists": [
    "disposable-email-domains",
    "disposable",
    "mailchecker",
    "burner-email-providers"
  ],
  "matchedDomain": "mailinator.com",
  "listsUpdatedAt": "2026-10-05T10:09:51.295Z",
  "meta": {
    "user": "..."
  }
}

(meta.user holds the account name of the caller, shown as "..." here.)

input and type: what you sent, and whether it was read as an email or a bare domain. A URL also works; only the domain is used.
domain: the domain that was extracted and checked.
disposable: true if the domain is on at least one list. Subdomains are matched against their parent domain, so you do not need to strip them first.
freeProvider: true for providers such as Gmail. It is always false when disposable is true.
matchedLists: which of the five merged public lists flagged the domain. Four of five agree here. A domain flagged by one list is a weaker signal than one flagged by all.
matchedDomain: the entry that matched, or null.
listsUpdatedAt: when the lists were last refreshed. They refresh when older than 7 days.

A free provider looks like this (gmail.com, also captured 7 Oct 2026, 213 bytes): type is domain, disposable is false, freeProvider is true, matchedLists is [] and matchedDomain is null. That split lets you reject throwaway domains outright while only flagging free providers on a B2B form.

What it does not do

A domain missing from the lists is not proof the address is real or safe. New throwaway domains appear daily.
The lists are community-maintained, so false positives happen. Use matchedLists to see how many agree.
It never contacts the mailbox. It does not check that the address exists, that the domain has mail servers, or that the user can receive mail. For that you need a confirmation email.
It is a list lookup. It does not score a domain on age or reputation.

Errors

Status	When	Body
200	Input read and checked	The result above
400	`email` missing	`{"error":"Pass ?email=<email address or domain>.","code":400}`
400	`email` not readable	`{"error":"Not a valid email address.","code":400}`
405	Any method other than GET	`{"error":"Use GET /checkDisposable?email=<address or domain>.","code":405}`
502	Unexpected failure inside the API	`{"error":"Check failed: ...","code":502}`

The 400, 405 and 502 bodies are from the API's own documentation and were not re-run on 7 Oct. Requests that fail at the RapidAPI gateway (a missing or wrong key, or a quota that is used up) return RapidAPI's own error, not this shape.

Plan

The free Basic plan on the listing currently shows 1,000 requests per month. Paid plans start at $29 per month.

Listing and playground: https://rapidapi.com/samaanmohammed/api/disposable-email-checker16