Email Validation — How to Check if an Email Address Is Real
Someone types jhon@gmial.con into a signup form. It looks like an email address — it has an @ and some letters — but it will bounce every time. Meanwhile, a@b.co looks suspiciously short but could be entirely real. “Valid-looking” and “actually works” are two different questions, and checking the second one properly takes three separate steps, not one regex.
Why Email Validation Isn’t Just a Regex Check
A lot of signup forms validate email addresses with a single regular expression and call it done. That catches obvious typos — a missing @, no domain — but it misses two much more common problems: the domain might not exist or might not accept mail at all, and the address might belong to a disposable inbox created specifically to bypass your verification email. A regex alone answers none of that.
Real email validation happens in layers, each one catching a different category of bad address.
Layer 1: Syntax
This is what most validators check, and it is a genuinely useful first filter. The rules that matter in practice:
- There must be exactly one
@symbol, with something before it (the local part) and something after it (the domain). - The domain needs at least one dot —
user@localhostis technically valid in some contexts but not a real internet email address. - The local part can’t start or end with a dot, and can’t have two dots in a row (
john..doe@example.comis invalid). - Length limits apply: 64 characters max for the local part, 253 for the domain, 254 total — addresses that blow past these are either fake or auto-generated garbage.
The full RFC 5322 specification technically permits a much wider range of characters and formats than any real-world mail system actually uses (quoted strings, escaped characters, comments inside the address). Validating against the full spec tends to accept addresses no real inbox provider would ever issue — so practical validators use a tighter, pragmatic pattern instead, similar to what browsers use for <input type="email"> fields.
What syntax checking catches: typos, copy-paste errors, obviously malformed input. What it misses: whether the domain exists, whether it accepts mail, and whether the address is a burner.
Layer 2: Disposable / Throwaway Domains
Services like Mailinator, Guerrilla Mail, Yopmail, and 10minutemail exist specifically to give people a working inbox with zero commitment — read one verification email, then let it expire. They are genuinely useful for privacy-conscious signups to services you don’t trust, but they are a problem if you’re trying to build a real user list, since these addresses will never open a second email from you.
Checking against a curated list of known disposable domains catches the most common offenders. It is not a perfect system — new disposable services appear constantly, and this is fundamentally a blocklist-based approach that will always be a step behind the newest one — but it filters out the vast majority of throwaway signups with virtually no false positives, since nobody has “mailinator.com” as their real permanent address.
Layer 3: MX Records (Does the Domain Actually Receive Mail?)
This is the layer most validators skip because it requires a network request instead of just string parsing. An MX (Mail Exchanger) record is a DNS entry that tells the internet which servers handle incoming email for a domain. If a domain has no MX record, it cannot receive email — full stop — no matter how correct the syntax looks.
This catches a specific and surprisingly common failure mode: a syntactically perfect address at a domain that simply isn’t set up to receive mail. Typo’d domains (gmial.com instead of gmail.com), expired domains, or a company’s marketing domain that was never configured for email are all invisible to syntax checking alone but immediately obvious from a missing MX record.
Important nuance: checking MX records confirms the domain can receive mail — it does not confirm that the specific mailbox (jane@ vs jhn@) exists. Actually confirming a specific inbox exists requires an SMTP handshake with the mail server (or sending a real verification email), which is a different, heavier technique most mail providers actively discourage because it resembles the reconnaissance step of a spam attack.
Putting the Three Layers Together
| Check | Catches | Misses |
|---|---|---|
| Syntax | Typos, malformed input | Fake but well-formed domains |
| Disposable domain | Known throwaway inboxes | New/unlisted disposable services |
| MX record | Domains that can’t receive mail at all | Whether the specific mailbox exists |
None of the three layers alone is sufficient, but together they catch the overwhelming majority of invalid addresses before you ever send a verification email — which matters, because a high bounce rate on outbound email damages your sending domain’s reputation with mail providers, making future legitimate emails more likely to land in spam.
Check an Email Address Online
Our free Email Validator runs all three checks in your browser: syntax validation, a disposable-domain lookup, and a live MX record check via the Google Public DNS API. No email is sent, no mailbox is contacted, and nothing you type is logged or stored.
→ Open the free Email Validator
Type an address, get all three checks instantly — no account, no upload, no tracking.