Check an email

POST https://api.signitize.io/v1/check validates, normalizes and inspects one email address. Call it from your backend when a user submits your signup form, before you create the account.

Request

Part	Value
Method	POST
URL	https://api.signitize.io/v1/check
Headers	Authorization: Bearer <key> (see Authentication) and Content-Type: application/json
Body	{ "email": "<address the user typed>" }, a string of at most 254 characters

Send the address exactly as typed. Signitize trims spaces and lowercases it, so don't clean it yourself.

Response

{ "email": "[email protected]", "disposable": false, "deliverable": true }

The body contains only these three fields. The usage headers (X-RateLimit-Remaining and others) are described in Rate limits & usage headers, error responses in Errors.

The three fields

Each field answers a different question. Don't mix them up.

Field	Type	Meaning
email	string	The canonical email: every alias of one inbox ([email protected], [email protected]) gives the same value. It is a duplicate-check key and says nothing about whether the address is good. See Normalization.
disposable	boolean	true when the domain is a throwaway or temporary mail service. See Detection.
deliverable	boolean	false when the address can never receive mail: the domain doesn't exist, it accepts no mail, no mail server resolves, or the username breaks the provider's rules. See Detection.

What deliverable: true does not mean

deliverable: true means nothing proves that the address can't receive mail. It does not mean:

• The mailbox exists. [email protected] is deliverable when company.com accepts mail, even if nobody called blah works there. Signitize never asks mail servers about individual mailboxes: large providers answer "accepted" for every address or block servers that probe them.
• The person owns it. Anyone can type someone else's address.
• The check completed. If a DNS lookup fails, the answer is also true, so a DNS problem never blocks a real signup.

Only your verification email proves that the mailbox exists and belongs to the user.

Examples

Input	Status	email	disposable	deliverable	Why
[email protected]	200	[email protected]	false	true	Gmail alias of [email protected]
[email protected]	200	[email protected]	false	true	Yahoo disposable address (a real inbox)
[email protected]	200	[email protected]	true	true	Throwaway domain
[email protected]	200	[email protected]	false	false	Gmail never allows _
[email protected]	200	[email protected]	false	false	Domain publishes "accepts no mail" (null MX)
[email protected]	200	[email protected]	false	true	Privacy relay: forwards to a real inbox
josé@exemple.fr	400				Non-ASCII addresses are rejected

Signitize is stricter than many validators: non-ASCII addresses, quoted local parts ("john doe"@x.com) and local parts over 64 characters get 400. The full rules are in Format validation.

Use the result in your signup

Result	What to do
200 with disposable: true	Reject: "Disposable email addresses are not allowed. Please use a permanent email address."
200 with deliverable: false	Reject: "This email address cannot receive mail. Please check it for typos."
200 with disposable: false and deliverable: true	Look up email in your users table. If an account has it, including a banned one, reject as a duplicate. Otherwise create the account.
400	The value is not an email address. Show "Enter a valid email address."
Anything else (401, 422, 429, 5xx, timeout)	Don't block the user. Create the account as pending and recheck it later: see Never block a signup.

Only 200 and 400 should ever change what your user sees.

:::tip Two addresses, two jobs

Store email (the canonical email) in a unique column, but send mail to the address the user typed. The typed address always reaches them. The canonical one is only a duplicate-check key and may not be a real mailbox, as with Yahoo disposable addresses.

Keep banned accounts, or at least their canonical email, instead of deleting them. Every alias of a banned inbox then matches the ban.

:::

Who checks what

Responsibility	Owner
Format check for instant feedback	Your frontend
Final format check, normalization, disposable, undeliverable	Signitize
Duplicate and banned accounts, using email	Your backend
Mailbox exists and belongs to the user	Your verification email: activate the account only after the click

The complete signup code in Node.js and Python, with the fallback and the recheck job, is in Never block a signup. What counts toward your quota is in Rate limits.