---
title: "Verify and score an email address"
method: GET
path: "/v1/verify/email"
tags: ["Scoring"]
---

# Verify and score an email address

`GET /v1/verify/email`

## Request

- Base URL: `https://www.layercall.com`
- URL: `https://www.layercall.com/v1/verify/email`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Checks syntax, MX records and mailbox deliverability, and flags disposable, role-based, free-provider and homograph (lookalike) addresses.

## Query parameters

- `email` string, email, required
- `strictness` 'lenient' | 'balanced' | 'strict'

## Response `200`

Result

- EmailResult
  - `email` string, required
  - `normalized_email` string
  - `risk_score` integer, required: 0 = clean, 100 = certain fraud.
  - `verdict` 'allow' | 'review' | 'block', required: Recommended action. Thresholds move with `strictness`.
  - `status` string: e.g. valid, invalid, do_not_mail, unknown.
  - `sub_status` string, nullable: e.g. disposable, role_based, mailbox_not_found.
  - `deliverability_score` integer
  - `did_you_mean` string, nullable: Suggested correction for a likely typo.
  - `signals` object
    - `syntax_valid` boolean
    - `mx_found` boolean
    - `is_disposable` boolean
    - `is_homograph` boolean: Lookalike domain — mixed script or a spelling that folds onto a real ASCII domain.
    - `is_role_account` boolean
    - `is_free_provider` boolean
  - `cached` boolean
  - `request_id` string
  - `signals_unavailable` string[]: Signals that could not be measured on this request — e.g. ["tor", "vpn_providers"]. Absent entirely when every feed answered, so the happy-path shape is unchanged. Present means the score was built on incomplete data: a "clean" answer and a "we could not check" answer are otherwise identical.
  - `domain` string
  - `domain_age_days` unknown
  - `mx_provider` string
  - `mx_records` string[]
  - `first_seen` unknown
  - `times_seen` integer
  - `abuse_reports` integer
  - `digital_footprint` object
    - `has_gravatar` boolean, nullable: Whether the address has a public Gravatar. null means the check did not run — the request's time budget was exhausted — which is not the same as no avatar.
    - `gravatar_profile_url` unknown
    - `breach_count` unknown
    - `seen_in_breach` unknown
  - `processing_time_sec` number
  - `billable_lookups` integer

## Other responses

- `400`: Missing or malformed input.
- `401`: Missing, invalid, or revoked API key.
- `429`: Monthly quota or spend cap reached, or the 600 requests-per-minute rate limit exceeded.

---

[API](https://skmtc.dev/layercall/apis/layercall-api.md) · [All operations](https://skmtc.dev/layercall/apis/layercall-api/llms.txt) · [OpenAPI document](https://skmtc.dev/layercall/apis/layercall-api/revisions/b1258307dc91?raw)