---
title: "Email address verification (safe or full SMTP probe)"
method: POST
path: "/verify"
tags: ["verify"]
---

# Email address verification (safe or full SMTP probe)

`POST /verify`

## Request

- Base URL: `https://dash.mailsocket.app/api/v1`
- URL: `https://dash.mailsocket.app/api/v1/verify`
- Auth: HTTP bearer

`mode: "safe"` (default): syntax + DNS (MX, falling back to A/AAAA) +
disposable/role heuristics. Never opens an SMTP connection. Rate-limited
per key AND per account (an account holding multiple keys cannot
multiply its effective ceiling), plus a service-wide concurrency cap.

`mode: "full"` is not generally available and returns
`403 smtp_verify_disabled` (or `403 verify_full_entitlement_required`
on a plan other than Business). When enabled it additionally
opens one real SMTP session to the target domain's MX and issues a
RCPT probe (never DATA) to check whether the specific mailbox exists.
Separate, harder per-key/per-account rate limits and a separate small
in-flight capacity pool apply on top of the safe-mode limits. SSRF-safe
by construction: every resolved MX/A/AAAA address is validated as
public before any connection is attempted; a domain that resolves
exclusively to non-public addresses degrades to the safe verdict
(`smtp.probe: "skipped"`, `reason: "mx_non_public"`) rather than
erroring. Any probe failure (timeout, refused connection, per-domain
cooldown, capacity exhaustion) degrades to `200` with the safe-mode
verdict.

## Request body

- object
  - `email` string, required: The address to check. Any string is accepted and gets a verdict: an address the server cannot use (wrong shape, too long) returns `200` with `syntax_valid: false` and a `reason`, never a `4xx`. Only the first 320 characters are read and checked (the verdict's `email` echoes that part). An empty or blank value is `422 validation_error`.
  - `mode` 'safe' | 'full': "full" additionally performs a live SMTP RCPT probe. Not generally available (403 smtp_verify_disabled).

## Response `200`

A verification verdict (never a hard existence guarantee).

- object
  - `data` object, required
    - `email` string, required
    - `deliverable` 'deliverable' | 'risky' | 'undeliverable' | 'unknown', required
    - `syntax_valid` boolean, required
    - `domain` string, nullable, required
    - `has_mx` boolean, required
    - `is_disposable` boolean, required
    - `is_role` boolean, required
    - `reason` string, required
    - `checked` string, required
    - `smtp` object: Present only when mode is "full".
      - `probe` 'completed' | 'skipped' | 'failed'
      - `rcpt_code` integer, nullable
      - `catch_all` boolean, nullable
      - `reason` string

## Other responses

- `401`: Missing or invalid API key.
- `403`: Account forbidden, full-mode SMTP verify disabled (smtp_verify_disabled), or the plan lacks the full-mode entitlement (verify_full_entitlement_required).
- `422`: Request validation failed (malformed body or invalid parameter).
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/mailsocket/apis/mailsocket-api.md) · [All operations](https://skmtc.dev/mailsocket/apis/mailsocket-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mailsocket/apis/mailsocket-api/revisions/e579500dfb7e?raw)