How to Validate Email Addresses at Signup
· 4 min read
The cheapest bad email address to deal with is the one that never gets into your system. Every signup, checkout or contact form that accepts an address without checking it lets in typos, fake addresses and throwaway inboxes. Those addresses then bounce, fill your database, and in the case of real customers who made a typo, mean they never receive their receipt or password reset.
This guide shows how to validate email addresses at the moment they are entered, in a way that stops bad data without annoying real people.
Why validate at signup?
- Customers get their emails. Order confirmations, account activation links and password resets only work if the address is right.
- Your bounce rate stays low. Fewer bounces protect your sender reputation for every email you send. See how to reduce your email bounce rate.
- Fewer fake accounts. Throwaway addresses are a common way to claim free trials and rewards more than once.
- Cleaner data. Support, analytics and your email platform all work better when every contact is real.
The layers of email validation
Good validation works in layers, from instant checks in the browser to a full check on your server.
1. Format check in the browser
Use type="email" on the input field. Browsers then block obvious mistakes, like a missing @ sign, and show the right keyboard on phones. This is a convenience, not a security measure, because anyone can bypass the browser.
2. Format check on the server
Always validate again on the server. Most web frameworks have a built-in email rule. Be careful not to be stricter than the standard: plus signs (jane+news@example.com), dots, long new domain endings and international characters are all legitimate.
3. Typo suggestions
A large share of bad addresses are simple typos in popular domains: gmial.com, hotmial.com, yaho.com or .con instead of .com. Instead of rejecting these, suggest the fix: "Did you mean jane@gmail.com?" and let the person accept it with one click. Some typo domains are run as spam traps, so catching them also protects your reputation; see what is a spam trap.
4. Domain and MX check
Look up the domain in DNS. If it does not exist, or publishes no mail servers, every message will bounce, so you can safely ask the person to check the address. You can see these first four layers in action with the free email checker.
5. Mailbox verification
The final layer asks the receiving mail server whether the exact mailbox exists, without sending a message. This needs a verification service, because doing it yourself from a web server is slow and can get your server's IP address blocked. The NoBounch email verification API returns a result of valid, invalid, catch-all, disposable or unknown, plus a typo suggestion and role and free provider flags, in a single request.
6. Confirmation email
For newsletters and accounts, a confirmation email that the person must click (often called double opt-in) is still the strongest proof that they own the address and want your mail. Validation and confirmation work well together: validation catches mistakes before the person leaves the page, and confirmation proves ownership.
How to act on each result
| Result | Suggested action |
|---|---|
| Valid | Accept. |
| Invalid | Ask the person to check the address. Show the typo suggestion if there is one. |
| Disposable | For trials and rewards, ask for a permanent address. For other forms, accept with a gentle warning. See disposable email addresses. |
| Catch-all | Accept. The mailbox cannot be confirmed, so rely on the confirmation email. See what is a catch-all email. |
| Unknown | Accept. The mail server did not answer clearly, which is not the person's fault. |
Role addresses such as info@ or sales@ are real inboxes. For business products they are often fine; for personal accounts you might suggest a personal address, but rarely need to block them.
Good practice for the user experience
- Check on blur or on submit, not on every keystroke. That keeps API calls low and does not distract people while they type.
- Never block on a slow answer. Set a short timeout. If the check does not finish in time, accept the address and verify it later.
- Write helpful messages. "We could not find a mail server for gmial.com. Did you mean gmail.com?" works far better than "Invalid email".
- Call the API from your server. Keep your API key secret; never put it in browser code.
- Rate limit your form. Bots that hammer a signup form will also use up your verification credits.
- Respect privacy. Only check addresses that people give you themselves, and tell them how you use their data.
What about the addresses you already have?
Validation at signup protects new data. For the addresses already in your database, run a one-off clean with bulk email verification: upload a CSV or Excel file, then download the valid addresses and review the rest. After that, signup validation keeps the list clean going forward.