TL;DR
- Vendors, including the big ones, use "verification" and "validation" for the same service. Don't pick a tool by which word it uses.
- When there is a difference: validation = is the address well formed, and can its domain receive mail? Verification = does this exact mailbox exist, according to its mail server?
- Only the second stops the classic hard bounce. Check that any tool you use does a real SMTP mailbox check.
Two words, one market
Search for either term and you get the same companies selling the same thing. Product pages say "email validation API" and "email verification API" for identical services, and many use both on one page. So the label tells you little. What matters is which checks run behind it.
Where people do draw a line, it comes from software engineering. Validation asks "is this input acceptable?" and is answered from the input alone. Verification asks "is this true?" and needs to check with the outside world. Applied to email:
| Validation (could it work?) | Verification (does it work?) | |
|---|---|---|
| Checks | Syntax, domain exists, domain has MX records, known disposable domain, role prefix | All of that, plus asking the mail server about the mailbox, plus a catch-all test |
| Contacts the mail server? | No (DNS lookups only) | Yes, an SMTP conversation that stops before any message is sent |
| Speed | Milliseconds | Usually a few seconds; longer when a server greylists |
Catches typos like [email protected] | Yes | Yes |
Catches [email protected] after Jane left | No | Yes, if the server rejects the mailbox |
| Good for | Instant form feedback, first-pass filtering | Cold email lists, old lists, anything where bounces cost you |
What validation alone misses
A list of B2B leads is usually well formed already. The addresses came from a database, not from people typing. So a validation-only
pass finds very little: maybe a broken row and a few dead domains. The addresses that actually bounce in cold email are the ones on
healthy domains whose mailbox has gone, because the person changed jobs. Those pass every syntax and DNS check. Only the mail server
knows they're gone, and it answers 550 5.1.1 when asked (see bounce codes).
What verification still can't settle
- Catch-all domains accept every address, so the mailbox check can't confirm the person. See what is a catch-all email.
- Servers that won't answer: some time out, greylist, or block verification traffic. Those come back unknown, not guessed.
- Spam traps answer like real mailboxes. See spam traps.
How MailExchange covers both
Every address goes through six checks, in order (how it works):
- Syntax. Fails as undeliverable:
invalid_email. - Domain and DNS. No domain, no MX record or a null MX fails as undeliverable:
invalid_domain. - Risk lists. Disposable domains, role prefixes and free webmail are flagged.
- SMTP mailbox check. We ask the server about the address. No email is sent.
- Catch-all test. We ask about a random address at the same domain, in the same session.
- Verdict. Deliverable, risky, undeliverable or unknown, with a reason. See all statuses and reasons.
Steps 1-3 are the validation part, and 4-5 are the verification part. You pay the same per address either way, and unknowns are refunded.