Open-Source Email Verifiers (Reacher, AfterShip): When Self-Hosting Works and When It Doesn't

Yes, there are good open-source email verifiers, and they do real mailbox checks. The hard part is not the code but where you run it. check-if-email-exists (the engine behind Reacher, written in Rust) and AfterShip's email-verifier (Go) are both MIT-licensed and check syntax, MX, disposable domains and the mailbox over SMTP without sending an email. Both need outbound port 25, which the big clouds block by default, and an IP that mail servers will talk to. Reacher's own README says that beyond very small volumes you'll need SMTP proxies. So self-hosting fits signup-form checks, data that can't leave your network, or building a verification product. For cleaning lists at volume, a hosted verifier usually costs less once you count IPs and time.

The two active projects

Both read on GitHub on 2 November 2026:

	check-if-email-exists (Reacher)	email-verifier (AfterShip)
Language	Rust	Go
License	MIT	MIT
Stars	About 10,400	About 1,650
Form	Library, CLI, and an HTTP backend in Docker	Go library
Mailbox (SMTP) check	Yes	Yes, off by default
Catch-all detection	Yes	Yes, on by default when SMTP is on
Other checks	Syntax, MX, disposable, role, full inbox, disabled mailbox, Gravatar, Have I Been Pwned	Syntax, MX, free provider, role, disposable, Gravatar
Proxy support	SOCKS5	SOCKS5

Sources: the check-if-email-exists repository and the email-verifier repository. Both were updated in the week before we read them.

Reacher's quick start is one command, docker run -p 8080:8080 reacherhq/backend:latest, then a POST to /v0/check_email. AfterShip's is a few lines of Go with EnableSMTPCheck().

What the READMEs say about infrastructure

Both projects are candid about the same problem.

• Reacher: for the Docker backend, "outbound port 25 must be open." And: "It is possible to operate Reacher with your own IP addresses. But if you wish to process more than very small volumes you will need SMTP proxy servers."
• AfterShip: "because most of the ISPs block outgoing SMTP requests through port 25 to prevent email spamming, the module will not perform SMTP checking by default." It also warns that the default sender identity (user@example.org, localhost) gets whole exchanges rejected, and to "use a domain you control, with a PTR record for the IP you connect from."

That is the whole story of self-hosted verification in two quotes. The checks themselves are a few hundred lines of protocol. Getting honest answers from mail servers is an operations job.

What you need to run one well

1. A host that allows outbound port 25. AWS, Google Cloud and Azure block it by default; some providers lift the block on request, some never do. Our post on cloud providers blocking port 25 shows how to test a host in thirty seconds. A blocked port doesn't fail loudly: every check just times out and comes back unknown.
2. A clean IP with reverse DNS. Mail servers check who is connecting. An IP with no PTR record, a mismatched HELO name, or a listing on a blocklist gets refused before the address is ever considered. Check yours with the reverse DNS lookup and blacklist check.
3. Retry logic. Greylisting servers defer the first attempt from an unknown sender with a 4xx. Without a retry a few minutes later, those come back unknown.
4. Rate limits per provider. Hammering one provider from one IP gets the IP throttled or listed. At volume that means several IPs or proxies, which is what Reacher's README is pointing at.
5. Provider-specific handling. Some providers answer every check the same way, some refuse checks from whole networks. Microsoft's consumer domains (outlook.com, hotmail.com, live.com) are the main example: they do reject unknown users, but they refuse checks from some networks, ours included at the moment, so those addresses can't be confirmed by us. Our 2026 study of how mailbox providers answer verification checks lists what each major provider does.
6. Catch-all handling. Both libraries detect catch-all domains, which is the honest outcome: a domain that accepts every address can't be confirmed by an SMTP check. What you do with those rows is up to you.

None of this is unique to open source. It's what every verifier has to do. Our build vs buy guide goes through the costs in detail.

When self-hosting is the right call

• Signup forms at low volume. A few hundred checks a day from one clean IP is well within what a single server can do, and a library call is simpler than an API dependency.
• Data that can't leave your network. If policy forbids sending addresses to a third party, self-hosting is the answer, and the code is auditable.
• Verification is your product. If you are building a verifier or a data business, you'll need to own this layer anyway.
• The cheap layers. Syntax, MX and disposable-domain checks don't need port 25 and run anywhere. It is reasonable to do those yourself and buy only the mailbox check.

When a hosted verifier is cheaper

• Cleaning lists of tens of thousands or more. This is where proxies and IP reputation start to matter, and where a hosted plan with its own infrastructure costs less than proxies plus engineering time.
• No one owns mail infrastructure on your team. An IP that gets listed, a provider that changes its behavior, a port that gets blocked after a host migration: someone has to notice.
• You need results in a CRM or sequencer. Hosted verifiers come with CSV upload, integrations and result files; a library gives you a function call.

For scale, SimpleVerifier Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. The API is metered separately: Pro includes 10,000 API calls a month, then $1.50 per 1,000. See the API docs and pricing.

A hybrid that works

1. Run syntax, MX and disposable checks yourself at signup, with either library or a regex plus DNS lookup.
2. Send the addresses that pass to a hosted verifier for the mailbox check, in real time or in batches.
3. Keep catch-all and unconfirmed results as risky rather than forcing them into valid or invalid.

Where SimpleVerifier fits

Try a hosted check on your own list before deciding: upload a file on the verify page; the first 100 checks are free with a Google sign-in.