Use case · SimpleVerifier Team
Preventing fake signups with a real-time email check
Call the verification API from your server when the form is submitted. Reject addresses that come back invalid (no mail server, mailbox not found, or one of 9,913 known disposable domains), accept valid and risky, and create the account anyway if the check times out. This removes typos and throwaway inboxes. It does not stop a person with a real second address.
Fake signups come in three kinds: typos from real people, throwaway inboxes, and bots filling the form with made-up addresses. An email check helps with all three to different degrees, and it is one layer rather than the whole defence.
The design question is not whether to check but what to do with ambiguous results. Block too little and junk reaches your database; block too much and you turn away customers on company domains that cannot be confirmed.
Where fake signups come from
Mistyped addresses from genuine users
A typo in the domain or a missing character is the most common reason a confirmation email never arrives. Catching it while the user is still on the page costs one retry; catching it later costs a lost signup. The email typo corrector shows the kind of mistakes involved.
Disposable inboxes
9,913 disposable domains are in our list and return invalid with the reason Disposable address. New throwaway domains appear constantly, so a list is a strong filter, not a complete one. Look up any domain with the disposable email checker.
Bots submitting invented addresses
Scripts often use well-formed but nonexistent mailboxes on real domains. A mailbox check rejects those. Bots that use real, working inboxes get through, so pair the check with a honeypot field or rate limiting (honeypot fields against signup bots).
Catch-all domains look the same for real and fake
A catch-all server accepts every recipient, so a made-up name at that domain returns risky, not invalid. Treat risky as allowed at the form and let your confirmation email prove the address.
Add the check to your signup endpoint
Get an API key and keep it on the server
Create a key under API keys. Call the API from your backend so the key never reaches the browser. The API reference has the request and response format; SDKs cover Node.js and Python.
Verify on submit, not on every keystroke
Run a cheap syntax check in the browser, then one server-side call when the form is submitted. Checking on every keystroke spends calls and produces flicker. No-code form stacks can use the form widget, WordPress plugin, Zapier or Make.
Block only the invalid results
Show the user a specific message: use a permanent address for a disposable domain, check for typos for the rest. Allow valid and risky. Keep the reason text in your logs so support can answer why a signup was refused.
Fail open
Give the call a timeout that suits your form. If it expires or the API is unreachable, create the account and verify in the background. A verification outage should never be the reason someone cannot sign up.
Review the refusals for a week
Read a sample of the blocked addresses. If real customers are in the pile, loosen the rule; if junk still gets in, add rate limits or a honeypot rather than blocking risky addresses.
What to do with each result
| Result | What to do | Why |
|---|---|---|
| valid | Allow | Mailbox confirmed by the recipient's server. |
| risky · Accepts all addresses | Allow | Catch-all domain. Cannot be confirmed either way; the confirmation email is the test. |
| risky · Server would not confirm / Mailbox check unavailable | Allow, re-check later | Temporary or refused to answer. Not the user's fault. |
| invalid · Disposable address | Block with a clear message | Throwaway inbox. |
| invalid · Invalid format / No mail server / Mailbox not found | Ask the user to retype | Usually a typo and the user is still on the page. |
The server-side check
curl "https://simpleverifier.com/api/v1/verify?email=jane@company.com" \
-H "Authorization: Bearer $SIMPLEVERIFIER_KEY"Full request and response details are in the API reference.
Common questions
- Can email verification stop all fake signups?
- No. It stops mistyped addresses, nonexistent mailboxes and known disposable domains. A person using a real second address, or a bot with working inboxes, still passes. Combine it with rate limiting or a honeypot field.
- Should I block risky addresses?
- Not at the form. Risky usually means a catch-all company domain or a server that would not answer, and blocking it rejects real customers. Allow it and let the confirmation email test the address.
- What if the verification API is slow or down?
- Fail open: create the account and verify in the background. Never block signups on a third-party timeout.
- Does the API need a paid plan?
- API access starts on Pro at $29.99 a month (10,000 calls a month included, then $1.50 per 1,000). Your first checks on a list are free with a Google sign-in, so you can test the results before paying.
Test it on your own signups
Pro is $29.99 a month and never cuts you off: the first 100,000 emails a month run at full speed, then big lists run slower. CSV uploads, the API (10,000 calls a month, then $1.50 per 1,000), the Google Sheets add-on and the email finder are all included. Cancel any time.
The first 100 checks are free with a Google sign-in and no card, once per account.