Skip to main content

Free tool

Free email verifier

Check whether an email address can receive mail, using the live verification API. No account, no credit card, and nothing is sent to the address.

  • Three attempts a day from one network, no sign-up
  • Eight statuses, each explained below
  • A free account adds 100 verification credits, CSV upload, an API key and AI analysis

Complete the security check to continue.

Each check tells you

  • Status · Valid, invalid, risky, unknown, catch‑all, disposable, role or spam trap
  • Quality score · From 0 to 100
  • Risk flags · Disposable, role account, free provider, catch‑all

3 free verifications per day. No signup required.

What runs

Four checks, in order

Type an address and Kawaa answers from the live API, running the checks below in order until one settles it: usually a real conversation with the receiving mail server, sometimes a verdict the earlier layers reach on their own. Nothing is delivered to the address at any point.

  • Syntax and typos

    The address is parsed against the rules for a mail address, and common domain misspellings are caught here — an API result carries the correction as a suggestion field, so gmial.com does not simply fail. (The free checker above does not display it yet.)

  • Domain and MX records

    The domain has to exist and be able to take mail. Usually that means MX records — but a domain with none and a working address record is still tried as an implicit mail host, because plenty of small domains receive mail that way. Where an address really stops is a domain that does not resolve, or one publishing a null MX: its owner saying, in DNS, that no mail arrives here.

  • Risk signals

    Disposable domains, role addresses such as info@ or support@, free mailbox providers and known spam-trap patterns are weighed next, because an address can be perfectly deliverable and still be one you should not send to. A confident disposable or spam-trap verdict ends the check here.

  • Mailbox

    If the address survived all of that, the receiving server is asked whether it would accept it, without sending anything to it. Servers that accept every address are identified as catch-all instead of being reported as valid.

The first check that settles the question ends it, so a malformed address, a domain with no mail server, or a confident disposable verdict is answered without any conversation at all. And if the same address was checked in the last 24 hours the stored result comes back instead of a fresh check.

Reading the result

What each status means, and what to do about it

Eight statuses, not four. A catch-all domain, a role address and a disposable mailbox are three different problems, and rolling them together into one “risky” bucket leaves you with a label you cannot act on.

  • Valid

    What it means
    The domain accepts mail and the receiving server indicated it would accept this mailbox.
    What to do
    Send.

  • Invalid

    What it means
    The address cannot receive mail — a malformed address, a domain that does not exist, no mail server, or a mailbox the server rejected.
    What to do
    Remove it. Sending will bounce.

  • Risky

    What it means
    The mailbox was not confirmed and something is against the address — most often a server that blocked the check on reputation grounds rather than answering it, but also a connection that failed, a full mailbox, or catch-all evidence that did not settle.
    What to do
    Read the reason code before deciding. Risky is not a quieter kind of valid: only valid means the mailbox was confirmed.

  • Catch-all

    What it means
    The domain accepts mail to every address, so a positive answer proves nothing about this particular mailbox.
    What to do
    Keep it if you have other evidence the person is real; expect some bounces.

  • Disposable

    What it means
    The domain belongs to a service that issues throwaway mailboxes, usually expiring in minutes or hours. That is a fact about the provider; nothing here was measured about this particular mailbox.
    What to do
    Block it at signup. It may well work today, which is the point — it is unlikely to still be there when you need to reach the person.

  • Role account

    What it means
    A shared address such as info@, sales@ or support@, meant to be read by a team rather than a person. It is named from the local part and the domain’s mail records; the mailbox itself is only confirmed when the reason code is mailbox_exists rather than dns_only.
    What to do
    Poor for marketing either way — role addresses attract complaints. Reasonable for support or transactional mail if the reason code says the mailbox was confirmed.

  • Spam trap

    What it means
    The address matches a known spam-trap pattern. Traps exist to catch senders who mail addresses they never collected.
    What to do
    Remove it, and look at where the address came from.

  • Unknown

    What it means
    The receiving server answered, but not with a verdict — it greylisted the attempt, returned a temporary 4xx, or only the DNS layer was reached. (A server that could not be reached at all is risky, not unknown.)
    What to do
    Try again later. An unknown is not a verdict about the address, but it does use a credit: a bulk job charges one credit per address submitted, whatever comes back.

Why, not just what

Most verdicts carry their reason

A status on its own cannot tell you whether an address is bad or whether the check was refused. An authenticated API result adds a sub_status naming the reason, and it is the difference between deleting a dead mailbox and deleting a subscriber whose provider would not talk to us. It is absent on disposable and spam trap, where the status is already the whole reason, and the free checker above does not show it yet.

mailbox_exists
The receiving server indicated the mailbox is there.
mailbox_reject
The receiving server said this mailbox does not exist.
catch_all
The domain answers yes to every address, so the answer carries no information about this one.
provider_accept_all
The mailbox provider accepts everything at the edge and decides later.
policy_block
The server refused to answer on reputation or policy grounds. The address may be perfectly good.
greylisted
The server asked us to come back later — standard anti-spam behaviour, not a verdict.
temporary_failure
A transient error at the receiving end.
connection_failure
The mail server could not be reached.
dns_only
Only the DNS layer was checked; no mailbox conversation took place.
no_mx
The domain exists but publishes no mail server.
domain_not_found
The domain does not resolve.
syntax_error
The address is not a valid mail address.

The full result shape, field by field, is in the verification API reference.

More than one address

When a single check is not the job

A list you already have

Upload a CSV and Kawaa verifies it as a job, then gives you the file back with a status, a quality score, the risk flags and a suggested correction on every row. (The reason code is on the API result, not in the downloaded file.) Batches go up to 100 addresses on the free plan and 10,000 on Enterprise.

How senders use it

Addresses as they arrive

Call the API from your signup form and refuse a disposable address before it becomes a subscriber. A single verification answers in one request; webhooks report bulk jobs as they finish.

API quickstart

Inside the tools you use

HubSpot, Salesforce and Mailchimp connect from the dashboard and verify contacts where they already live. Other tools reach the same API through webhooks; the integrations index marks which connectors are shipped and which are still coming.

All integrations

Questions

About checking an address

Does checking an address send it an email?

No. The check opens a conversation with the receiving mail server and asks whether it would accept the address, then closes without delivering anything. Nobody is emailed, and nothing appears in their inbox.

How many addresses can I check here for free?

Three attempts a day from one network, with no account. Attempts, not results: the daily count is taken when the form is submitted, and a failed security check spends one without returning anything. A free account raises the allowance to 100 one-time verification credits, which can be spent one at a time through the dashboard or the API, or all at once on a CSV upload. A bulk job charges one credit for every address submitted, including any that come back unknown.

Is this the same check a paid plan runs?

The same live verification, with one layer off. A fresh check from this page runs syntax, domain, MX and the mailbox probe, but skips the AI analysis that an authenticated request includes by default — that layer is what sharpens typo, disposable, spam-trap, role and catch-all scoring. It also does not return the sub_status reason code that an API result carries. One wrinkle: if your answer came from the 24-hour cache it may have been produced by a request that did include the AI layer, since results are stored by address rather than by who asked. Everything else, including the plan-independent rule that every check runs on every plan, is the same.

Why does a Gmail or Outlook address sometimes come back as risky or unknown?

The large mailbox providers rate-limit and often refuse verification probes outright. When that happens the honest answer is that the check was blocked, not that the address is bad — which is why an authenticated API result carries a reason code such as policy_block or greylisted alongside the status. Treating a blocked probe as an invalid address is how good subscribers get deleted.

What is a catch-all domain, and why is it not just valid?

A catch-all domain accepts mail addressed to anything@ that domain and sorts it out afterwards. The receiving server therefore says yes to an address whether or not a mailbox exists behind it, so reporting catch-all as valid would be reporting a guess as a fact. Kawaa reports it as catch-all so you can decide.

Is the answer always live?

Usually, but not always. If the same address was checked within the last 24 hours and the stored result can be reused, that result comes back instead of a fresh probe. Re-running a conversation with the same mail server minutes apart mostly annoys it, and a blocked or rate-limited probe is a worse answer than a recent one. The checker above does not yet tell you which of the two you got, so treat any answer here as up to a day old; an API response carries a from_cache flag that says so outright.

Do you store the address I check?

The address and its result are stored so a repeat check of the same address can be answered from cache, keyed by a one-way hash of the address. Free checks made without an account are not attached to any account or profile. The privacy policy has the detail.

Can I check a whole list?

Yes, but not on this page. Upload a CSV in the dashboard and Kawaa verifies the file as a job, or call the batch API. A free account includes 100 credits to try it, and paid plans start at $19 a month for 5,000 verifications.

Is a verified address guaranteed to be deliverable?

No, and no verifier can promise that. A mailbox can be closed the day after it is checked, a receiving server can change its mind about your reputation, and a catch-all domain never gave a real answer in the first place. Verification removes the addresses that are certain to bounce and labels the ones that carry risk; it does not make a list permanent.

100 more checks, free

A free account adds 100 verification credits, the CSV upload, the API and an API key.

Get started freeView pricing

No credit card required