Introduction to Arcjet email validation

Arcjet email validation lets you validate and verify email addresses in your application to reduce spam and fraudulent signups.

What is Arcjet?

Arcjet helps developers protect their apps in just a few lines of code. Bot detection. Rate limiting. Email validation. Attack protection. Data redaction. A developer-first approach to security.

Email validation is useful anywhere users enter an email address, such as signup, login, password reset, and contact forms. It helps you catch invalid, disposable, and undeliverable addresses before they become accounts in your system.

Unlike using a simple library that only checks email syntax, Arcjet email validation also verifies whether email addresses are disposable, can actually receive email (MX records), and more - without you needing to run any infrastructure.

When to use Arcjet email validation

Use Arcjet email validation when you want to:

• Reduce spam and fraudulent accounts at signup.
• Improve data quality in user profiles and contact lists.
• Avoid sending email to invalid or undeliverable addresses.
• Block temporary / disposable email addresses.

You can combine email validation with Arcjet rate limiting to prevent brute-force attacks, and with Arcjet sensitive info to block unwanted or unsafe data.

How Arcjet email validation works

Arcjet validates email addresses in two stages: local syntax validation and remote verification.

1. Local syntax validation

First, Arcjet validates the email address syntax. Validation follows several email RFCs, with deliberate modifications to exclude addresses that don’t make sense for real applications (for example, localhost domains).

These algorithms are shipped with the Arcjet SDKs.

Only syntactically valid email addresses are sent to the Arcjet Cloud API for further verification.

2. Remote email verification

The Arcjet Cloud API performs additional checks for syntactically valid addresses. This includes:

• Email categorization Whether the domain is disposable, free, or custom (for example, gmail.com is considered a free email service).

• MX check Whether the domain has valid MX records and appears able to receive email.

• Gravatar check Whether the address has a Gravatar entry associated with it. This can be a useful signal that the email address belongs to a real person.

These checks help you decide whether to accept, reject, or flag an email address in your application logic.

Plan	Availability
Free	🚫
Starter	✅ Usage based pricing
Business	✅ Usage based pricing
Enterprise	✅ Usage based pricing

Discussion