Email Validation Endpoint

The email endpoint returns UserCheck's signals for an email address and its domain: whether the address is disposable, its normalized form, and the other fields documented below.

Endpoint

GET /email/{email}

Parameters

Parameter	Type	Required	Description
email	string	Yes	The email address to check (e.g., [email protected])

Query parameters

Parameter	Type	Default	Description
include_mx	boolean	true	Set to false to skip the MX lookup. The mx and mx_records keys are then left out of the response entirely rather than returned as null. mx_providers is still returned.
wait	string	none	Comma-separated list of fields to resolve before responding, instead of returning null and filling them in afterwards. Accepts domain_age_in_days and domain_authority. Pro plans only; unrecognized names are ignored.

wait trades response time for completeness. A field that is already known returns at normal speed; one that has to be looked up holds the response open until the lookup finishes. Ask only for the fields you actually need on the first response.

Request example

curl -X GET "https://api.usercheck.com/email/[email protected]" \
  -H "Authorization: Bearer YOUR_API_KEY"

Response

Success response (200)

{
  "status": 200,
  "email": "[email protected]",
  "normalized_email": "[email protected]",
  "domain": "github.com",
  "domain_authority": 96,
  "tld_trust": 1,
  "domain_age_in_days": 6871,
  "mx": true,
  "mx_records": [
      { "hostname": "github-com.mail.protection.outlook.com", "priority": 0 }
  ],
  "mx_providers": [
      { "slug": "microsoft", "type": "mailbox", "grade": "professional" }
  ],
  "spf": "relaxed",
  "dmarc": "quarantine",
  "disposable": false,
  "public_domain": false,
  "relay_domain": false,
  "free_subdomain": false,
  "alias": false,
  "role_account": false,
  "spam": false,
  "did_you_mean": null,
  "blocklisted": false
}

Response fields

Field	Type	Description
status	integer	HTTP status code indicating the result of the API request. 200: Successful request 400: Invalid input (malformed email) 429: Rate limit exceeded
email	string	The email address that was checked, as it was submitted.
normalized_email	string	The canonical form of the address: lowercased, with subaddress tags (user+tag@) and provider-specific alias conventions removed, and alternate domains folded into the primary one. An identity key rather than a delivery address; send mail to the submitted email instead, which is not always the same. See Email Normalization.
domain	string	The domain part of the email address, in normalized form: lowercased, with internationalized names converted to their ASCII (punycode) representation. The domain-level fields in the response describe this domain.
domain_authority	integer|null	A 0–100 score indicating how established and credible a domain is. Higher scores indicate well-established domains with strong online presence. Lower scores may signal newly created or less reputable domains. The value is null when the score has not been determined. See Domain Authority. Pro Plan Only
tld_trust	integer|null	A 1–5 score indicating how strict the registration requirements are for the domain's TLD. Higher scores mean the registry performed more identity verification before issuing the domain. See TLD Trust. Pro Plan Only
domain_age_in_days	integer|null	The number of days since the domain was registered, based on the registration date reported by the domain's registry. The value is null when the registration date is unknown or hasn't been retrieved yet.
mx	boolean|null	Indicates whether the domain has valid MX (Mail Exchange) records, the DNS records that name the servers accepting mail for a domain. A value of true means the domain is configured to receive email. The value is null when the DNS lookup couldn't be completed.
mx_records	array	The domain's MX records, sorted by priority (lowest value first, the order in which sending servers try them). Each record contains the mail server hostname and its priority. Empty when the domain has no MX records.
mx_providers	array	Third-party services the domain delegates its MX records to. Empty when the domain manages its own MX infrastructure or uses an unrecognized setup. See MX Providers.
spf	string|null	The domain's SPF posture: how strictly its published SPF record limits who may send email as the domain. One of: strict, relaxed, neutral, permissive, missing, or invalid. The value is null when the SPF posture hasn't been assessed yet. See SPF & DMARC.
dmarc	string|null	The domain's effective DMARC policy: what it asks receivers to do with mail that fails authentication. One of: reject, quarantine, none, missing, or invalid. The value is null when the DMARC policy hasn't been assessed yet. See SPF & DMARC.
disposable	boolean	Indicates whether the email address is disposable. This can be true because the domain is a disposable email provider, or because the specific email address has been identified as disposable on an otherwise legitimate domain. Some public email providers (Gmail, Outlook, etc.) are exploited to create throwaway addresses; in these cases, the individual email is flagged but the domain itself is not disposable. See Disposable Domains.
disposable_provider	string|null	Names the service operating the disposable domain, as context for the disposable flag: the domain itself rarely reveals which service is behind it. Usually the provider's primary domain, but an app store URL for providers that are mobile apps, so treat it as an opaque identifier. The value is null when the provider hasn't been identified. Only included in the response when the domain is disposable. See Disposable Domains. Pro Plan Only
public_domain	boolean	Indicates whether the email uses a public email service like Gmail, Yahoo Mail, or Outlook, where anyone can create a mailbox. Addresses on a public domain belong to unrelated individuals, unlike addresses on a company domain, which belong to one organization. See Public Domains.
relay_domain	boolean	Indicates whether the email uses a domain from an email forwarding or relay service such as SimpleLogin, DuckDuckGo Email Protection, or Apple's Hide My Email. These addresses automatically forward mail to the owner's actual mailbox at another address, which stays hidden. See Relay Domains.
free_subdomain	boolean	Indicates whether the email's domain is a subdomain of a free subdomain or dynamic DNS service like duckdns.org. The parent domain itself is not flagged. See Free Subdomains.
alias	boolean	Deprecated. true when the submitted address contains a + tag (e.g., [email protected]). Comparing email with normalized_email detects this and the provider-specific alias forms as well, so use that comparison instead. This field will be removed in a future API version.
role_account	boolean	Indicates whether the email is a role account (e.g., admin@, support@, billing@): an address that represents a function or team rather than an individual person, and is typically shared by multiple people within an organization. See Role Accounts.
spam	boolean	Indicates whether the domain is associated with spam or other abusive activity. These domains often look legitimate at first glance but have been flagged in UserCheck's dataset. A domain can be flagged as spam without being disposable. See Spam Domains.
did_you_mean	string|null	A suggested correction when the domain part looks like a likely misspelling of a well-known domain, returned as the full address (e.g., [email protected] → [email protected]). The value is null when no suggestion is available. See Did You Mean.
blocklisted	boolean	Indicates whether the email's domain exactly matches an entry on your account's custom blocklist. Entries are managed in the dashboard or through the Blocklist endpoint. Pro Plan Only

Error responses

Invalid email format (400)

{
  "status": 400,
  "error": "The email address is invalid."
}

Rate limit exceeded (429)

{
  "status": 429,
  "error": "Too many requests"
}