Email Verification vs Email Validation: What Actually Matters?
The clear answer to what email validation and verification actually do, which one you need for your use case, and a decision tree to pick the right approach by volume.
Short answer: Email validation checks whether an address is formatted correctly. Email verification checks whether the mailbox actually exists. For cold outreach and campaign deliverability, you need verification. For form signup validation, you might only need validation.
Most guides treat these as interchangeable, which causes real problems — teams run regex checks, assume their list is “verified,” send a campaign, and wonder why they have a 10% bounce rate.
Here’s the full breakdown.
Email Validation: What It Actually Checks
Validation is syntax and format checking. It answers the question: is this a structurally valid email address?
What it checks:
- Presence of the
@symbol - Valid characters before and after the
@ - Presence of a domain with a valid TLD (
.com,.io,.co.uk, etc.) - No leading/trailing spaces
- No consecutive dots or illegal special characters
What it does NOT check:
- Whether the domain exists
- Whether the domain has mail (MX) records
- Whether the specific mailbox exists
- Whether the address is a disposable/temporary service
- Whether the address will actually accept mail
Example implementations:
// Basic JavaScript regex validation
const isValidFormat = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
// Google Sheets formula
=REGEXMATCH(A2, "^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$")These tell you that [email protected] is format-valid. It will pass validation. It will bounce if you send to it.
When validation is enough:
- Web form input validation at signup (catch typos like
[email protected]) - Data hygiene checks before importing a CSV (remove broken formats)
- Filtering a raw scraped list before paying for live verification credits
Email Verification: What It Actually Checks
Verification goes several layers deeper. It answers: does this mailbox actually exist and accept mail?
There are three levels of verification, each more accurate than the last:
Level 1: DNS / MX Record Check
After confirming the format is valid, a verifier checks whether the domain has MX (mail exchange) records — the DNS entries that tell the internet where to deliver mail for that domain.
What it catches: Domains that don’t exist, domains not configured to receive email, typos that create syntactically valid but non-functional addresses (gmail.co instead of gmail.com).
What it misses: Domains that have MX records but specific mailboxes that don’t exist.
Level 2: SMTP Handshake (Live Ping)
The most accurate method. The verifier initiates an SMTP connection to the mail server and asks, in effect, “do you accept mail for [email protected]?” without actually sending anything.
This is what providers like NeverBounce, ZeroBounce, and MillionVerifier do.
What it catches: Mailboxes that don’t exist even though the domain is valid, deactivated accounts, accounts that have been deleted.
What it misses: Catch-all domains (which respond “yes” to every address), and some servers configured to always return “yes” regardless of whether the mailbox exists (greylisting, anti-harvesting policies).
Level 3: Catch-All Detection
A subset of SMTP verification. When a domain is configured as a “catch-all” (it accepts mail to any address, regardless of whether the mailbox exists), standard SMTP checks return a false positive.
Good verification providers flag these separately with a catch-all status — meaning “the domain accepts mail, but we cannot confirm whether this specific address exists.”
Side-by-Side Comparison
| Capability | Validation | DNS/MX Check | SMTP Verification |
|---|---|---|---|
| Catches format errors | ✅ | ✅ | ✅ |
| Confirms domain exists | ❌ | ✅ | ✅ |
| Confirms domain accepts mail | ❌ | ✅ | ✅ |
| Confirms mailbox exists | ❌ | ❌ | ✅ |
| Detects catch-all domains | ❌ | ❌ | ✅ (flagged) |
| Detects disposable emails | ❌ | ❌ | ✅ (provider list) |
| Cost | Free | Free / API | Paid (fraction of a cent/ea) |
| Speed | Instant | Fast | Fast (~1s per address) |
Decision Tree: Which Do You Need?
What are you using this for?
│
├── Web form signup / input validation
│ └── Do you need to catch typos instantly?
│ ├── Yes → Email Validation (regex, client-side)
│ └── Yes + catch disposables → DNS/MX check (API call at submit)
│
├── Bulk list cleanup before sending
│ └── What kind of email?
│ ├── Transactional / product email (users who signed up) → DNS/MX check is usually sufficient
│ └── Cold outreach / marketing → Full SMTP Verification required
│
└── Ongoing list maintenance (recurring sends)
└── How large is your list?
├── < 100/mo → ZeroBounce free tier (100/mo)
├── 100–1,500/mo → Verification tool free plan (~50/day)
└── > 1,500/mo → Paid plan (~$79/yr for 500/day)The Accuracy Gap in Practice
Here’s what the gap between validation and verification looks like on a real list:
A list of 1,000 addresses collected via LinkedIn scrape or data provider typically contains:
| Issue | Approximate rate |
|---|---|
| Format errors (catch with validation) | 1–3% |
| Valid format, non-existent domain | 2–5% |
| Valid domain, non-existent mailbox | 8–15% |
| Catch-all (unknown deliverability) | 10–25% |
| Disposable emails | 1–3% |
Running only validation removes the 1–3% format errors. Running full SMTP verification removes the other 10–20%+ that would bounce or soft-fail.
On a 1,000-contact cold list, the difference between “validated” and “verified” is often 100–200 addresses that would otherwise bounce — enough to damage your sender reputation significantly.
Common Misconceptions
“We use an email validation API at signup, so our list is clean.”
Your signup form validation catches typos. It doesn’t catch addresses that were valid at signup but have since become inactive (job changes, account closures). For campaigns to a list built 3+ months ago, you need a fresh SMTP verification pass.
“NeverBounce / ZeroBounce says it’s valid, so it won’t bounce.”
Catch-all addresses pass verification as catch-all — not as valid. If you’re treating catch-all as equivalent to valid for cold sends, you’re accepting bounce risk the provider explicitly flagged.
“Verification is too expensive for our volume.”
At current provider pricing, SMTP verification costs roughly $0.003–$0.008 per email depending on volume. Verifying 1,000 emails costs $3–8. One bounced domain warming sequence that forces you to acquire a new sending domain costs significantly more.
Practical Recommendation by Scale
| Monthly email volume | Recommended approach |
|---|---|
| < 100/month | ZeroBounce or Hunter.io free tier (100/month) |
| 100–1,500/month | Smart Email Verifier add-on free plan (50/day, Sheets-native) |
| 1,500–15,000/month | Smart Email Verifier premium ($79/year, 500/day) |
| > 15,000/month | Direct NeverBounce / ZeroBounce bulk API plan |
For Google Sheets users specifically: the Smart Email Verifier Add-on connects NeverBounce, ZeroBounce, or MillionVerifier directly to your spreadsheet — no CSV export, no manual reimport. Verification results appear in a status column alongside your data.
Summary
- Email validation = syntax check. Free, fast, catches formatting errors only.
- Email verification = live SMTP check. Confirms the mailbox exists. Required for cold outreach.
- Catch-all detection = a subset of verification. Flags domains that accept everything — treat differently from confirmed valid addresses.
The right answer isn’t always “do full SMTP verification on everything.” For signup forms, a real-time validation API (plus optional MX check) is usually sufficient and faster. For cold outreach to any list larger than ~50 addresses, full verification is the baseline — not a premium feature.
Need SMTP verification inside Google Sheets? Smart Email Verifier add-on — free to install →