Everything about how EVA verifies emails, what it costs, and how to run it yourself. Can't find your answer? Email [email protected].
Last updated: August 4, 2026
verifications.email is an email verification API, also called EVA. It checks whether an email address is real and can receive mail before you send to it. The service runs 28 checks per address, including syntax and RFC validation, DNS and MX record lookups, live SMTP mailbox verification, disposable and role-account detection, catch-all scoring, spam trap detection, domain authentication analysis (SPF, DKIM, DMARC), blacklist checks, and deliverability grading. It is built for marketers cleaning mailing lists, SaaS teams validating signups, sales teams qualifying leads, and developers who want to embed verification in their own products. Pricing starts with a free tier of 300 verifications per month; paid plans run from $19 per month, and pay-as-you-go credit packs start at $5 for 1,000 checks and never expire. Teams that need unlimited volume or full data control can license the same engine to run on their own servers, starting at $4,995 one-time.
Four groups get the most out of EVA. Marketers cleaning mailing lists before a campaign, so bounces stay low and sender reputation stays intact. SaaS teams validating email addresses at signup to keep fake and disposable accounts out. Sales teams verifying prospect lists before outreach so sequences reach real people. And developers embedding verification into their own products through the REST API, SDKs, or the self-hosted engine. If you send email at any volume, or accept email addresses from strangers, EVA is built for you.
EVA has provider-specific verification strategies for Google (Gmail + Workspace), Microsoft (consumer + 365 Business), Yahoo (consumer + business), Apple iCloud, ProtonMail, Zoho, Mail.ru, Mimecast, and Proofpoint, plus a generic strategy for all other providers. The generic fallback handles greylist retries, timeouts, and ambiguous responses, so any mail server on the internet can be checked.
No. verifications.email is an independent email verification service launched in 2026 and has no connection to Verifications.io, a defunct, unrelated company known for a 2019 data breach. The two have never shared owners, staff, infrastructure, or data. Beyond the similar name, there is no relationship of any kind. verifications.email stores customer data on its own infrastructure and publishes its security contact at /.well-known/security.txt. More background is on the About page.
Enterprise plans include an SLA guarantee. Our cloud infrastructure maintains 99.9%+ uptime, and you can check current status at any time on the public health endpoint. If your use case needs contractual uptime or support commitments, email [email protected] and we will put terms in writing.
EVA achieves 99% verification accuracy using provider-specific strategies for Google, Microsoft, Yahoo, and more. Our proprietary methods resolve catch-all and accept-all limitations that trip up other services. When EVA cannot reach a definitive answer, it says so instead of guessing, and those checks are free.
A catch-all domain is configured to accept mail for any address at that domain, whether or not the specific mailbox exists. That makes a plain SMTP check useless, because the server says yes to everything. EVA detects catch-all configurations and then goes further, using provider-specific techniques and catch-all scoring to estimate whether the specific mailbox is real. For Microsoft 365 and Yahoo domains, dedicated strategies can often resolve a definitive answer where generic verifiers give up and label everything risky.
SMTP verification opens a connection to the recipient's mail server and asks, using the standard RCPT TO command, whether the mailbox exists. The conversation stops before any message is sent, so the address owner never sees anything: no email, no notification, nothing in spam. It is the same first step every legitimate mail server performs when delivering mail. EVA layers provider-specific handling on top, including greylist retries and rate-limit awareness, so checks stay polite and reliable.
Unknown means EVA could not reach a definitive answer: the mail server timed out, greylisted the connection, or returned an ambiguous response. Rather than guess, EVA reports the uncertainty honestly. Unknown results are never charged, on any plan, because you should not pay for a non-answer. In bulk jobs, unknown results are automatically re-verified with backoff, so many of them resolve to a definitive answer on their own.
Payments run through our crypto checkout. Bitcoin, Ethereum, and major stablecoins are supported, for both subscriptions and one-time credit packs. If you need another payment method, email support and we will find a way. Full plan and credit pack pricing is on the pricing page.
You are not charged. Unknowns are free. Some mail servers time out, greylist new connections, or give ambiguous answers, and when that happens EVA returns an unknown result instead of guessing. You only pay for definitive results, whether the address turns out to be valid, invalid, or risky with a clear reason attached.
Yes, the API is the product. It is a REST API with JSON responses, authenticated with an X-API-Key header and documented with a full OpenAPI specification. Official SDKs exist for JavaScript and TypeScript (npm) and for Python (pip), and there is a ready-made Postman collection for exploring the endpoints without writing code. An embeddable verification widget is available for signup forms. Endpoints cover single verification, bulk jobs, and account usage. See the API docs to get started.
Checks that stop at syntax, DNS, or cached results return in well under a second. Checks that need a live SMTP conversation usually take a few seconds, depending on the receiving mail server. Rate limits scale with plan: 10 requests per minute on Free, 60 on Starter, 200 on Pro, 500 on Business, and 1,000 on Enterprise. Every response includes X-RateLimit headers so your integration can pace itself. For large lists, bulk upload is faster than looping over the single-verify endpoint.
Upload a CSV or XLSX file with up to 50,000 emails in a single file. Many verifiers cap uploads at 1,000 to 5,000 on entry plans; EVA takes the full file. Processing runs in the background, you get a webhook when it finishes, and results download as CSV.
Emails you submit are used only to run the verification and to show results in your account history. We never sell or share your lists, and we never send mail to the addresses you check. If you need verification data to never leave your own servers at all, the self-hosted license covers that.
EVA is built to support GDPR-compliant use. Submitted addresses are processed only to perform the verification you requested and to show your results; they are never sold, shared, or mailed. A Data Processing Agreement is available at /dpa, alongside the privacy policy and terms of service. Teams with strict data residency requirements can go further with the self-hosted license, where email data never leaves infrastructure you control.
Same engine, same capabilities, your infrastructure. The cloud API is fully managed by us with usage-based pricing and no infrastructure work required. Self-hosted deploys with Docker on your own servers and pays zero per-email costs with unlimited volume, which suits high-volume or compliance-sensitive teams. Deployment licenses start at $4,995 one-time; OEM source licenses are available for embedding verification in your own product. Details are on the self-hosted page.
Yes. Your cloud account data, including API keys and usage history, stays available, and you can run both at the same time. Many teams start on the cloud API to validate the results on their own lists, then move high-volume workloads to a self-hosted deployment once the per-email math favors owning the engine.
Go 1.24. The entire codebase compiles to a single binary with zero runtime dependencies. Fast, lightweight, and straightforward to audit and extend. The cloud API and the self-hosted distribution run the same code, so results are identical wherever the engine runs.
Any Linux server with Docker. Minimum: 1 CPU, 1 GB RAM. Recommended: 2 CPU, 4 GB RAM for production workloads. Works on AWS, GCP, Azure, DigitalOcean, Hetzner, or bare metal. The stack ships as Docker Compose with PostgreSQL and Redis included, and most teams are verifying emails within 15 minutes of unpacking the distribution.
Deployment licensees pull updated Docker images; OEM licensees pull from the private source repository. The first 12 months of updates are included, then renewal is optional ($995/yr Deployment, $5,995/yr OEM). Mail providers change their behavior constantly, so updates are what keep accuracy high. Either way, the version you have keeps working indefinitely.
The Deployment License ships production Docker images, which is everything you need to run unlimited verifications. The OEM Source License adds the complete Go source with the right to modify, extend, and embed it in your own product. Neither license permits reselling the source, redistributing it, or offering email verification as a standalone service to third parties. Source is delivered under a signed agreement.
Because they grant different rights, not different software. The Deployment License lets you use the engine. The OEM License transfers our core asset, the source of a provider-specific verification engine that took years of research to build, plus the right to ship it inside your commercial product. You are buying rights, not bits.
Yes. The OEM license is available as a term license at $1,495/mo with a 12-month minimum, and larger licenses can be paid in milestones (for example on signing, on delivery, and after acceptance). Email us and we will structure something workable.
Try it yourself with 300 free verifications every month, or email [email protected] and a human will answer.
Get Started Free