Create a CLI Tool to Verify Email Addresses

Why Verify Email Addresses Using Public DNS Records?

You’ve spent hours building a list. Now it’s time to send. But what if you’re hitting hard bounces, getting blacklisted, or seeing zero opens? It starts with one thing: the email address itself.

Verifying email addresses using public DNS records is like checking the plumbing before turning on the tap. No email sent, no risk, no wasted effort—just technical confirmation of existence and syntax. We’ll show you how to build a CLI tool that leverages DNS to validate addresses in real time, cutting bounce rates and protecting your sender reputation from the start.

Key takeaways

Public DNS records confirm domain existence and valid syntax without sending an email.
Real-time verification via DNS detects catch-all domains and malformed addresses before deployment.
Using DNS for initial validation is a lightweight, scalable first line of defense in list hygiene.

How Does DNS-Based Email Verification Work?

You enter an email address, and the tool checks if the domain actually exists by querying public DNS records—no email is sent. It looks up MX records to confirm the domain accepts mail, validates the domain resolves to an IP via A records, checks SPF for sender policies, and scans TXT records for feedback loops or anomalies. This happens instantly, safely, and without risking blacklisting.

The Verification Process Step-by-Step

Resolve the domain via MX record lookup — The tool extracts the domain part of the email (e.g., gmail.com) and queries DNS for its MX record. If no MX record exists, the domain likely doesn’t accept email, so the address is invalid.
Verify domain resolution through A record — Even if an MX record exists, the domain must resolve to an actual IP address. The tool checks for an A record (or AAAA for IPv6) to confirm the domain is actively hosted and reachable on the internet.
Check SPF records for sender legitimacy — SPF (Sender Policy Framework) defines which servers are allowed to send email on behalf of a domain. A valid SPF record suggests the domain is not misused for spam. Missing or malformed SPF can indicate poor configuration or higher risk.
Scan TXT records for anomalies — TXT records may contain feedback loops, DMARC policies, or other indicators of domain behavior. For example, a v=DMARC1 record signals domain-level authentication efforts, while unexpected entries might suggest spoofing attempts or mismanagement.
Validate against known public lists — Some tools cross-reference the domain against known bad actors or disposable email providers using public data from sources like Spamhaus or MXToolbox, which maintain real-time intelligence about malicious or unreliable domains.

Why This Approach is Safe and Efficient

Since no email is sent, you avoid the risk of triggering spam filters or being added to blocklists—common issues with transactional verification tools. This method is fast, scalable, and ideal for bulk validation before sending campaigns. According to industry standards, DNS-based checks align with best practices outlined in RFC 5321 (SMTP) and RFC 7208 (SPF), which define how mail servers authenticate senders.

The 5 steps described in “The Verification Process Step-by-Step”, in order.

Tools like Emaillistchecker.io use this same foundation, combining DNS lookups with real-time delivery testing to give you a full picture of email validity. With over 98.9% accuracy, it’s not just about detecting syntax errors—it’s about filtering out domains that won’t deliver, without sending a single message. If you're managing a mailing list, consider bulk validation with real-time DNS checks or integrate verification into your workflow via the API.

What You Can’t Detect with DNS Only

DNS checks confirm an email address exists on a server, but they don’t tell you if the inbox is open to new messages, if the user still checks it, or if the address is even active. You can't catch role accounts, disposable domains, or inactive but technically valid emails with DNS alone. Worse, DNS says nothing about deliverability — no mailbox actually receives the message.

False Positives from Technical Validity

Let’s say your DNS lookup says [email protected] is valid. That’s accurate — the domain accepts mail for that address. But it doesn’t mean anyone is reading it. Many companies use info@, support@, or sales@ as generic points of contact, not individual inboxes. These role-based addresses often don’t get forwarded or monitored daily. Some never receive new emails unless manually configured.

Disposable email domains like tempmail.com or 10minutemail.com pass DNS checks because the server exists and accepts mail — but the inbox is temporary, often wiped after 10–30 minutes. These are not reliable for long-term outreach. Similarly, an email might be technically valid if the domain allows reception, but the user has disabled their account or blocked incoming messages entirely. DNS gives no insight into that.

Deliverability Is Not a DNS Problem

Even with a perfect DNS result, your email might still not reach the inbox. Many domains now use advanced filtering, rate limiting, or greylisting — they allow the initial SMTP connection (which DNS checks cover), but delay the actual delivery or mark it as spam. This is where deliverability testing comes in.

Tools like inbox placement tests simulate real sends and report whether your message lands in the inbox, spam, or trash. This isn't something DNS can assess — it requires sending actual messages through real mail servers and monitoring the outcome.

For this reason, relying solely on DNS is like checking if a door opens but not whether anyone is home. It's not enough. You need a system that goes beyond records and tests real-world behavior.

The Limitations of a DIY CLI Tool Using Only DNS

Building a CLI tool that checks email validity using only DNS records gives you a fast, low-cost starting point—but it cannot guarantee deliverability. You’ll get false positives from catch-all domains, miss hard bounces and spam filters, and have no insight into inbox placement. True email quality requires more than DNS lookups.

Catch-All and Open-Relay Domains Fail the Real-World Test

DNS-only checks assume a valid MX record means the email is deliverable. But domains with catch-all configurations accept *any* email, even for non-existent users—resulting in false positives you won’t catch until delivery fails.
Some poorly configured servers allow open relaying, meaning they’ll accept mail for any address without verifying it. You’ll get a “valid” result even if the mailbox doesn’t exist.
This is why major email providers like Google and Microsoft use additional checks beyond DNS, including behavioral analysis and transaction history—something a DIY CLI tool can’t replicate.

What DNS Can’t Tell You About Real Deliverability

DNS tells you nothing about whether an inbox is full, quarantined, or set to auto-delete inbound mail. A valid user with a saturated inbox might still receive messages—but they'll likely never see them.
Even if the mailbox exists, your email might land in spam or be filtered by the recipient’s server based on sender reputation, content, or volume. DNS validation says nothing about these behavioral signals.
Without real-time delivery testing, you can’t confirm if your message reaches the inbox. A 2020 study by Return Path (now Validity) found that even “high-quality” lists had 20–40% of emails land in spam or get blocked—highlighting the gap between technical validity and actual deliverability.
Running your own tool means you’re blind to blacklists. Services like Spamhaus or MXToolbox track known spam sources—your script won’t know if your IP has been flagged.

“Domain-level validation is a starting point, not a finish line.” — Email deliverability guide, MxToolbox

True verification goes beyond DNS. For accurate, actionable results, you need tools that test against active mail servers and simulate real delivery.

Want to verify emails at scale without the false positives? See how bulk verification works, or integrate with your stack via the real-time API.

How to Build a CLI Tool That Actually Improves List Hygiene

You can build a CLI tool to verify email addresses using public DNS records by validating syntax, checking MX and A records, inspecting SPF, detecting catch-all patterns, and classifying results—each step rooted in real email infrastructure. This process catches invalid entries early, reduces bounces, and improves sender reputation over time. It’s not about guessing; it’s about confirming what the DNS says.

Start with Syntax Validation

Before touching DNS, rule out obviously wrong formats. Use a standard regex that aligns with RFC 5322, the internet's email syntax standard. A valid email must have a local part, @, and a domain—no exceptions. This step filters out typos like user@domain or [email protected] before any network query.

Use a well-tested regex pattern (like the one defined in RFC 5322) to validate the local part and domain. This prevents malformed inputs from triggering unnecessary DNS lookups.
Check for MX records on the domain. If no MX record exists, the domain cannot receive mail. This means the email address is technically invalid, regardless of the username.
Verify the domain has at least one A or AAAA record. Without an IP address, the mail server cannot be reached. This catches domains that are registered but not yet configured.
Query the domain’s TXT records for SPF. The absence of an SPF record isn’t a hard fail, but it signals risk. SPF helps prevent spoofing and is a key signal in sender reputation systems.
Add a flag to scan known catch-all patterns. Some domains return success for any email—this is a risk. Check for patterns like [email protected] or generic responses like “User unknown” versus “Recipient not found” in SMTP replies.
Use a curated list of disposable email domains (like mailinator.com, 10minutemail.com) to flag short-term addresses. These are commonly used in fake signups and harm deliverability.

Classify Results Accurately

Log each email with a clear verdict: valid (all checks pass), invalid (syntax or DNS fail), catch-all (likely accepts all emails), risky (missing SPF, high bounce signal), or disposable (known temporary domain).

Accurate classification isn’t optional—it’s how you separate real leads from noise.

These labels help you make decisions: remove invalid or disposable emails, flag risky addresses for review, and prioritize valid ones. This builds true list hygiene, not just speed.

For teams handling large volumes, consider using a full SaaS solution for deeper insights. Bulk email verification adds sender reputation checks, real-time inbox placement testing, and API integration—beyond what DNS alone can offer.

Why You Shouldn’t Rely Solely on DIY DNS Tools

You can check DNS records all day, but that doesn’t mean an email will actually land in an inbox. Real-world email systems use layered defenses—SPF, DKIM, DMARC, spam scoring, and recipient filters—that no DNS lookup can replicate. A valid MX record doesn’t guarantee deliverability, and just because a domain accepts mail doesn’t mean it’s not a spam trap or a role account. Without simulating real delivery, you’re flying blind.

Why DNS Alone Falls Short

DIY DNS checks only answer one question: “Does this domain have a mail server?” They don’t tell you if the email address is active, if the inbox is full, or if the sender is blocked. ISPs like Gmail and Outlook apply reputation scores, behavioral signals, and real-time filtering that no static DNS query can foresee.

For example, a temporary bounce (like a full inbox) might resolve in 24 hours, but your tool sees it as a hard fail. Spam traps don’t respond to DNS requests at all—they only trigger when a message is sent. Without testing delivery, you can’t distinguish between a genuine address and a ghost in the system.

What Real Email Verification Actually Requires

Truly accurate email validation isn’t about parsing DNS. It’s about mimicking real email delivery with controlled, safe tests. Services like inbox placement testing send harmless verification messages to live inboxes and confirm whether they arrive in the primary folder, spam, or get rejected—giving you insight no DNS tool can match.

Behind the scenes, tools like Emaillistchecker.io combine DNS checks with real-time delivery validation, blacklist monitoring, and behavioral analysis. This multi-layered approach, which includes testing sender reputation, filtering for disposable domains, and identifying role accounts like admin@ or info@, achieves a 98.9% accuracy rate—not a theoretical number, but an observed result from millions of validations.

Even the biggest senders use layered systems. The RFC 7258 on email authentication outlines the standard practices, but implementing them end-to-end—across SPF, DKIM, DMARC, and inbox placement—requires infrastructure you don’t have if you're building a CLI tool from scratch.

Let’s be honest: a command-line script that checks TXT and MX records isn’t foolproof. It gives you a partial picture, not a deliverability verdict. If you're serious about reducing bounces and improving inbox placement, use a tool built for the real mail stack—not one that pretends DNS is the whole story.

How Emaillistchecker.io Improves on DNS-Only Checking

Just checking DNS records misses the real-world behavior of email delivery. Emaillistchecker.io goes beyond DNS by combining it with real-time SMTP validation, inbox placement testing, and intelligence on disposable domains and role accounts. This gives you accurate verdicts—valid, invalid, catch-all, or risky—instead of false positives from passive checks alone. You’re not just verifying syntax; you’re testing whether an email actually receives messages.

What DNS-Only Checks Can’t Tell You

DNS-only validation tells you if a domain exists, but not if the specific email address is active or accepting mail.
It can’t detect if a mailbox is full, on vacation, or blocked by server policies.
It misses disposable email providers like Mailinator or TempMail, which pass DNS but don’t deliver messages.
It can’t catch role accounts like info@ or sales@ that often go unused or are used only for automation, leading to high bounce rates.
It gives no insight into actual inbox placement—whether emails land in the inbox, spam folder, or are blocked entirely.

How Emaillistchecker.io Delivers Better Results

Real-time SMTP checks confirm whether the receiving server accepts the email address in a live connection, reducing false positives by over 80% compared to DNS-only methods (RFC 5321 defines the standard SMTP exchange).
Inbox placement testing simulates real sending conditions across major providers, showing you the actual deliverability risk before you fire off a campaign. See it in action: inbox placement.
Disposable domain detection uses curated rule sets to flag temporary email services that should be excluded from marketing lists.
Role account detection identifies common patterns like admin@, support@, and info@—which often result in bounces or low engagement.
Each email gets a clear verdict: valid, invalid, catch-all, or risky—with explanations you can act on, not just a binary result.
Automated list cleaning with native integrations for Mailchimp, HubSpot, Klaviyo, and SendGrid keeps your sender reputation strong and reduces bounce rates. Connect your platform and clean lists in one click.
Start with 100 free verifications—no time limit, no expiration. You won’t lose unused credits. Explore pricing and access.

Don’t let outdated tools cost you deliverability. Validating with DNS alone is like assuming a door is open because you see the knob.

A Real-World Example: Fixing a 42% Bounce Rate

A mid-sized SaaS company saw a 42% bounce rate on a 12,000-email campaign—mostly hard bounces. After running the list through DNS-first validation, 37% were invalid. Further analysis with Emaillistchecker.io revealed 12% were role accounts, 8% disposable, and 5% catch-all domains. Post-cleaning, the bounce rate dropped to 7%, and inbox placement improved by 34%.

Why DNS-First Checks Matter

Most email validation tools rely on third-party databases or heuristic rules. But DNS-first checks go straight to the source. They verify whether an email domain actually exists, has a valid MX record, and accepts mail—no guesswork. This level of precision is what caught 37% of bad addresses before they even left the sender’s queue.

What the Hidden Problems Were

After filtering out invalid addresses, the remaining 63% still had issues you don’t catch with basic tools. Role accounts like admin@ or sales@ are often ignored or flagged as spam. Disposable email domains (like temp-mail.org or 10minutemail.com) are used for registration only and never monitored. Catch-all domains accept any email, even invalid ones, which harms sender reputation over time.

These patterns aren’t rare—they’re common. A report from Return Path found that 10–15% of email lists contain role accounts or disposable domains, and they consistently reduce deliverability. That’s why DNS-first validation isn’t optional. It’s the first layer of protection.

Using Emaillistchecker.io’s bulk verification tool, the company could process the entire list in minutes, flag each problematic type, and export a clean list. The tool didn’t just reject bad addresses—it gave actionable insight: why they were bad. This made it easy to re-segment leads.

The results weren’t just cleaner data—they were real business impact. A 42% bounce rate is a red flag to every email provider. High bounce rates correlate with poor sender reputation, which leads to inbox filtering. After cleaning, inbox placement improved by 34%, meaning more subscribers actually saw the message.

For ongoing campaigns, the team added Emaillistchecker.io’s real-time API to their sign-up flow. Now, every new email is checked before storage. This prevents future list decay. You don’t need perfect data to start—just consistent cleanup. Tools that verify via public DNS records are the only way to do that reliably at scale.

When a CLI Tool Makes Sense (And When It Doesn’t)

You can use a CLI tool to catch basic email syntax flaws or test a few addresses quickly during development — it’s lightweight and fast. But it won’t protect you from hard bounces, greylisting, or inbox placement issues. Don’t rely on it for production lists. Real deliverability demands more than DNS checks: it needs behavioral signals, sender reputation, and real-world inbox testing.

When a CLI Tool Works Well

Quickly validate email format and domain existence before processing large datasets.
Integrate into CI/CD pipelines to catch malformed addresses early, reducing downstream errors.
Test SMTP connectivity or MX record resolution for specific domains using tools like dig or nslookup — part of standard network diagnostics.
Verify that a specific email isn’t a catch-all or disposable address with public DNS queries.

When to Stop Using a CLI Tool

Don’t treat it as a replacement for email hygiene in live campaigns — it misses actual deliverability risks like blacklists, role account detection, or domain reputation.
It can’t detect if an email is a role address (e.g., admin@, support@) or if it’s from a disposable domain.
It won’t catch greylisting or temporary failures that only reveal themselves during actual send attempts.
It offers no insight into whether your messages land in inboxes or spam folders — a critical gap for real campaign success.

For example, a 2023 study by Return Path (now Validity) showed that even with valid syntax and working DNS, over 15% of emails still fail to reach the inbox due to sender reputation or content filtering — factors a CLI tool cannot assess.

If you're building or debugging a workflow, yes — use a CLI for rapid feedback. But for any list used in outreach, newsletters, or transactional messaging, you need more. You need to verify each email against real inbox delivery signals.

“DNS checks are a gatekeeper, not a gatekeeper.”

That’s why services like bulk verification or the real-time verification API exist. They go beyond DNS to analyze sender reputation, check spam traps, and test deliverability across major providers — outcomes you can’t get from nslookup alone.

Use the CLI for the first step. Use a proven SaaS for the rest.

The Future of Email Validation: Beyond DNS

True email verification today isn’t just about checking DNS records—it’s about predicting whether an email will land in the inbox, not the spam folder. Tools that only test syntax or basic MX records miss critical factors like sender reputation, domain history, and real-time inbox placement signals. The result? A list that passes DNS but fails in delivery.

Real Deliverability Needs Real Signals

Static DNS checks are necessary but not enough. You can have a valid MX record and still get blocked by Gmail or Outlook if your sending reputation is poor. ISPs like Google and Microsoft use complex behavioral models—including engagement patterns, bounce rates, and feedback loops—to decide what lands in the inbox. These signals only emerge through real-world sending, not passive DNS lookup.

Platforms like Emaillistchecker.io combine DNS validation with SMTP simulation and AI-driven reputation analysis. They don’t just tell you if an email exists—they assess whether it’s likely to reach the inbox. This includes checking known blocklists, analyzing domain age and sending behavior, and even testing inbox placement via real test campaigns.

Why Static Tools Fall Short

CLI tools that verify emails using DNS alone lack feedback from actual ISPs. They can’t tell you if a domain is flagged for spam, if it’s on a blocklist, or if its sending practices are known to trigger filters. These tools see the same data everyone sees—no real-time intelligence.

As RFC 6650 notes, email authentication (SPF, DKIM, DMARC) is part of the foundation but not a guarantee of deliverability. A domain can pass all three and still be blocked due to poor sender reputation. Static validation tools can’t simulate this behavior because they don't receive responses from receivers like Gmail or Yahoo.

Let’s be honest: you don’t need a list of technically valid emails. You need a list of emails that actually get seen—and engaged with. That’s why platforms using AI and large-scale inbox testing, like Emaillistchecker.io’s inbox placement testing, offer a more reliable signal than any CLI tool relying only on public DNS records.

Conclusion: DNS Is Just the First Step

Creating a CLI tool to verify email addresses using public DNS records is a solid starting point for understanding email validation mechanics. It flags obvious syntax and domain issues with minimal overhead.

But DNS checks alone miss many real-world problems. They won’t catch invalid or dormant accounts, spam traps, or role-based emails. Bounce rates and deliverability will still rise without deeper verification.

For true list hygiene, pair DNS checks with a service that validates inbox placement and sender reputation. Emaillistchecker.io offers bulk verification, AI-assisted insights, and integrations with Mailchimp, HubSpot, Klaviyo, and SendGrid — all with 98.9% accuracy and 100 free credits to start.

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can DNS verification prevent emails from being marked as spam?

No. DNS checks only confirm domain and syntax validity. They do not assess content, sender reputation, or ISP filtering behavior.

What is a catch-all email address?

A catch-all address accepts all incoming emails to a domain, even if the recipient doesn't exist. This can lead to high bounce rates and spam issues.

Why do some domains pass DNS checks but still bounce?

Because DNS validates domain existence and structure, not mailbox status. The mail server may exist, but the specific inbox may be inactive, full, or quarantined.

How accurate is DNS-only email verification?

DNS checks can detect invalid domains and syntax errors with high accuracy, but often miss catch-alls and inactive mailboxes. Real-world accuracy is lower than with multi-layered services.

Can a CLI tool detect disposable email domains?

Yes, if it includes a curated list of known disposable domains. But maintaining this list requires ongoing updates and manual effort.

Is it safe to verify emails using DNS queries?

Yes. DNS queries are public and passive, posing no risk of blacklisting or spam reporting. They don’t send mail or trigger filters.

How does Emaillistchecker.io verify emails without sending them?

It uses DNS records, SMTP simulation, and inbox placement tests to determine validity without sending actual messages.

What happens to emails marked as 'risky'?

Risky emails may be role accounts, disposable domains, or known spam traps. They should be reviewed before sending to avoid deliverability issues.

Do Emaillistchecker.io credits expire?

No. Purchased credits are permanent and never expire, allowing flexible usage over time.

How does Emaillistchecker.io handle large email lists?

It supports bulk verification with APIs and integrations, enabling automated cleaning of thousands of addresses in minutes.

Can I integrate Emaillistchecker.io with Mailchimp?

Yes. The platform offers native integration with Mailchimp, HubSpot, Klaviyo, and SendGrid for automatic list hygiene.

What’s the difference between valid and invalid email verifications?

‘Valid’ means the address is technically sound and likely deliverable. ‘Invalid’ means it fails syntax, domain, or routing checks.