DIY Email Validator Using Public DNS

Can you really verify an email address without sending it or using an online service?

You’re about to send a campaign. Your list is large. You don’t want bounces, wasted sends, or blacklisting. But you’ve heard the warning: “Don’t trust your list.” So you wonder—can you really check an email without sending a single message, or relying on a tool like Mailchimp’s built-in checker?

Yes. You can. By using only public DNS records—like MX, SPF, and A records—you can answer one key question: does the domain even exist on the internet for receiving mail? It’s not magic. It’s the basic plumbing of how email works. This method is the foundation of any DIY approach to email verification.

Think of it like checking a street address before mailing a letter. You can confirm the street exists. But you can’t know if the house has a mailbox, or if the person lives there. Same with email: DNS checks confirm the domain is set up to receive mail—no more, no less. It doesn’t tell you whether the specific email is active, or if it’s a disposable one, a role account, or syntactically broken.

Key takeaways

You can verify an email’s technical existence using only public DNS records like MX and A without sending mail or using a third-party service.
Public DNS checks reveal whether a domain is configured to receive mail, not whether a specific email is active or valid.
This approach is a core, foundational step in list hygiene but cannot detect role accounts, disposable domains, or invalid syntax on its own.

What DNS records are needed to validate an email address manually?

You can validate an email address using only public DNS records: MX (for mail servers), A (to confirm domain existence), and SPF (to check if the domain authorizes sending). DKIM and DMARC are not needed for basic validation—they're for sender authentication, not address validity. Querying these three records gives you a strong signal on whether an email is likely to exist and be deliverable.

MX records: The mail servers that receive email

When you query a domain’s MX record, you’re asking: “Who handles incoming mail for this domain?” A valid MX record means someone is actively accepting emails for that domain. No MX record means the address is almost certainly invalid. This is the most critical check for confirming the domain can receive mail.

A records: Confirming the domain exists

An A record maps a domain name to an IP address. If a domain has no A record, it doesn’t resolve on the internet—meaning it either doesn’t exist, is misconfigured, or has been taken down. You can check this using tools like MxToolbox or standard command-line tools like dig A example.com. Lack of an A record typically means the email address is dead.

SPF records: Indicating domain legitimacy

SPF (Sender Policy Framework) records list which servers are authorized to send email on behalf of a domain. The presence of an SPF record doesn’t confirm an individual email is valid, but it indicates the domain is actively managed and takes email delivery seriously. Absence of SPF increases the risk of the domain being spoofed or unused—red flags for address validity.

DKIM and DMARC are not required for basic validation. DKIM signs outgoing messages, and DMARC defines policies for handling unauthenticated mail. They’re used by recipients to evaluate sender trust, but they don’t tell you whether an email address actually exists or can receive messages.

Manual validation using only these three records is a solid baseline. Tools like bulk verification automate this process across large lists while adding additional checks like disposable domains, role accounts, and deliverability trends. For real-time validation, the API pulls in DNS data along with reputation scoring and inbox placement analysis—without relying on third-party blacklists or databases.

If you're building a DIY validator, use public DNS queries via standard tools like dig or nslookup. You don’t need proprietary data to answer the core question: “Can mail be delivered?” Answer: Only if MX, A, and SPF records exist and resolve correctly. That’s the foundation of email validation at scale.

How to manually check email validity using only public DNS tools

You can verify an email’s domain legitimacy with free, public DNS tools like dig or nslookup. Check for an A record (to confirm the domain resolves) and MX records (to confirm it accepts mail). If both exist, the domain is technically valid. Missing either indicates the email address is unlikely to be deliverable. For deeper validation, inspect SPF records via TXT lookups.

Open a terminal or use a web-based DNS tool like Google’s public DNS resolver or MXToolbox to query the domain.
Run dig example.com A to check if the domain has an A record. No A record means the domain doesn’t resolve to an IP address—this is a firm indicator of invalidity.
Run dig example.com MX next. A missing MX record means the domain doesn’t route incoming mail. This is a hard failure—no mail can be delivered.
If both A and MX records exist, the domain is technically valid. You can proceed to validate the full email address using an SMTP check—but that requires sending an actual email, which is outside the scope of pure DNS validation.
For edge cases, run dig example.com TXT and look for SPF records. SPF exists to prevent spoofing, but its presence doesn’t guarantee inbox delivery—it only means the domain has published sending policies.

Why DNS validation works—and where it fails

Public DNS records are the foundation of internet email routing. As defined in RFC 5321, an email recipient must be reachable via DNS. If a domain has no MX record, mail servers won’t attempt delivery. The same applies to missing A records.

But DNS checks only validate the domain. They can’t detect catch-all servers, role accounts (like admin@ or support@), or disposable email addresses. They also can’t confirm whether a mailbox exists or is active—only whether the domain’s routing is configured.

When to automate this process

Manually checking each email is time-consuming and error-prone. Tools like bulk email verification automate these checks across thousands of addresses, including SMTP-level validation and catch-all detection. For real-time integration, use the EmailListChecker API with support for Mailchimp, HubSpot, Klaviyo, and SendGrid via native integrations.

You can do this with public tools. But doing it right—efficiently, accurately, and at scale—requires a system tuned for deliverability. Accuracy rates above 98.9% come from combining DNS checks with active SMTP validation and behavior analysis, not just queries.

Why a DIY DNS method isn’t enough for full email validation

You can confirm a domain exists using public DNS records, but that doesn’t mean a specific email address is valid, active, or capable of receiving messages. DNS only tells you if the domain is real — not whether the mailbox actually exists or is set up to accept email. A DIY method using only DNS queries is incomplete because it misses critical layers of deliverability risk: catch-all domains, role accounts, disposable addresses, and typos.

Domain existence ≠ mailbox existence

Running a DNS MX or A record lookup shows a domain is real — but it doesn’t check whether a particular address like [email protected] is actually set up. Many domains respond to any email address, even if the user doesn’t exist. This is called a catch-all configuration, and it’s common in poorly managed or disposable email systems. You’ll get a positive DNS response, but the address never gets your message, leading to wasted sends and potential deliverability penalties.

False positives from role and disposable addresses

Role-based emails like admin@, support@, or info@ often resolve via DNS, but these accounts are rarely monitored or used for actual communication. They appear valid but deliver nothing. Similarly, disposable email domains (like Mailinator or 10minutemail) have working DNS but are designed for temporary use — no one actually reads messages sent there. A bare DNS check can’t distinguish between these and real, active addresses. Even simple typos — like [email protected] instead of [email protected] — will pass DNS validation, but the email won’t work. According to an RFC 5321 standard, DNS resolution is just the first step in SMTP validation, not the final decision.

For reliable validation, you need real-time SMTP inspection and behavioral analysis. Tools like bulk verification or the email verification API not only check DNS but simulate the actual delivery process — detecting bounces, greylist delays, and invalid inbox responses. They also flag role accounts and disposable domains based on known patterns and reputation data, reducing false positives from DIY methods.

What happens when you verify an email with only DNS checks?

You’ll catch domains that can receive mail—like checking if a mailbox exists at a post office—but you won’t know if the specific address is real or active. You’ll reduce hard bounces, but miss role accounts, typos, and inactive users. This method screens for technical validity only, not deliverability or inbox placement.

The limits of DNS-only verification

Running only DNS checks tells you whether a domain has MX records and valid SMTP infrastructure. That’s useful—it confirms the domain is technically capable of receiving email. But it doesn’t confirm whether the user exists, whether the mailbox is disabled, or whether the email is actually deliverable.

For example, an address like [email protected] or [email protected] might pass DNS checks, but still bounce if not monitored. Same with misspelled addresses like [email protected]—valid domain, invalid user.

What DNS checks miss

You might think "if the domain checks out, the email should work." But this overlooks real-world issues that don’t show up in the DNS layer. Catch-all domains, for instance, accept all incoming mail regardless of individual address validity. A check that finds a working catch-all doesn’t mean the specific email is active.

Disposable domains (like tempmail.com) often pass DNS checks too. They’re set up to receive mail, but only for short-lived use—perfect for spam, not long-term engagement. DNS alone can’t flag these.

And while you’ll avoid hard bounces (errors like 550 "mailbox not found"), soft bounces (like 450 "user mailbox full") and deliverability issues still happen. These depend on sender reputation, content, timing, and engagement—all outside DNS.

Let’s be honest: DNS checks aren’t enough. They’re a filtering step, not a full verification. They help shrink your list, but they don’t guarantee inbox placement or engagement.

For a more complete solution, combine DNS checks with real-time validation, SMTP verification, and inbox placement testing. Tools like bulk email verification or the real-time API go beyond DNS by simulating actual delivery attempts.

According to RFC 5321, the SMTP protocol defines the framework for mail delivery, but it doesn’t guarantee the end-user exists. Even a successful SMTP handshake doesn’t mean the recipient will read it. That’s why relying only on DNS is like checking if a door is open—but not whether someone is home.

At minimum, DNS checks should be part of a larger strategy. But for reliability, you need more than just a domain’s technical setup. You need to verify real delivery and engagement potential.

How to avoid false positives from catch-all domains using DNS

DNS checks alone can't tell you if an email address is valid or just routed by a catch-all domain. Validating via MX or A records only confirms the domain exists—not that the specific address does. To avoid false positives, you need SMTP-level validation that examines actual server responses, like 550 or 551 codes, which standard DNS tools miss.

Why DNS records fail with catch-all domains

Catch-all domains are set up to accept all incoming mail, regardless of the local part. That means even a malformed address like [email protected] will appear valid when you check its MX record or verify the domain via DNS lookup.

Let’s say you’re validating a list of addresses using nothing but DNS queries. The server responds with a successful connection, and everything looks fine. But in reality, the address doesn’t exist—only the domain does. That’s a false positive, and it can hurt your deliverability.

SMTP is the only reliable way to detect catch-alls

To catch this issue, you need to perform an SMTP handshake. This involves sending a real email connection request and reading the server’s response code. If the server returns a 550 or 551 error during the RCPT TO step, the address is invalid. Catch-all domains often skip this step and accept the address, so only SMTP-level checks can reveal the truth.

Public DNS checks can’t simulate this. They don’t connect to the mail server, they just read records meant to describe routing, not intent. Even tools like RFC 5321 acknowledge that DNS alone cannot verify delivery potential—only an actual SMTP session can.

For example, if a single email fails with a 550 error, that’s a red flag: the address isn’t valid. But if it passes with no error, and the domain is a catch-all, you won’t know—it could be accepting all inputs. That’s why relying solely on DNS is flawed.

You can’t eliminate false positives from catch-alls with DNS alone. Only real-time SMTP verification does. If you're managing a list and want to catch these issues early, consider using a service with live SMTP validation built in.

Tools like email list verification perform actual delivery tests instead of relying on static DNS. They check response codes, detect disposable domains, and flag risky addresses—without you needing to write code or manage infrastructure.

Where this DIY approach falls short in real-world email campaigns

Running your own email validation using public DNS checks won’t stop high bounce rates, catch disposable addresses, or prevent spam traps. It only confirms basic syntax and MX records—meaning you’ll still hit invalid, role-based, or blocked addresses. Without real inbox presence testing, sender reputation checks, or automation, your list stays risky. Even a small list can become a deliverability liability if you go it alone.

What basic DNS checks miss

You’re not verifying whether an email actually accepts messages—only that a domain has an MX record. A valid DNS setup doesn’t mean the inbox exists or is active.
Role accounts like info@ or support@ are often catch-alls. Your DNS check will pass, but the message won’t reach a real person—and could trigger spam filters.
Disposable email domains like tempmail.com or 10minutemail.com are widely used in fake signups. DNS checks don’t detect them, letting spam traps and low engagement sneak into your list.

Why manual checks break at scale

Running MX or SMTP checks for 10,000 emails manually takes days, if not weeks. You can’t automate the process without custom code, and even then, greylisting and rate limits will slow you down.
Even if you script it, you won’t catch sender reputation issues. A domain with a history of spamming can still pass DNS checks—yet mailboxes will reject your messages anyway.
Sending to a list full of dormant or trap addresses harms your sender score. Tools like Spamhaus and Return Path show that consistent sends to invalid or low-quality addresses trigger blacklists—even with a clean DNS record.
Real-world deliverability depends on reputation, sender alignment, and inbox placement. A DIY DNS approach gives you no insight into these factors. You can’t test how your email lands in Gmail, Outlook, or Apple Mail without a proper inbox placement tool.

For accurate list hygiene, you need more than DNS: you need inbox presence verification, real-time risk signals, and sender reputation assessment. Tools like bulk email validation or the real-time API handle these complexities at scale. They check syntax, role accounts, disposable domains, and real inbox response—all without you writing a single query.

Deliverability isn’t about sending more. It’s about sending cleanly.

What real email verification services do that DNS doesn’t

Public DNS checks only confirm if an email domain exists and has mail servers — they can’t tell if an address is real, active, or safe to send to. Real email verification services go beyond DNS by testing actual delivery via SMTP, detecting role accounts and disposable domains, flagging risky addresses using reputation data, and simulating sends to avoid catch-all traps — all at scale with bulk processing and integrations.

SMTP verification: the real test of deliverability

DNS only checks if a domain has an MX record. It doesn’t know whether an individual address can receive mail. Real email validators use SMTP connections to talk directly to the receiving server and verify if a specific email address is accepted during a send attempt. This is the closest thing to a real-world test — much more reliable than just checking if the domain exists.

For example, you might have a valid @example.com address in DNS, but if it’s a disabled or blocked account, SMTP will reject the message. Services like EmailListChecker’s bulk verification use this method to catch silent failures long before you send.

Beyond syntax: catching the hidden red flags

DNS can’t detect if an email is a role account like admin@ or sales@ — these are high-risk for spam complaints and low engagement. It also can’t spot disposable emails (like temp-mail services) or malformed syntax that breaks deliverability. Real verification tools use databases and real-time signals to tag these addresses as likely invalid or risky.

They also prevent you from wasting sends on catch-all domains — servers that accept all incoming emails regardless of the local part. These cause high bounce rates and hurt sender reputation. By simulating a send, verified services distinguish between real addresses and those that just accept anything.

These checks require persistent data, historical patterns, and real-time feedback loops — something no public DNS lookup can provide. The result is a far more accurate, deliverable list. Services like EmailListChecker’s API do this at scale, integrate with tools like Mailchimp, HubSpot, and SendGrid, and keep your data private without relying on third-party services.

How Emaillistchecker.io handles verification beyond DNS

You can’t trust DNS alone to confirm an email is truly deliverable. Emaillistchecker.io goes beyond DNS by combining real-time SMTP validation with behavioral patterns, known domain databases, and inbox placement testing. This means we don’t just check if an address format is valid—we confirm it can actually receive messages, even if it’s a role account, disposable inbox, or part of a catch-all system. The result? A reliable verdict for every email, not just a technical “yes” or “no.”

Real SMTP checks confirm inbox reachability

Many tools stop at DNS. We go further. After validating the domain and format, we simulate a real SMTP session with the receiving mail server. This is how we confirm the mailbox is active and accepting mail. This process detects issues like greylisting, temporary failures, or hard bounces that DNS alone can’t reveal. It’s the difference between knowing an address is syntactically correct and knowing it will actually receive your message.

Patterns and databases spot problem domains

We identify high-risk emails using known indicators: role accounts like admin@, sales@, or abuse@ are often non-personal and not reliably monitored. Disposable domains (like mailinator.com) are flagged using a maintained list of known temporary providers. Catch-all domains—those that accept any email—can inflate list size but lower engagement. Our system detects these using behavioral signals and public domain patterns. You get a clear “catch-all” or “risky” label, not a false green light.

Every verification result includes a precise verdict: valid (likely to receive), invalid (undeliverable, format or domain issue), catch-all (accepts all emails), risky (role account, disposable, or reputation-flagged). These labels are based on real-world testing, not guesswork.

Whether you're cleaning a 10,000-email list or integrating verification into your onboarding flow, we support bulk uploads via bulk verification, real-time checks with our API, or direct sync with Mailchimp, HubSpot, Klaviyo, or SendGrid through our integrations. Our 98.9% accuracy is grounded in actual inbox placement data, sender reputation tracking, and feedback from actual delivery trials—a standard you can’t get from passive DNS-only checks.

For deeper insight, we offer inbox placement testing via inbox placement to see how your messages fare across providers like Gmail, Outlook, and Apple Mail.

For detailed technical background, see the SMTP specification and RFC 5322, which define how email delivery is validated at the protocol level.

Can you trust a DIY DNS validator to keep your list clean?

You can’t. A DIY DNS check only tells you if a domain exists—nothing more. It won’t catch typos, disposable emails, role accounts, or invalid addresses. Relying on it alone means you’ll send to hard bounces, hit spam traps, and risk your sender reputation. It’s a shallow first filter, not a real verification solution.

What DIY DNS validation actually does

Checks if a domain has an MX record—confirming it’s set up to receive mail.
Does not verify whether a specific email address exists on that domain.
Cannot detect common typos like [email protected] or [email protected].
Misses role-based addresses like admin@, sales@, or info@ that are often unused or monitored.
Has no way to detect disposable email domains like tempmail.org or guerrillamail.com.
Cannot assess if an address is a spam trap—often silently harvested and monitored by abuse teams.

Why relying on DIY DNS is risky

Hard bounces from invalid addresses degrade your sender reputation. ISPs track these patterns.
Spam traps, even if unintentional, can get you blacklisted. One hit can affect all future sends.
High bounce rates signal poor list hygiene, which reduces inbox placement—even for valid emails.
According to Spamhaus, spam traps can be triggered by just one send, even to a dormant address.
Mail providers use reputation metrics (like Feedback Loops and engagement rates) to decide if your emails reach the inbox.
Even if your list looks clean on paper, a DIY validator won’t catch the real threats.

Let’s be clear: DNS checks are a low-effort step, but they’re not protection. You need more—real validation that checks address syntax, domain health, and inbox placement indicators.

For reliable, scalable list hygiene, you need a tool that goes beyond DNS. Bulk verification checks millions of addresses with 98.9% accuracy, flags risky emails, and helps you avoid bounces and blacklist risks.

Bottom line: DNS checks are a start, not a substitute for real verification

DNS checks confirm a domain exists and accepts mail — but they don’t confirm if a specific email address is valid or active.

They miss syntax errors, temporary bounces, role accounts, disposable domains, and reputation signals that impact deliverability.

What real email verification covers

Tests syntax and format correctness
Validates inbox placement and response patterns
Identifies catch-alls and greylisted domains
Flags disposable and role-based addresses
Assesses sender reputation and blocklist status

For bulk lists, doing this manually or with basic tools leads to high bounce rates and poor inbox placement. Accuracy drops below 80% without proper infrastructure.

Using a tool like Emaillistchecker.io — with 98.9% accuracy and full feature integration — ensures your outreach lands in inboxes, not spam folders.

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I verify an email address just by checking DNS?

Yes, you can check if the domain exists and accepts mail via MX and A records, but this doesn’t confirm if a specific email address is valid or active.

What DNS records do I need to verify an email?

You need A and MX records at minimum. SPF records can support legitimacy checks but aren't required for basic validation.

Does a missing MX record mean an email is invalid?

A missing MX record strongly indicates the domain doesn’t accept mail, so any email at that domain is very likely invalid.

Can DNS validation catch disposable email addresses?

No — disposable domains often have valid DNS, so a DNS check alone won’t detect them.

Why do I still get bounces after DNS validation?

Because DNS checks only confirm domain existence, not individual address validity. Role accounts, typos, and catch-all domains still bounce.

How accurate is a DIY email validation method?

It’s only accurate for domain existence — not address validity. It may miss invalid syntax, role accounts, and disposable domains.

Is it safe to use DNS checks for email list cleaning?

It’s safe as a basic filter but insufficient. Relying solely on DNS can leave invalid or risky addresses in your list.

Can I automate DNS-based email validation at scale?

Yes, but it’s limited. Automating DNS checks doesn’t solve catch-all domains, role accounts, or syntax errors at scale.

What’s the difference between a valid and a risky email address?

A valid address is confirmed to exist and accept mail. A risky address may be valid but linked to a poor sender reputation, disposable domain, or high bounce history.

Do email verification services use DNS checks?

Yes — they include DNS checks as part of their process, but add SMTP testing, syntax validation, and reputation scoring for a complete verdict.

How does Emaillistchecker.io improve deliverability?

It removes invalid, role, and disposable email addresses, reducing bounces and improving sender reputation, leading to higher inbox placement.

Can I try email verification without paying?

Yes — Emaillistchecker.io offers 100 free verifications to start, with credits that never expire.