Save Email Verification Status in Next.js Prisma

Why saving email verification status after a server action matters

You just ran a server action—user signed up, updated their profile, or triggered a welcome email. But what if the email address you’re now working with isn’t actually valid? Or worse, it’s a role account like admin@ or a disposable inbox?

Email lists degrade. Even clean data loses validity over time. Without tracking verification status after each server action, you’re blindly sending to addresses that bounce, get flagged as spam, or never reach the inbox. That’s wasted bandwidth, damaged sender reputation, and poor user experience.

Next.js Prisma save email verification status after server action isn’t just a technical step—it’s a safeguard. It ensures every future operation respects the current validity of the address, reducing bounces, avoiding spam traps, and preserving deliverability.

Key takeaways

Saving verification status after a server action prevents sending to invalid, role-based, or disposable emails.
Unverified or outdated email data increases bounce rates and harms sender reputation over time.
Storing status in your Prisma database ensures consistent validation across future server actions and email campaigns.

What’s required to save verification status in Next.js with Prisma

You need a verified email from a trusted source like an email verification API, a Prisma schema with a dedicated field for verification status, and a server-side function that updates this field after user creation or update. It’s not enough to store the email—its validity must be confirmed and persisted programmatically.

Core Requirements

Use a reliable email verification API—like EmailListChecker’s API—to confirm an email’s deliverability and syntax before saving it. This prevents invalid entries from entering your database.
Modify your Prisma schema to include a verified boolean field (e.g., verified Boolean @default(false)) to track confirmation status at the data layer.
Create a server-side action (e.g., in a Next.js API route or server component) that runs after user creation or update, calling the verification API and updating the verified field in the database accordingly.
Handle asynchronous responses: the verification API may take 100–500ms. Use async/await and proper error handling to avoid blocking the main thread.
Store the verification timestamp (e.g., verifiedAt DateTime?) for auditing and compliance—this matches industry standards for email consent tracking.
Ensure your server function is idempotent: if the same email is submitted twice, don’t retry verification unless verification status changed.

Best Practices for Integration

Never trust the client-side validation. Even if a form checks for @ symbols, an email might still be undeliverable. Validation must happen server-side with real checks.
Consider using a queue (like Redis or a database job table) for high-volume verification, especially if you're processing bulk lists. RFC 9204 discusses best practices for email validation at scale.
Use environment variables to store API keys and avoid hardcoding them in your source.
Log verification results: record whether an email was valid, invalid, disposable, or caught by a catch-all domain for future analysis.
Run periodic audits on your user base—use bulk verification to clean outdated or invalid entries without manual effort.

How to model verification status in your Prisma schema

You should define a verificationStatus enum in your Prisma schema with values like pending, valid, invalid, catch-all, and risky. This field must be nullable at creation—let initial user input not determine final status—and updated after a server-side verification action using an external service like the EmailListChecker.io API. This approach ensures accurate, auditable status tracking and reduces delivery failures from invalid or misclassified addresses.

Use enums to codify verification outcomes

Let’s model the status using a Prisma enum. This forces consistency across your codebase and prevents ambiguous state values like strings such as "verified" or "not valid." The enum provides a clear contract: only pre-approved statuses are allowed. This reduces bugs and simplifies queries—no more pattern matching on arbitrary strings.

For example, enum VerificationStatus { pending valid invalid catch-all risky } covers common email validation results. This aligns with standard practices used by email verification tools, including those that assess deliverability, bounce risk, or mailbox existence—such as the ones defined in RFC 5321 for SMTP response codes.

Separate input from outcome

Never trust user-provided email status. A user might claim their email is valid, but only a server action confirms it. That’s why the field should start as nullable and default to pending when a new record is created. Only after a verification request—via an API like EmailListChecker.io’s real-time verification API—should the status update.

This is especially important for bulk processes. When you import a list, many addresses may look valid but aren't. Running a validation step afterward—using a tool like EmailListChecker.io’s bulk verification—lets you clean the list at scale and assign accurate statuses without relying on raw user input.

Also, don’t treat catch-all or risky as just "invalid." They signal different behaviors: catch-all domains accept any address, which can mean high spam risk. Risky status may point to a temporary or volatile inbox. Tracking these nuances helps you decide whether to send, delay, or suppress messages.

This layered modeling ensures your system reacts intelligently. It's not just about saying 'this email is good or bad'—it's about knowing why and adjusting actions accordingly. That’s how real deliverability systems work.

How to integrate Emaillistchecker.io’s real-time API in a Next.js server action

You can verify an email’s validity in real time within a Next.js server action by calling Emaillistchecker.io’s API with the email and your API key using fetch, setting a 5-second timeout to prevent blocking, and parsing the response to extract the status, verdict, and any error. Then update your Prisma model with the result directly in the server action without needing client-side logic.

Set up your server action in a route handler or server component. Use the `async` keyword to allow asynchronous operations, and ensure it’s properly exported. This gives you access to the server environment where you can securely call external APIs.
Call Emaillistchecker.io’s API with fetch using your API key in the headers. The endpoint is https://emaillistchecker.io/api. Send a POST request with the email in the body, and include your key for authentication. This ensures only authorized users can access the service.
Set a timeout using AbortController to prevent hanging requests. Wrap the fetch call in an abort signal with a 5-second timeout. This is critical for server actions — unbounded waits can block threads and degrade performance, especially with high volumes.
Parse the response safely using JSON parsing. Extract the status (e.g., "success", "error"), verdict (e.g., "valid", "catch-all", "risky"), and any error message. Check the status first – only proceed if it’s "success" to avoid processing malformed responses.
Update your Prisma model with the verified status. Use prisma.email.update() or similar, passing the email ID and the verdict. This keeps your database in sync with real-time verification results. Consider storing the timestamp as well for auditing.
Handle errors gracefully. If the API returns an error or the request times out, log the event and mark the email as "unknown" or "pending". Never assume success — unreliable results can harm deliverability and sender reputation.

Why timeout and error handling matter

Without a timeout, a server action can hang indefinitely if the verification service responds slowly or fails. According to AWS Lambda documentation, timeout limits are enforced at the platform level, and exceeding them causes termination. A 5-second timeout aligns with industry best practices for external API calls in server actions.

Optional: use with bulk verification

If you're verifying large lists, consider using Emaillistchecker.io’s bulk verification feature instead. It’s built for high-volume validation and avoids rate limiting issues. The real-time API is best for on-demand checks during user sign-ups or form submissions.

Verification accuracy starts with consistent, immediate feedback. The right API call at the right time stops bad emails from ever hitting your system.

Next.js server action to verify and save status after form submission

You can verify an email and save its status after form submission by creating a server action in your Next.js app directory. This action extracts the email, runs a verification function, then updates the user record in Prisma with the result—valid, invalid, or risky—based on the outcome. You return the result to the client for immediate feedback.

Set up a server action in app/api/users/route.ts using the Next.js App Router API route pattern. This file becomes the endpoint for form submissions, allowing you to run server-side logic without exposing it to the client.
Extract the email from the incoming request body. Use await request.json() to parse the data and validate the format before proceeding—this stops malformed input from disrupting your workflow.
Call your verifyEmail() function with the extracted email. This function should query a trusted email verification service, such as the EmailListChecker API, which offers verified results based on SMTP checks, DNS lookup, and pattern recognition.
Based on the response from the verification service, determine the status: valid, invalid, or risky. Use this verdict to set the verificationStatus field in your Prisma update query.
Run the Prisma update operation with prisma.user.update(). Specify the user ID and the new verificationStatus value. This ensures the database is updated in real time after verification occurs.
Return a JSON response with { success: true } if the update succeeded, or { error: 'message' } if something went wrong—like a network failure or a missing user ID. This lets the client know exactly what happened.

How verification affects data integrity

When you verify an email before saving, you reduce invalid records by catching typos, role accounts, and disposable domains early. This aligns with industry standards—RFC 5321 defines the SMTP protocol, which underpins email delivery and validation logic.

Why server actions matter for security

By keeping email verification inside a server action, you ensure sensitive logic stays protected. No client-side code gets exposed, and you avoid issues like race conditions. This also helps with deliverability—verified email lists are less likely to trigger spam filters due to high bounce rates.

For teams managing large lists, consider bulk verification via the EmailListChecker bulk verification tool to audit entire databases before use. This adds another safeguard, especially when onboarding new subscribers.

How to handle different verdicts from the email verification API

After a server-side email verification call, update the user's status based on the API's response: mark valid emails as active, reject invalid ones with a reason, tag catch-all or risky addresses for review, and never auto-approve high-risk results. This keeps your database clean and your deliverability strong.

Valid: Proceed with confidence

If the API returns valid, you’re clear to proceed — confirm the user’s registration, trigger onboarding, or grant access. This means the email address exists, accepts mail, and isn’t a disposable domain. Use it to build trust, send welcome sequences, or update user profiles. The email verification API returns reliable real-time results with high precision when validated against known standards, making this stage safe to automate.

Invalid: Reject and log

When the API says invalid, the email doesn’t exist, is malformed, or has a syntax error. Block the submission immediately, show a helpful message (e.g., “Please check your email address”), and log the status for audit. Common causes include typos, non-existent domains, or closed addresses. According to data from Return Path, invalid addresses contribute to 3–5% of overall delivery failures — catching them early prevents bounces and protects sender reputation.

Catch-all or risky: Flag, don’t auto-allow

If the API returns catch-all or risky, treat the address as high-risk. A catch-all mailbox accepts email for any user, which may mean it’s a spam trap or a disposable address. Avoid auto-approving these. Instead, mark the status as review or risky in your database and trigger manual validation or CAPTCHA verification. These addresses are common in bulk sign-ups and can hurt deliverability if used improperly. Spamhaus monitors known catch-all setups and blacklists domains that abuse them.

Never assume a catch-all email is safe — it’s often a sign of a low-quality or disposable address.

Risky verdicts usually come from domains with poor reputation, known spam behavior, or temporary availability. Use them as signals to delay activation. You might require email confirmation, apply rate limits, or restrict access to non-marketing actions. This balances user experience with long-term list hygiene. For bulk processing, use tools like the bulk verification service to clean entire lists before syncing to Next.js or Prisma.

Why you should not trust client-side verification alone

You’re not safe relying only on client-side checks. A user can bypass them with dev tools, script injection, or tampered forms. Even a valid-looking email may be inactive, rejected by the server, or trapped in a spam filter. Client-side validation doesn’t confirm deliverability — only server-side checks with real SMTP interactions do. For high-reliability workflows, trust the process, not just the input.

Client-side checks are easy to bypass

Any JavaScript-based validation can be disabled or modified via browser dev tools.
Users can craft payloads with valid syntax but invalid or non-responsive domains.
Auto-suggesting or formatting with regex doesn’t prove the mailbox exists.

Client validation misses critical delivery risks

It cannot detect if an email address is blocked by the recipient’s server or caught in greylisting.
A syntactically correct address may belong to a role account (like [email protected]) that rarely receives messages.
Some domains use catch-all policies — they accept all emails but rarely deliver them to inboxes.
Disposable email domains (like tempmail.com) can pass client-side checks but never allow real inbox placement.

Real email verification requires testing the actual delivery path. This is why tools like bulk verification or real-time API checks exist — they simulate a real SMTP conversation, confirming whether an address is both valid and capable of receiving mail. This isn't just theory: email deliverability depends on multiple layers of server behavior, from DNS records to sender reputation, which client-side logic cannot assess.

Per RFC 5321, SMTP is the standard for email transmission. If an email fails at the SMTP level, it never reaches an inbox, regardless of client-side pass rates. The same applies to blacklists, such as those maintained by Spamhaus. A client-side check won’t detect if an address is on a blocklist or if a sender’s IP has poor reputation — both of which kill deliverability.

How to use list hygiene to reduce bounce rates over time

You can reduce bounce rates over time by regularly verifying your email list using a bulk API like Emaillistchecker.io’s. Remove invalid, catch-all, or risky addresses before sending. Use only verified statuses in campaigns, exports, and analytics to maintain clean data and improve sender reputation.

Weekly verification with real-time feedback

Run a bulk verification every week using Emaillistchecker.io’s bulk verification tool to flag outdated or incorrect emails.
Automate this process with the real-time verification API to verify new sign-ups and updates in your Next.js app during server actions.
Check for bounces in your transactional logs and cross-reference those addresses with your verification results to spot recurring issues.
Use the results to update your database: mark invalid, catch-all, or risky addresses as inactive and stop sending to them.

Data integrity in campaigns and analytics

Exclude emails with status invalid, catch-all, or risky from all marketing and transactional sends.
Filter your data exports to include only verified emails—this ensures that your campaign reports reflect actual engagement, not noise from dead or temporary addresses.
Set up automated reports that flag any spike in catch-all or risky emails, which may indicate data quality issues or bot sign-ups.
Track your bounce rate over time—studies show that consistent list hygiene can reduce bounce rates by 20–30% in 6 months, a key factor in maintaining inbox placement with providers like Gmail and Outlook.

A clean list is the foundation of deliverability. According to Return Path data, emails from lists with low bounce rates are 30% more likely to reach the inbox than those with high bounce rates.

Let’s be clear: verifying a list once isn’t enough. You’re not just cleaning up noise—you’re protecting your sender reputation. Each email sent to a dead or temporary address harms your deliverability score, especially if it’s flagged by DMARC or greylisting filters.

Best practices for sending emails after server-side verification

You should only send confirmation or onboarding emails to users whose email status is verified as valid. Never send marketing messages to risky or catch-all emails. Log every verification attempt and status change to meet compliance standards and track data quality over time. This prevents wasted sends, protects sender reputation, and aligns with industry standards for data integrity.

Verification status dictates email eligibility

Send onboarding or confirmation emails only to users with a valid status. This reduces bounce rates and preserves your sender reputation.
Do not send any marketing or promotional content to users marked risky or catch-all. These addresses often indicate poor quality or temporary use, and sending to them increases spam complaints and blacklisting risks.
Use real-time verification via API or bulk checks (like API or bulk verification) to filter out invalid, disposable, or role-based addresses early in the journey.
Consider RFC 5322 guidelines on address format validity, but remember that format correctness alone doesn’t equal deliverability. Status verification is essential.

Log every step for compliance and debug clarity

Log every verification attempt, including the timestamp, input email, and returned status (valid, invalid, risky, etc.).
Store status changes, not just initial results. A user’s email can change status over time (e.g., from catch-all to invalid after a test).
Keep logs for at least 12 months to comply with GDPR, CCPA, and other data protection requirements.
Integrate verification status directly into your user profile state, so downstream systems (like CRM or email service providers) can honor the status without rechecking.
Use the inbox placement tool to simulate how your emails will land in real inboxes, ensuring that even valid emails don’t get quarantined due to poor content or reputation.

Good email hygiene isn’t optional—it’s a prerequisite for consistent inbox placement.

How Emaillistchecker.io helps maintain long-term list hygiene

You can maintain clean, accurate lists over time by verifying emails at scale and syncing results automatically. With 98.9% accuracy, Emaillistchecker.io reduces false positives that waste time and skew analytics. It works with your existing tools—Mailchimp, HubSpot, Klaviyo, SendGrid—so verified status updates in real time. The in-app AI assistant helps diagnose issues or recommend improvements, so you don’t need to guess why a verification failed.

Bulk Verification Keeps Your Data Clean Without Extra Work

Let’s say you’ve accumulated thousands of emails over months. A single invalid address might not matter—but thousands can tank deliverability. Emaillistchecker.io handles bulk verification with precision. You upload a list, and it checks every address against live SMTP responses, catch-all detection, and disposable domain filters. No manual cleanup needed. It flags invalid, risky, or catch-all addresses so you can remove them before sending.

Seamless Integrations Keep Your System in Sync

Verification isn’t useful if your CRM or marketing platform doesn’t know the result. Emaillistchecker.io integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid, so verified status updates across systems automatically. That means your campaigns send only to confirmed addresses. This reduces bounce rates and protects sender reputation—an industry-standard practice backed by data from Return Path and other deliverability providers.

For developers building with Next.js and Prisma, this means you can store verification status in your database after a server action. When a user signs up or edits their email, you can trigger a verification call via the real-time API at api.emaillistchecker.io, then update your Prisma model with the result. No need to retry failed emails or track status manually.

Want to find missing email addresses? Try the email finder for leads or recovery campaigns. Still unsure what to do with a “risky” email? The in-app AI assistant guides you through possible causes—role accounts, temporary domains, or known spam traps—and suggests next steps.

And yes, you get 100 free verifications to start. Credits never expire, so you can test at your own pace. Long-term list hygiene isn’t about one-time fixes—it’s about consistent validation, syncing, and learning. Emaillistchecker.io handles the mechanics so you don’t have to.

Conclusion: Verify early, save status, act with confidence

Verifying email addresses before or immediately after a server action ensures your database contains only valid, deliverable addresses. This reduces failures at the moment of send and prevents downstream issues from invalid or dormant contacts.

Using Prisma to store verification status—powered by real-time checks from a trusted source like Emaillistchecker.io—creates a reliable, scalable layer between user input and campaign execution. No more guessing. No more wasted sends.

Over time, consistently verified data lowers bounce rates, preserves sender reputation, and increases inbox placement. It’s a foundational step for any application that relies on email engagement.

Sources

Gmail classifies anyone sending close to 5,000 or more messages to personal Gmail accounts in 24 hours as a bulk sender — and that status is permanent once triggered. — Google Email Sender Guidelines FAQ (2024)
Only 39.3% of email senders said they were fully aware of Gmail and Yahoo's bulk sender requirements, and 23% reported real deliverability problems after enforcement began. — Mailgun State of Email Deliverability (2024)

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I verify an email without a server action?

Yes, but it only validates syntax and basic patterns. For real deliverability, use an API after a server-side request.

What happens if I skip email verification in Next.js?

Your app risks sending to non-existent or disposable emails, increasing bounce rates and harming sender reputation.

Does Emaillistchecker.io support bulk verification via API?

Yes — you can send up to 1,000 emails per request. Each verification costs one credit, and credits never expire.

How do I store the verification status in Prisma?

Add a `verificationStatus` field to your model using an enum type and update it after a server-side verification call.

What does 'catch-all' mean in email verification?

It means the domain accepts all incoming emails, even if the address doesn't exist. This is a high-risk status.

Can Prisma enums handle non-standard values like 'risky'?

Yes — you can define a custom enum with values including 'risky', 'catch-all', or 'invalid' in your schema.

How often should I re-verify user emails?

Re-verify quarterly or after major list updates to maintain hygiene and prevent decay.

Is Emaillistchecker.io free to use?

Yes — you get 100 free verifications to start. After that, credits are purchased but never expire.

Yes — run verification in a non-blocking server action using async/await, and show a loading state.

Does Emaillistchecker.io check disposable domains?

Yes — it detects disposable and temporary email providers and marks them as 'risky' or 'invalid'.

How does Emaillistchecker.io maintain 98.9% accuracy?

Through real-time SMTP checks, MX record validation, and a database of known disposable domains and role accounts.

Do I need to store the API key in .env files?

Yes — always keep your API key in environment variables, never hardcode it in your source files.