Email Validator for Agents (MX, Disposable, Typo, Risk Score v2)

$0.79 per 1,000 emails ($0.00079 per email). Error rows are free. Optional mailbox check with your own MillionVerifier key: +$0.19 per 1,000 checked emails ($0.00019 each), charged only when MillionVerifier returns a real result. You pay MillionVerifier for its credits directly.

Example: 5,000 signup emails cost 5,000 × $0.00079 = $3.95, plus Apify's $0.00005 Actor-start fee.

This Fairquery Apify Actor validates email addresses without sending any email and without SMTP probing. It checks syntax, DNS/MX, null MX, disposable domains (9,800+ bundled), role accounts, free providers, typos ("gamil.com" → "gmail.com"), the mail provider and SPF/DMARC. Each address gets a valid / risky / invalid / unknown verdict with machine-readable reason codes, plus a 0–100 Risk Score v2.

What's new in v2 (Risk Score v2)

All v1 fields are unchanged. v2 only adds fields:

• risk_score (0–100, higher = riskier), risk_level (low / medium / high) and risk_reasons

• mx_provider_class: consumer_webmail, business_suite, security_gateway, hosting_or_forwarding, disposable_service, self_hosted_or_unrecognised or none. mail_provider_id gives the provider (google, microsoft, yahoo, proofpoint, …).

• catch_all_likelihood: low / medium / high / unknown. This is an estimate from the mail provider type, not a measurement (catch_all_basis: "estimate_from_mx_provider"). See the table below.

• domain_age_days and domain_registered_at from RDAP. Domains under 30 days old get NEW_DOMAIN. If the age is unknown, these fields are null.

• disposable_infrastructure: the domain's MX host is shared with known disposable-inbox services. This flags new throwaway domains that are not on the list yet.

• mailbox_verified: always false unless the optional BYOK MillionVerifier check ran with a live key and returned ok or invalid.

Related MCP server: inboxvalid-mcp

When to use this Actor (LLM / tool selection)

Use it when an agent needs to:

• Pre-filter a lead / CRM / signup list before outreach, import or paid verification

• Decide whether an address can receive mail (domain exists, has MX, no null MX)

• Flag disposable inboxes (including new ones on disposable infrastructure), brand-new domains, role addresses and free webmail

• Suggest a fix for a mistyped domain

• See the mail provider, its type, and the DMARC policy

On its own it does not confirm that a specific mailbox exists. That needs an SMTP conversation, and this Actor does none (see the FAQ). If you need mailbox-level results, add your own MillionVerifier key (optional). valid means "well-formed, the domain can receive mail, no risk flags". It does not mean "mailbox confirmed".

How it works

Catch-all estimate (prior, not measured)

Risk score v2 (additive, capped 0–100)

risk_level: low < 25 ≤ medium < 60 ≤ high. Treat this score as a pre-send filter, not as proof of deliverability. The verdict and reasons fields work exactly as in v1. The new signals only change them when the BYOK check runs: an invalid result from MillionVerifier makes the verdict invalid, and catch_all or disposable make it risky.

Input

{ "emails": ["jane@acme.com", "info@apify.com", "bob@gamil.com"], "allowFreeProviders": false }

Output

Every row has schema_version (1.1.0; v1 rows were 1.0.0, and v2 only adds fields), type (email | error), source_url (the DoH MX query URL) and checked_at.

Real row from beta run TzHumKQWvIqfKfdRm (2026-10-17):

{
  "type": "email", "input": "someone@yahoo.com", "email": "someone@yahoo.com", "domain": "yahoo.com",
  "verdict": "valid", "reasons": ["FREE_PROVIDER"],
  "syntax_valid": true, "is_disposable": false, "is_role_account": false, "is_free_provider": true,
  "did_you_mean": null, "domain_exists": true, "has_mx": true, "null_mx": false, "implicit_mx": false,
  "mx_records": [{ "priority": 1, "exchange": "mta5.am0.yahoodns.net" }, …], "mail_provider": "Yahoo",
  "has_spf": true, "has_dmarc": true, "dmarc_policy": "reject",
  "risk_score": 15, "risk_level": "low", "risk_reasons": ["CATCH_ALL_LIKELY_ESTIMATE"], "risk_score_version": 2,
  "mail_provider_id": "yahoo", "mx_provider_class": "consumer_webmail",
  "catch_all_likelihood": "high", "catch_all_basis": "estimate_from_mx_provider",
  "domain_registered_at": "1995-01-18T05:00:00.000Z", "domain_age_days": 11595,
  "domain_age_source": "https://rdap.verisign.com/com/v1/domain/yahoo.com",
  "disposable_infrastructure": false, "disposable_infrastructure_mx": null,
  "mailbox_verified": false, "mailbox_check": "not_requested", "mailbox_status": null,
  "mailbox_provider": null, "mailbox_raw": null, "mailbox_error": null
}

v1 reason codes (reasons) are unchanged: INVALID_SYNTAX, DOMAIN_NOT_FOUND, NULL_MX and NO_MAIL_SERVER (→ invalid); DISPOSABLE_DOMAIN, ROLE_ACCOUNT, FREE_PROVIDER, POSSIBLE_TYPO and IMPLICIT_MX_ONLY (→ risky, depending on the allow* flags); DNS_NOT_CHECKED (→ unknown). With BYOK there are also MAILBOX_UNDELIVERABLE, MAILBOX_CATCH_ALL and MAILBOX_DISPOSABLE.

mailbox_check is one of not_requested, checked, skipped_invalid, skipped_disposable, skipped_limit or error. mailbox_status is one of deliverable, undeliverable, catch_all, disposable or unknown, mapped 1:1 from MillionVerifier's result field (ok, invalid, catch_all, disposable, unknown). mailbox_raw keeps result, resultcode, subresult, quality and livemode. It never contains your key.

Error rows (machine-readable, never charged)

{ "type": "error", "code": "DNS_LOOKUP_FAILED", "message": "DoH MX acme.com -> HTTP 503", "retryable": true, "input": "jane@acme.com", "domain": "acme.com" }

Codes: INPUT_EMPTY, INPUT_TOO_LARGE, MAX_EMAILS_EXCEEDED, DNS_LOOKUP_FAILED, MAILBOX_KEY_INVALID_FORMAT and MAILBOX_CHECK_STOPPED (for example a wrong key or no credits left). Duplicate addresses (case-insensitive) are skipped and counted in the summary.

Run summary

The key-value store record RUN_SUMMARY has: emails checked, duplicates skipped, verdict counts, domains checked, DNS and RDAP request counts, RDAP cache hits, mailbox checks attempted, billable and failed, charged events, and the echoed input. The API key is never echoed; the summary shows only mailboxCheckEnabled: true/false.

Pricing

These are never charged:

• error rows

• skipped duplicates

• rows skipped before the mailbox check (already invalid, disposable, or over mailboxCheckMaxPerRun)

• MillionVerifier unknown / unverified results

• vendor errors, timeouts and rate limits

• demo keys (API_KEY_FOR_*, livemode: false)

Malformed addresses still get an invalid verdict row, and that row is charged like any other check.

Worked examples

• 5,000 addresses with 200 duplicates and 30 DNS failures: 4,770 × $0.00079 = $3.77, plus $0.00005.

• 5,000 addresses with BYOK, where 3,600 survivors get a real MillionVerifier result: 5,000 × $0.00079 + 3,600 × $0.00019 = $3.95 + $0.68 = $4.63, plus your MillionVerifier credits.

To cap spend, set a maximum cost per run in the run options; the Actor stops cleanly at the limit and does not start mailbox checks it could not charge for. maxEmails and mailboxCheckMaxPerRun cap each run.

Price comparison (Apify Store, checked 2026-10-17)

Prices are per email, read from each Actor's pricing through the Apify API (GET /v2/acts/{id}) on 2026-10-17. Tier prices depend on your Apify plan. Those Actors verify mailboxes over SMTP via their own off-Apify backends; this Actor does not. The comparison is meant for pre-filtering, not as a claim of equal accuracy.

"–" means the tier was not read for this table. We are not the cheapest mailbox verifier on higher Apify tiers, and we do not claim to be. The positioning is: a $0.79 per 1,000 pre-send risk score; send only the survivors to a mailbox verifier.

Optional mailbox check: bring your own MillionVerifier key

• How: put your key from https://app.millionverifier.com/api into millionVerifierApiKey. Only rows that are not already invalid or disposable are sent, which saves your credits. A free pre-flight call to MillionVerifier's credits endpoint stops the phase at once if the key is wrong or the account has no credits.

• API used: MillionVerifier Single API v3, GET https://api.millionverifier.com/api/v3/?api=…&email=…&timeout=10 (API docs, OpenAPI 3.1.0, checked 2026-10-17). We use a 15 s request timeout, at most 10 parallel requests and 2 per recipient domain, back-off and retry on HTTP 429/503, and the hard mailboxCheckMaxPerRun cap. Timeouts are not retried, because the vendor may already have used a credit.

• Vendor limits and billing (from MillionVerifier's help center, checked 2026-10-17):

  • The Single API is limited to 160 requests per second per account.

  • MillionVerifier does not deduct credits for risky (unknown, catch_all) results.

  • It does deduct credits again if the same address is verified again.

  • Credits used appear in your account in one-minute batches.

  • Source: Real-Time API.

  • Within one run, each address is checked once (duplicates are removed first). Nothing is cached across runs.

• Terms (checked 2026-10-17):

  • MillionVerifier explicitly allows integrating its API into other products and reselling it (Resellers; the API docs say "You may also use our API to resell our services").

  • Its Terms of Service (published 20 July 2026) treat use through your API key or an integration as your use. You must protect your key and use the data lawfully.

  • The service is for business use only.

  • With BYOK you use your own account, so nothing is resold.

• Your key:

  • It is a secret input, encrypted by Apify.

  • The Actor never logs it.

  • It is never written to the dataset, the key-value store or RUN_SUMMARY.

  • Error messages contain only our own codes, never the key.

• Privacy: with BYOK, the email addresses you submit are sent to MillionVerifier, which acts as your processor under its DPA. Without a key, no full address leaves the Actor.

• Demo keys: MillionVerifier's documented test keys (for example API_KEY_FOR_OK) return fake results with livemode: false. They never change the verdict, never set mailbox_verified, and are never charged.

• "Deliverable" does not mean inbox placement.

Memory / runtime

Default 128 MB. No browser and no proxy. About 1,000 emails across a few hundred domains usually finish in about a minute. The first run on new domains is slower because of RDAP lookups; later runs reuse the 30-day cache.

MCP / Apify tools

Call from agents via Apify MCP (https://mcp.apify.com, authenticated with your Apify token), Actor fairquery/email-validator-mx-disposable:

{ "actor": "fairquery/email-validator-mx-disposable", "input": { "emails": ["jane@acme.com"] } }

Read dataset items (type == "email") and the RUN_SUMMARY record. A standalone stdio MCP server lives in the GitHub repo under mcp/.

Local stdio MCP server

This repo ships a stdio MCP server (TypeScript, @modelcontextprotocol/sdk) under mcp/ exposing validate_emails (runs this Actor through the Apify API) and the free offline check_email_syntax. initialize and tools/list work without a token; tool calls require APIFY_TOKEN (billed per the Store pricing).

cd mcp && npm install && npm run build
node scripts/smoke-test.mjs                          # initialize + tools/list, no token
APIFY_TOKEN=... node scripts/smoke-test.mjs --call   # real tool call

{ "mcpServers": { "fairquery-email": { "command": "node", "args": ["/path/to/email-validator-mx-disposable/mcp/dist/index.js"], "env": { "APIFY_TOKEN": "<your Apify token>" } } } }

Docker: docker build -t fairquery-email-mcp . (the repo-root Dockerfile builds this MCP server and is what Glama uses; the Apify Actor image is built from .actor/Dockerfile). glama.json lists fairquery as maintainer.

Works well after

• Google Maps Scraper, Contact Details Scraper or Website Contact & Company Enricher: pass the emails they find into emails to drop dead domains, disposable inboxes and typos before outreach.

• Before a CRM import or a newsletter send: run your export through this Actor and drop invalid rows. Review the risky rows by hand.

• Then screen the people or companies with the Sanctions & Watchlist Screener if you onboard customers or suppliers.

Troubleshooting

FAQ

Why no SMTP probing?

Three reasons.

1. It is not possible from Apify. We tested it on 2026-10-17 with a private, throwaway test Actor (run OYO4B7Rqdl3lGAtJv, 128 MB, 33 s):

   • TCP port 25 to Gmail, Outlook and Yahoo MX hosts timed out. Ports 587 and 465 timed out too.

   • Port 443 connected in 4 ms.

   • Apify Proxy refused CONNECT host:25 on both the datacenter group (590 UPSTREAM502) and the residential group (590 UPSTREAM453).

   • The egress IP was in AWS address space, and AWS blocks outbound port 25 by default.

   • The probe only opened TCP connections and sent QUIT. It never sent RCPT TO, and it has since been deleted.

2. The workarounds have real costs. You would need your own relay host or a rotating "SMTP proxy" pool, and that creates IP-reputation and blocklist risk. Spamhaus describes unsolicited probing as potentially hostile.

3. Even with port 25 open, many answers carry little information. Catch-all domains accept every recipient, Yahoo accepts every recipient at RCPT time, Microsoft's answers vary, and greylisting delays answers.

Mailbox-level verifiers on Apify generally run the SMTP step outside Apify. If you need that step, use the optional MillionVerifier BYOK check: the SMTP work happens on MillionVerifier's infrastructure, under your account.

Does it send email or connect to mail servers?

No. It uses DNS-over-HTTPS (MX, A/AAAA, TXT), RDAP (registry web APIs) and bundled lists. There is no SMTP handshake, and nothing is sent to the address. With BYOK, MillionVerifier does its own checks on its infrastructure.

Does valid or a low risk_score mean the mailbox exists?

No. mailbox_verified is false unless the BYOK check returned a live ok or invalid result.

Is catch_all_likelihood measured?

No. It is an estimate from the mail provider type (see the table above). Only the BYOK result catch_all comes from an actual check, done by MillionVerifier.

How much does a run cost?

$0.00079 per email row with a verdict, plus a $0.00005 start fee. 1,000 emails ≈ $0.79. BYOK adds $0.00019 per real MillionVerifier result. Error rows and skipped duplicates are free.

How do I limit spend?

Set a maximum cost per run in the run options, and/or lower maxEmails and mailboxCheckMaxPerRun.

Can an AI agent call it?

Yes. Use Apify MCP with Actor fairquery/email-validator-mx-disposable, or the Fairquery MCP server (npx -y @fairquery/agent-trust-mcp). The server's free email_check_syntax tool runs locally; its email_validate_deliverability tool calls this Actor.

Is my list stored?

Results are written only to your run's dataset and RUN_SUMMARY in your Apify account. Two things are sent elsewhere:

• Domain names (not full addresses) go to the Cloudflare DNS-over-HTTPS resolver and to the registry RDAP servers.

• If cacheDomainAge is on, registration dates for domains (no email addresses) are kept for 30 days in the fairquery-email-rdap-cache store in your account.

Full addresses leave the Actor only when you add a MillionVerifier key.

Fairquery family

Other Fairquery tools on the Apify Store. Each one returns structured rows with machine-readable error codes, and error rows are never charged:

• Website Contact & Company Enricher: domain in, public business emails, phones, socials and company details out; $3 per 1,000 domains

• Website Tech, SEO & llms.txt Check for Agents: tech stack, SEO score, AI-crawler rules and llms.txt per site; $1.50 per 1,000 sites

• Sanctions & Watchlist Screener (OFAC, EU, UK, UN): fuzzy name screening against official sanctions lists; $3 per 1,000 names + $0.007 per run

• LLM Data Guard: PII & Secret Redactor: redact PII and secrets before text reaches an LLM; $1.50 per 1,000 documents + $0.20 per 1,000 findings

• Dependency Vulnerability Check for Agents: packages and lockfiles against OSV.dev; $0.50 per 1,000 packages + $1.50 per 1,000 vulnerabilities

• EDGAR Company Facts & Filings for Agents: SEC filings and XBRL facts by ticker, CIK or name; from $1.50 per 1,000 companies

• Company Jobs Feed: Greenhouse, Lever & Ashby: live jobs from employers' own ATS boards with age and repost signals; $0.99 per 1,000 jobs + $0.0005 per board

• MCP server @fairquery/agent-trust-mcp: one MCP server for Claude Desktop, Cursor and VS Code (npx -y @fairquery/agent-trust-mcp). It has 7 free tools that need no token, plus paid tools that call the PII, email, sanctions and OSV Actors with your own Apify token.

All Fairquery Actors: https://apify.com/fairquery

Kits & templates

Optional guides from Fairquery for wiring this Actor into agents and automations (the Actor works fine without them):

• AI Agent Data Toolkit Quick-Start (PDF): MCP setup for Claude Desktop and Cursor, API calls, recipes, cost estimates.

• n8n + Zapier Workflow Template Pack: 10 importable n8n workflows for the four Fairquery Actors, plus Zapier setup guides.

• Agent Prompt Pack for Research & Lead Ops: 69 prompts for company research, lead cleaning, SEO and security reviews.

• Agent Starter Kit: 10 copy-paste MCP + n8n recipes ($5): 10 copy-paste MCP + n8n recipes, with ready-made Claude/Cursor configs and 3 starter workflows.

Disclaimer

DNS- and registry-based validation cannot guarantee that a mailbox exists or accepts mail. Use the results to reduce bounces, not as proof of deliverability. Comply with anti-spam law (CAN-SPAM, GDPR/ePrivacy) when you send email. MillionVerifier is a third-party service under its own terms; Fairquery is not affiliated with it.

Links

• Apify Store: https://apify.com/fairquery/email-validator-mx-disposable

• GitHub: https://github.com/fairquery/email-validator-mx-disposable

• Contact: fairquery@proton.me

• License: MIT

Development

Local development, tests and deployment notes are in DEVELOPMENT.md. The Apify Store README is .actor/README.md.