Skip to content
<pingutil/>

// email verification & domain lookup API

Check any email or domain: disposable, personal, or a real company.

pingutil is an email verification and lookup API. Send it an address like jane@acme.io and it tells you what kind of domain that is and, for companies, who they are. Teams use it to keep throwaway accounts out of signups, separate work emails from Gmail, and route leads.

Verify an emailTry a domain lookupRead the docs
  • Mailbox-level email verification: valid, invalid, risky or unknown
  • About 9,900 disposable domains, re-synced every Monday
  • Plugs into your CRM, outbound tools, signup flow and email platform
  • Company profiles for any business domain, cached at the edge
RequestPOST /v1/lookup
curl https://pingutil.com/v1/lookup \
  -H "Authorization: Bearer $PINGUTIL_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input":"x7kq2m9z@mailinator.com"}'
Response (trimmed)200 OK
{
  "domain": "mailinator.com",
  "category": "disposable",
  "email_signals": {
    "is_randomized": true,
    "is_role_based": false
  },
  "verdict": {
    "is_spam": true,
    "reason": "disposable_domain"
  }
}

POST /v1/demo/verify

Is this email real?

Checks the format, the domain, its mail server, and asks that server whether the mailbox exists, without sending anything. Most checks take one to five seconds.

try:

Have a list? Open the dashboard to upload a CSV of up to 50 addresses and download the results.

POST /v1/demo/lookup

Try a lookup

No key needed here. The demo allows 6 requests a minute per IP. A new company domain can take a few seconds the first time while its profile is built; once the day's demo budget of new profiles is spent, it answers from cache.

try:

use cases

What people build with it

Most integrations are a few lines around one call to /v1/lookup.

Keep throwaway accounts out of signup

Reject temporary inboxes before they eat a free trial or skew your activation numbers. Gibberish addresses on unlisted domains get caught by the email signals.

if (res.verdict.is_spam) {
  return error('Please use a permanent email address.');
}
Detecting disposable emails →

Send work emails to sales, everyone else to self-serve

A company domain is a different lead than a Gmail address. Branch on the category instead of asking for "company name" in another form field.

const route = res.category === 'company'
  ? 'sales' : 'self_serve';
Business vs personal email →

Fill in the company on new leads

Industry, headquarters, employee range and funding stage come back with the lookup, so your CRM record is useful before anyone opens it.

const { company } = res;
crm.update(lead.id, {
  industry: company?.industry,
  size: company?.employee_size_estimate,
});
Enriching leads from a domain →

Offer the team plan to the right people

When a second person signs up from the same company domain, that is your cue to suggest a shared workspace.

if (res.category === 'company' &&
    await countUsers(res.domain) > 1) {
  suggestTeamPlan(user);
}
Spotting teammates →

category

The seven categories

Every lookup returns exactly one. Lists are checked first (disposable, then free, then ISP), then TLD rules, and anything left over is treated as a company.

CategoryWhat it means
companyAnything that is not on a list or matched by a TLD rule. Gets a company profile.
freePersonal webmail from providers like Google, Microsoft, Yahoo and Proton.
disposableTemporary inboxes. Matched against the community list, re-synced weekly.
ispAddresses bundled with home internet service. Personal, not business.
educationalMatched by TLD: .edu, .edu.<cc>, .ac.<cc>, .sch.<cc>. Subdomains count.
governmentMatched by TLD: .gov, .mil, .gov.<cc>, .gouv.<cc>, .gob.<cc>, .govt.<cc>.
unknownInput that could not be parsed as an email or a registrable domain.

quickstart

Getting started

  1. 1

    Get a key

    Sign in with your email (no password) and create a key on the dashboard. It is shown once, so store it as a secret.

  2. 2

    Call /v1/lookup

    POST an email or a domain as "input". Add skip_enrichment: true when you only need the category and spam verdict.

  3. 3

    Branch on the result

    Block on verdict.is_spam, review low_trust, and use category and company to route the user or lead.

Full API reference
const res = await fetch('https://pingutil.com/v1/lookup', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.PINGUTIL_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ input: 'jane@stripe.com' }),
}).then((r) => r.json());

res.category;           // "company"
res.company?.industry;  // e.g. "Financial Technology"
res.verdict.is_spam;    // false

Python, Go and curl versions are in the quickstart. Prefer clicking around? The API explorer runs requests from your browser.

faq

Questions

What does pingutil do?

You send an email address or a domain. pingutil tells you whether it belongs to a company, a free webmail provider, a disposable (temporary) inbox service, a school, a government body or a consumer ISP. For company domains it also returns a profile: name, industry, headquarters, employee range, funding stage and links.

How do I get access, and what are the limits?

Sign in with your email to get an API key. Pricing is usage-based and designed to stay cost-effective as you grow. Each account gets 60 requests per minute (shared across its keys), 2,000 lookups and 50 new company profiles a day, and 300 email verifications a day. The demo on this page needs no key and allows 6 requests per minute per IP.

How does it detect disposable email addresses?

It checks the domain against the open disposable-email-domains list on GitHub (about 9,900 domains), which we re-sync every Monday. It also scores the part before the @ for machine-generated patterns like "ccjxx90sze", so throwaway accounts on unlisted domains still get flagged.

Where does the company data come from?

pingutil fetches the company's own homepage and has an open AI model (gpt-oss-20b on Cloudflare Workers AI) fill a fixed schema from it. Gemini with Google Search grounding is also supported. The output is validated before it is cached, and every profile carries a confidence score. It is good for routing and segmentation; verify it before you rely on it for anything legal or financial.

How fast is a lookup?

Category checks and email signals are list and rule lookups, so they return in milliseconds. A company profile that is already cached is just as fast. The first lookup for a new company domain calls the AI model and can take several seconds; pass skip_enrichment: true when you only need the category.

Do you store the email addresses I look up?

Domain lookups are cached and logged per domain (for example stripe.com); the part before the @ is only used in memory to compute email signals. Email verification results are cached for 30 days under a keyed SHA-256 hash (HMAC) of the address, never the plain address. CSV uploads in the dashboard keep your rows for 30 days so you can download them again, and you can delete them at any time.

Does pingutil check whether a mailbox exists?

Yes, with POST /v1/verify. It asks the domain’s mail server about the address over SMTP and hangs up before any message is sent, then returns valid, invalid, risky or unknown with a reason. Catch-all servers that accept every address come back as risky rather than valid. You can try it on the email verification page.