Free email validation APIs compared (and what "free" really includes)

The free email validation APIs worth knowing fall into two groups. Verification services (ZeroBounce, Abstract, Hunter, MailboxValidator, Emailable, Kickbox) give you somewhere between 50 and 300 checks, usually per month, and each check includes an SMTP-level mailbox test. Classification APIs such as pingutil skip the mailbox test, which makes them fast enough to call on every signup with no monthly quota, but they can't tell you whether a specific inbox exists.

Which one you want depends on the question you're asking. "Will this email bounce?" needs a verification service. "Is this a throwaway, webmail or company address?" needs classification, and a free tier of 100 credits a month runs out fast if you spend them on that.

The free tiers side by side

Every number below comes from the vendor's own pricing or product page as of 2026. Pricing pages change, so check before you budget.

A few things the table flattens:

• ZeroBounce says its Freemium credits "refill every month", and separately advertises 100 free monthly verifications when you sign up with a business domain. If you sign up with a Gmail address, read the terms on the page you land on.
• Hunter is mainly an email finder. Its 50 monthly credits are shared between finding, domain search and verification. Its pricing page doesn't state plainly whether the free plan includes API access, though the API page offers a free key.
• Emailable describes its 250 credits as what "every new account starts with". The page doesn't call it a monthly allowance, so plan for it being a one-off.
• Kickbox describes its plans as "starting at free for 100 verifications". We couldn't load its per-volume prices from its own site, so they aren't in the table.

What "free" means on each pricing page

Four details decide whether a free tier is useful to you. They're rarely in the headline number.

One-off grant or monthly refill

A one-off grant of 250 credits is a trial. It's enough to test the response format and estimate the share of unknown results on your own data, and not enough to run in production. A monthly refill of 100 to 300 checks can carry a side project or an internal tool indefinitely.

What one check costs

Credits and checks are not always one to one. Hunter charges half a credit per verification. Some vendors also charge differently for bulk list uploads and single API calls. Read the credit cost of the specific endpoint you'll call, not the plan's headline credit count.

Rate limits

A monthly quota and a per-second limit are separate constraints. Abstract's free plan allows 3 requests per second. pingutil has no monthly quota but caps each key at 60 requests per minute. For a signup form either is plenty. For cleaning a 50,000-row CSV, neither is the right tool.

What happens when you run out

This is the one that bites in production. If your signup handler treats a quota error as "invalid email", you'll block every user from the day the credits run out until the day they refill. Whatever you pick, wrap the call so that a 402, 429 or timeout means "unknown, let them in, check later".

Two different products share one name

"Email validation API" covers two different things, and most comparison pages mix them.

Verification services connect to the recipient's mail server and ask whether the mailbox exists. That's what ZeroBounce's mailbox_not_found sub-status and MailboxValidator's is_verified field report. This is slow (often seconds) and inconclusive more often than vendors like to admit: catch-all domains accept everything, and large providers often won't confirm mailboxes to strangers. We cover why in SMTP mailbox verification: why it's unreliable. It's still the best automated signal you have that an address will bounce.

Classification APIs never touch the mail server. They answer what kind of address this is: disposable, webmail, ISP, education, government or company, plus heuristics about the local part. Answers come back in milliseconds and don't consume per-check credits. They can't tell you that jane.doe@gmail.com doesn't exist.

The verification services in the table also return classification flags (disposable, free/webmail, role-based), so in theory one call covers both. The catch is cost: every call burns a credit, even when all you wanted was the disposable flag. For a longer walk through which you need, see email verification services vs domain classification APIs. If you only need the disposable flag, there are also keyless free endpoints and open lists, compared in disposable email checker APIs: open lists vs paid services.

Where paid verification earns its price

Be fair to the paid tools: they do things a classification API can't.

• Bounce protection before a send. If you're about to email a list you bought, imported or haven't mailed in a year, mailbox-level checks are the cheapest way to avoid a bounce spike that hurts your sender reputation.
• Bulk list cleaning. All of the verification vendors above accept CSV uploads and run them asynchronously. pingutil has no bulk endpoint.
• Spam traps and abuse lists. ZeroBounce lists spamtrap and abuse statuses. A domain-level API has no way to know an individual address is a trap.
• Catch-all detection. Knowing a domain accepts every address tells you to treat mailbox results there with suspicion. This needs an SMTP conversation.

If any of those is your actual problem, 100 free checks a month is a way to evaluate a vendor, and you'll end up paying. That's a reasonable outcome.

Where pingutil fits

pingutil is the classification kind. One call returns a category, email_signals (randomized local part, role address, system address) and a verdict you can block on. With skip_enrichment: true there's no LLM call, so it returns in milliseconds:

const res = await fetch('https://pingutil.com/v1/lookup', {
  method: 'POST',
  headers: {
    authorization: `Bearer ${process.env.PINGUTIL_KEY}`,
    'content-type': 'application/json',
  },
  body: JSON.stringify({ input: email, skip_enrichment: true, check_dns: true }),
  signal: AbortSignal.timeout(1500),
});

if (res.ok) {
  const data = await res.json();
  if (data.verdict.is_spam) {
    // disposable domain, reputation-flagged domain, or machine-generated local part
  } else if (data.domain_signals && !data.domain_signals.can_receive_email) {
    // domain has no MX and no A record to fall back to
  }
}
// On 429, timeout or 5xx: accept the signup and re-check later.

The honest limits: no SMTP mailbox check, no bulk endpoint, 60 requests per minute per key, and the disposable list is synced weekly from the community disposable-email-domains repository, so a throwaway domain that appeared in the last few days may not be on it yet. domain_signals comes from DNS only, and treats a domain with a null MX as able to receive mail. You can try addresses in the live demo without a key, and the full response shape is in the API reference.

A five-minute way to choose

1. Write down the question. "Will it bounce?" means verification. "Should this signup get a free trial?" usually means classification.
2. Estimate monthly volume. If it's under a few hundred, a verification free tier may cover it. If it's thousands of signups, don't spend credits on classification you can get free.
3. Check whether the allowance refills. One-off grants are for testing.
4. Run 50 addresses you know the answer for (your team's, a few disposable ones, a few typos) through your top two picks and count the unknown results.
5. Wrap whichever you pick in a timeout and a fail-open path before it goes anywhere near your signup handler.

Many teams end up with both: classification on every signup, and paid verification only before a large send.