Email typo detection: catching gmial.com at signup without annoying users

Email typo detection compares the domain someone typed against a list of common mailbox providers and, when it's one or two keystrokes away from one (gmial.com, hotmial.com, yaho.com), suggests the likely intended address. It catches the mistakes that every format check lets through, because jane@gmial.com is a perfectly valid-looking address. Show the suggestion, let the user accept it, and never change the address silently.

Why format checks miss typos

The browser's type="email" field checks shape only. MDN's documentation for the email input says a valid value is a properly formed address, which "doesn't necessarily mean the email address exists". Your server-side regex does the same job a second time. Neither knows that gmial.com isn't where the person gets their mail. (More on that gap in why an email regex is never enough.)

DNS checks help only partly. A domain that doesn't exist fails an MX lookup, so gmail.cmo is caught. But some misspellings of large providers are registered domains with mail servers of their own. An MX check sees a working domain and moves on.

The cost of a missed typo is high for the effort involved: a confirmation email that never arrives, a trial user who thinks your product is broken, and a lead that sales chases with a bounced sequence.

How the suggestion is computed

The usual approach, and the one the open-source mailcheck JavaScript library uses, is string distance:

1. Keep a list of popular mailbox domains (gmail.com, outlook.com, hotmail.com, yahoo.com, icloud.com and so on).
2. If the typed domain is on the list, there's nothing to suggest.
3. Otherwise compute the edit distance to each candidate: insertions, deletions, substitutions, and swaps of adjacent letters (gmial to gmail is one swap).
4. Suggest the closest candidate if it's within a small threshold.

The threshold is the whole game. Too loose and you start "correcting" real company domains. pingutil allows one edit for shorter provider names and two for names of ten characters or more (so hotmial.con still maps to hotmail.com), and skips very short names like me.com and gmx.de entirely, because too many real domains sit one edit away from them.

Using did_you_mean from the verify API

pingutil's /v1/verify returns a did_you_mean field with the full corrected address, or null. It's only a suggestion. It never changes status, and it's always null when the address verified as valid.

const res = await fetch('https://pingutil.com/v1/verify', {
  method: 'POST',
  headers: {
    authorization: `Bearer ${process.env.PINGUTIL_KEY}`,
    'content-type': 'application/json',
  },
  body: JSON.stringify({ email: 'jane@gmial.com' }),
});
const result = await res.json();
// result.did_you_mean -> "jane@gmail.com" when the domain looks like a typo

Call this from your backend, not the browser, so the API key stays private. A small endpoint that your form calls on blur is enough. The React signup form feedback article shows the client side of that pattern.

UI copy that gets typos fixed

The suggestion only helps if people act on it. Patterns that work:

• Ask, with the fix one click away. "Did you mean jane@gmail.com?" where the corrected address is a button that fills the field. Highlight only the part that changed if you can.
• Show it after the field loses focus, not on every keystroke. Half-typed addresses produce noisy suggestions.
• Let them dismiss it. "No, jane@gmial.com is correct" keeps the original. Some people really do use small domains that look like typos.
• Don't block submission on a suggestion. Block on things you know are broken, like invalid syntax or a domain with no mail server.
• Say it once. If they dismiss the suggestion, don't ask again on the next focus.

Copy to avoid: "Invalid email address" for a typo suggestion. It isn't invalid, and the message gives the user no idea what to change.

Why you shouldn't auto-correct silently

Rewriting the address without telling the user feels helpful and goes wrong in exactly the cases you can't see. If the person really owns jane@gmial.com (unlikely, but possible on any small domain), you've just sent their account confirmation to a stranger's inbox. If your typo list has a gap, you might map a real company domain to a provider. And the user doesn't learn their address was changed, so they can't fix it.

A visible suggestion costs one click and keeps the user in charge of their own address.

Where typo checks sit in the full flow

Run the typo suggestion alongside the other cheap checks, before anything that takes time:

1. Syntax.
2. Typo suggestion against popular providers.
3. Disposable domain list.
4. DNS and MX, then the mailbox check.

pingutil runs all of these in one /v1/verify call and returns the result with a status, a reason and the suggestion. See the full field list in the API reference, and try a misspelled address like you@hotmial.com in the verification demo. For what to do with each result once the address is fixed, see email verification statuses explained.