Skip to content
myiphero

01 — Email tool

Email checker

Is this email address legit? Check the format, typos, disposable domains, mail servers, SPF, DMARC and domain age in seconds.

Runs in
Your browser
Sent out
Domain only
Stored
Nothing
Checks
11

Private by design: only the domain (the part after the @) leaves your browser, for DNS and registration lookups. The full address is never sent or stored.

Result

What it means

The verdict adds up every warning we find. Low risk means the address is well formed, its domain receives mail and nothing looks off. Medium risk means something deserves a second look: a probable typo, a domain only a few weeks old, or missing anti-forgery records. High risk means at least one serious problem: the domain does not exist, accepts no mail, belongs to a throwaway inbox service or imitates a well-known brand.

Read the signals rather than the score alone. A two-week-old domain is alarming in a message that claims to be from your bank, and perfectly normal for a start-up you just signed up with. Likewise, a noreply@ address is fine for a shipping notice but odd for someone asking you to reply with your details.

Common red flags

  • Lookalike domains: paypa1.com, rnicrosoft.com or Cyrillic letters that look Latin. We compare a visual “skeleton” of the domain against brands that phishers love.
  • Brand words on a stranger’s domain: apple-id-verify.net is not Apple, however official it sounds.
  • Fresh registrations: scam domains are typically used for days, then abandoned.
  • No mail servers: an address that cannot receive replies is not one you can hold accountable.

How it works

After you press Check, eleven tests run, most of them instantly inside your browser:

  1. Syntax: one @, a mailbox name of up to 64 characters and a valid domain, including international (IDN) domains.
  2. Typos: the domain is compared with popular providers using edit distance, so gmial.com suggests gmail.com and .con suggests .com.
  3. Disposable domains: matched against the open-source disposable-email-domains list (about 9,000 services, public domain), downloaded to your browser as a whole so the lookup stays local.
  4. Free provider vs. own domain and role accounts such as info@, admin@ or noreply@.
  5. Suspicious domains: punycode (xn--), mixed alphabets and lookalikes of major brands.
  6. MX, SPF and DMARC: DNS queries over HTTPS to Cloudflare’s public resolver for the domain only.
  7. Domain age: the registration date from the registry’s RDAP service, fetched through our server, which keeps no logs. Some country registries do not publish it.

We never connect to the recipient’s mail server to probe the mailbox. That technique is unreliable, can get servers blacklisted, and would reveal the full address. If you have a message rather than just an address, theheader analyzer tells you far more about who really sent it.

Frequently asked questions

Can this tool tell me whether a mailbox really exists?

No. The only way to know for sure is to talk to the receiving mail server, and most providers deliberately hide whether an individual mailbox exists to stop spammers from harvesting addresses. We check what can be checked safely: the format, the domain, its mail servers and its reputation signals. A “low risk” result means the address can receive mail, not that a specific person reads it.

Is it safe to paste an email address here?

Yes. The address is analysed by JavaScript in your own browser. Only the domain (the part after the @) is sent out: to Cloudflare’s public DNS resolver for the MX, SPF and DMARC lookups, and to our server for the registration date, which we do not log. The part before the @ never leaves your device.

How do I know if an email is legit or a scam?

Look at the domain first. Scam mail often comes from free mailboxes, brand-new domains, throwaway services or lookalikes such as paypa1.com. Then check the message itself: urgency, payment requests, links that point somewhere other than the sender’s site. If the message is already in your inbox, paste its headers into the email header analyzer to see whether SPF, DKIM and DMARC passed.

What is a disposable email address?

A temporary inbox from services like Mailinator or 10 Minute Mail. Anyone who knows the address can often read it, and it disappears within minutes or hours. People use them to dodge sign-up forms; shops and communities block them because they are popular for fake accounts and abuse.

Why is an address from my own company marked medium risk?

Usually because the domain lacks SPF or DMARC records, or was registered recently. Those are signals about how easy the domain is to impersonate, not accusations. Publishing an SPF record and a DMARC policy (start with p=none, then move to quarantine or reject) fixes most of them.

Does a free provider like Gmail make an address suspicious?

Not on its own. Billions of people use free mailboxes. It only matters when the sender claims to be a company, bank or authority: real organisations write from their own domain, while scammers lean on free accounts because they cost nothing and need no verification.

Can I check addresses in bulk or through an API?

Not at the moment. The checker is built for checking one address at a time by hand. For lists, use a dedicated verification service that has agreements with mail providers.

Related tools

Learn