Build vs buy
Why not vibe-code an email verifier in an evening?
You can. syntax → MX → RCPT TO → 250/550 is about 300 lines
and works on gmail.com on day one. That is also exactly what several $9/month APIs
sell — an MX lookup with no SMTP dialogue. One of them rated a non-existent
mailbox on a domain we control as valid, confidence 100%.
The code is 5% of the product. The other 95% is earned, not written:
- IP reputation. Our server never sent a single email and still landed in
Spamhaus CSS — for the probe itself, because HELO didn't match PTR. iCloud
answered
550 rejected due to listing. Probe from your sending domain and you burn the domain your outreach runs on. - Mail identity. Forward-confirmed PTR ↔ HELO ↔ A, SPF, an MX for
MAIL FROM, and aprobe@route that accepts-then-drops so sender callouts see 250. Without it half your answers are greylisted "try later". - Providers drift silently. Microsoft changed behaviour under us; we found out from a wrong verdict. A weekly atlas now probes the big providers with fresh canaries and alerts on drift. A one-off script lies for years and nobody notices.
- Measurements nobody published. A noticeable share of addresses sits behind accept-everything servers, and role addresses at large companies are mostly catch-all. A script that can't tell reports "valid" exactly where a bounce is most expensive.
- Proof it isn't lying today. A sentinel checks the live service every morning against mailboxes whose truth we control, and alerts on the first contradiction. "Worked when I wrote it" ≠ "works today, and I'll know when it stops".
- Hostile input and quotas. CRLF can't reach SMTP, length is cut before any regex, probes are queued per domain, new domains are rate-limited — so one 50k list doesn't turn the IP into a snowshoe pattern.
- Port 25. Most clouds block it outbound. You need a separate host, a clean IP, a separate domain — and all of it warmed.
What you actually pay for
An engineer-hour is $50–100. Self-hosting a verifier isn't an evening;
it's on-call: delistings, provider drift, list updates, port 25. For a monthly
subscription you're not buying code — you're buying that someone else wakes
up to the alert, and that mailbox_verified: true is only ever said
with a live SMTP proof behind it. Verdicts we can't prove come back as
risky or unknown with a machine-readable reason —
an honest gap you can route around, instead of a guess that bounces.
Try the difference yourself
Paste a made-up address on a real domain into the live demo. An MX-only checker calls it valid; we tell you what we actually know.
And if you'd rather build it yourself — genuinely, go ahead: the spec is public and the road is described above. Read it first; the price is visible now.