Email Validation API vs Regex: What Actually Works

A while ago, a good friend came to me with a problem. He was working for a company that was struggling with email bounces. Their current validation service was letting bad emails slip through, and it was costing them time and money. He asked if I could build something better.

The catch? At that exact moment, I had absolutely zero experience with email validation. I had to start from scratch.

I dove into the research and ended up building a custom validator using PHP and a MariaDB database. Was it perfect? No. But it worked. The company saw an immediate drop in bounces compared to their old setup. The best part was that when something broke or needed tweaking, I could fix it the same day. I wasn't waiting on a third-party support ticket.

But as I dug deeper into the mechanics of email, I realized how incredibly messy this problem actually is. If you are trying to build your own validator, here is what I learned the hard way.

The Regex Trap (And Why It's Not Enough)

Most developers start with a regex. It feels like the logical first step. You write something like this:

import re

def is_valid_email(email):
    pattern = r'^[\w\.-]+@[\w\.-]+\.\w+$'
    return bool(re.match(pattern, email))

# Looks good, right?
print(is_valid_email("user@example.com"))  # True
print(is_valid_email("test@mailinator.com"))  # Also True... but it's garbage

This catches the obvious typos. But it doesn't catch:

• Disposable domains like mailinator.com or tempmail.com — these will pass your regex but bounce later.
• Catch-all servers that accept any address — your regex says "valid" but the email doesn't actually exist.
• Role-based addresses like admin@ or info@ — technically valid, but often ignored by real humans.

So you add a blacklist. Then you realize there are thousands of disposable domains. Then you try to keep the list updated. It's a rabbit hole.

The SMTP Verification Nightmare

"Okay," you think, "I'll just ask the mail server if the address exists." So you write an SMTP handshake script:

import smtplib
import dns.resolver

def smtp_verify(email):
    domain = email.split('@')[1]

    # Get MX record
    records = dns.resolver.resolve(domain, 'MX')
    mx_host = str(records[0].exchange)

    # Try SMTP handshake
    server = smtplib.SMTP(mx_host, timeout=10)
    server.set_debuglevel(0)
    server.helo('your-domain.com')
    server.mail('test@example.com')
    code, message = server.rcpt(email)
    server.quit()

    return code == 250

This works... sometimes. Then you hit the real world:

• Microsoft lies. Outlook, Hotmail, Live — they all accept every address during the SMTP handshake, then bounce it later. Your validator says "valid" but the email doesn't exist.
• Gmail throttles you. They add artificial delays to slow you down. Your verification takes 5–10 seconds per email.
• Yahoo blocks you entirely. No SMTP verification at all.
• Your IP gets blacklisted. Probe too many servers and you look like a spammer. Suddenly your own emails start going to spam folders.

When I was building that first PHP version, dealing with these edge cases was a daily headache. It worked for about 60% of emails. The other 40%? Either false positives or false negatives.

The Redesign (What I Use Now)

Eventually, I realized the PHP script was a band-aid. To really do this right, I needed a structural overhaul. I completely redesigned and rewrote the system in Python. That became the foundation of ParheliaWeb's Email Validation API.

Here is what that looks like now in 5 lines:

import requests

API_KEY = "your_api_key_here"

response = requests.post(
    "https://parheliaweb.com/v1/email/validate",
    headers={"x-api-key": API_KEY},
    json={"email": "user@example.com"}
)

result = response.json()["result"]
print(f"{result['status']} ({result['confidence']}% confident)")

Instead of just true/false, you get a full picture:

{
  "status": "valid",
  "confidence": 90,
  "syntax_valid": true,
  "domain_check": {
    "blacklisted": false,
    "disposable": false
  },
  "mx_valid": true,
  "smtp_check": {
    "result": true,
    "code": 250
  },
  "risk_factors": []
}

The API handles all the messy stuff I mentioned earlier:

• Disposable domain detection — checks against thousands of known temporary email services.
• Catch-all detection — identifies domains that accept any address.
• Microsoft/Gmail/Yahoo handling — transparent about what it can and can't verify.
• IP reputation protection — dedicated verification servers with clean IPs, so yours stays safe.
• Batch validation — validate up to 100 emails at once with connection pooling.

Transparency Over Hype

Is our system perfect? No system is. But we continue improving it every single day.

If you read our Email Validation Docs, you will notice something different: we actually tell you what our system can't do. We are transparent about the limitations (like Microsoft accepting all SMTP probes). But we are also proud of what it can do.

The whole point is transparency. You see the price, and you see exactly what you get for the price you pay. No games, no hidden traps. Just like how it should be.

The Real Cost Comparison

Factor	Build It Yourself	Use an API
Time to first result	2-4 weeks	5 minutes
Disposable domain coverage	None (you maintain it)	Thousands + auto-updated
Catch-all detection	Not possible	Built-in
Microsoft/Gmail handling	Blocked or misleading	Transparent status
IP reputation risk	Your IP gets blacklisted	Handled by provider
Accuracy	~60-70% (in my experience)	Transparent confidence scoring per result
Cost	Your time + infrastructure	Free tier → €39/month (Starter)

My advice is simple: If you're just validating a handful of emails for a personal project, regex gets the job done. But for SaaS products, marketing lists, or any scenario where deliverability matters, let a dedicated API handle the heavy lifting.

Getting Started

Questions?

I'm Andy, the founder. I'm just an IT guy who likes solving problems for people. If you have questions about the data or the API, just drop me a line.

📧 info@parheliaweb.com