DEV Community

mnotr
mnotr

Posted on • Originally published at mxcheck.dev

How to Validate Email Addresses in Node.js (2026 Guide)

#node #javascript #email #webdev

Email validation is one of those problems that looks simple but isn't. A basic regex catches obvious typos, but it won't tell you if the domain has a mail server, if the address is a disposable throwaway, or if the mailbox actually exists.

This guide covers 4 approaches to email validation in Node.js, from basic regex to full API-based verification, with working code for each.

1. Regex Validation (Basic)

The simplest approach. Catches formatting errors but nothing else.

function isValidEmail(email) {
  const regex = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
  return regex.test(email) && email.length <= 254;
}

console.log(isValidEmail("user@gmail.com"));     // true
console.log(isValidEmail("not-an-email"));        // false
console.log(isValidEmail("user@.com"));           // false
Enter fullscreen mode Exit fullscreen mode

Pros: Fast, no dependencies, no network calls.
Cons: user@fakdomain123.com passes validation. So does user@mailinator.com. You're only checking format, not deliverability.

2. MX Record Lookup (Medium)

Check if the domain actually has mail servers configured. This catches fake domains that pass regex.

const dns = require('dns').promises;

async function hasMxRecords(domain) {
  try {
    const records = await dns.resolveMx(domain);
    return records && records.length > 0;
  } catch (err) {
    return false;
  }
}

async function validateEmail(email) {
  const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  if (!regex.test(email)) return { valid: false, reason: "Invalid format" };

  const domain = email.split("@")[1];
  const hasMx = await hasMxRecords(domain);

  if (!hasMx) return { valid: false, reason: "Domain has no mail server" };

  return { valid: true };
}

// Usage
const result = await validateEmail("user@fakdomain123.com");
// { valid: false, reason: "Domain has no mail server" }
Enter fullscreen mode Exit fullscreen mode

Pros: Catches fake domains. Uses built-in Node.js dns module (no dependencies).
Cons: Doesn't catch disposable emails, role accounts, or typos. DNS lookups add ~10-50ms latency.

3. Disposable Email Detection (Better)

About 60% of fake signups use disposable email services like Mailinator, Guerrilla Mail, or 10MinuteMail. You need a blocklist.

const disposableDomains = new Set([
  "mailinator.com",
  "guerrillamail.com",
  "tempmail.com",
  "throwaway.email",
  "yopmail.com",
  // ... 500+ more domains
]);

function isDisposable(email) {
  const domain = email.split("@")[1].toLowerCase();
  return disposableDomains.has(domain);
}

console.log(isDisposable("user@mailinator.com")); // true
console.log(isDisposable("user@gmail.com"));      // false
Enter fullscreen mode Exit fullscreen mode

Pros: Blocks the majority of throwaway signups.
Cons: You need to maintain the list yourself. New disposable services appear constantly.

4. API-Based Validation (Best)

An API handles all checks in one call: syntax, MX records, disposable detection, typo suggestions, and more.

import mxcheck from "mxcheck";

const result = await mxcheck("admin@mailinator.com");
console.log(result);
// {
//   email: "admin@mailinator.com",
//   valid: true,
//   score: 0.6,
//   checks: {
//     syntax: { valid: true },
//     mx: { valid: true, records: ["mail.mailinator.com"] },
//     disposable: true,
//     role_account: true,
//     free_provider: false
//   },
//   suggestion: null
// }
Enter fullscreen mode Exit fullscreen mode

The API also catches typos:

const result = await mxcheck("user@gmial.com");
console.log(result.suggestion); // "user@gmail.com"
Enter fullscreen mode Exit fullscreen mode

Comparison

Method Fake format Fake domains Disposable Typos Latency
Regex Yes No No No <1ms
MX Lookup Yes Yes No No 10-50ms
Blocklist Yes No Yes No <1ms
API (MXCheck) Yes Yes Yes Yes ~5ms

Which approach should you use?

  • Contact form with low stakes: Regex is fine.
  • User registration: MX lookup + disposable detection at minimum.
  • Lead generation or paid signups: API-based validation. Bad emails cost you money.
  • Enterprise or compliance: API-based, plus SMTP verification.

Quick start: Add to Express.js 

import mxcheck from "mxcheck";

app.post("/signup", async (req, res) => {
  const result = await mxcheck(req.body.email);

  if (!result.valid) {
    return res.status(400).json({
      error: "Invalid email address",
      reason: result.reason,
      suggestion: result.suggestion
    });
  }

  if (result.checks.disposable) {
    return res.status(400).json({
      error: "Disposable email addresses are not allowed"
    });
  }

  // Email is valid, proceed with signup
  res.json({ success: true });
});
Enter fullscreen mode Exit fullscreen mode

One API call blocks fake emails, catches typos, and flags disposable addresses.

MXCheck - Free email validation API. 3,000 requests/month free. npm install mxcheck

Top comments (0)