How to Stop Fake Email Signups in Node.js (Beyond a Regex)
Every signup form eventually fills up with junk: john@gmial.com, test@test, and throwaway addresses that vanish in ten minutes. You send a welcome email, it bounces, and your sender reputation takes the hit.
Get APIHiver’s stories in your inbox
Join Medium for free to get updates from this writer.
A regex cannot fix this, because it only checks that a string looks like an email. Here is a better approach, with working code.
What a real email check covers
- Syntax: is the address well formed?
- Domain: does it exist in DNS?
- MX records: can the domain actually receive mail?
- Disposable and role addresses: throwaway inboxes, and shared ones like info@ or admin@
- Typos: is gmial.com really gmail.com?
One API call runs all of them
Keeping a disposable-domain list current is a chore, so I use the Email Validation API on APIHiver. The Basic plan is free and includes 500 requests a month. Here is the call in Node.js:
async function checkEmail(email) {
const url = new URL("https://email-validator.p.apihiver.com/v1/validate");
url.searchParams.set("email", email);
const res = await fetch(url, {
headers: { "X-API-Key": process.env.APIHIVER_KEY },
});
return res.json();
}
The response tells you everything in one object: valid_syntax, mx_found, disposable, role_account, did_you_mean, a deliverable verdict (likely, unknown or no) and a 0 to 100 score.
Use it at signup
Run the check on your server when the form is submitted, not only in the browser:
const v = await checkEmail(email);
if (!v.valid_syntax || v.deliverable === "no") {
return "That email does not look right.";
}
if (v.disposable) {
return "Please use a permanent email address.";
}
if (v.did_you_mean) {
return "Did you mean " + v.did_you_mean + "?";
}Stop duplicate accounts from Gmail tricks
Gmail ignores dots and everything after a plus sign, so John.Doe+promo@gmail.com and johndoe@gmail.com reach the same inbox. That makes free-trial abuse easy. The API also has a normalize endpoint that returns the canonical form, johndoe@gmail.com in this case. Store that value in a unique column and the duplicates stop at the database.
Be honest about the limits
No tool can promise an inbox exists, because many mail servers accept any address or refuse to confirm. That is why the verdict says likely instead of yes. For anything important, still send a confirmation link, and keep a light check in the browser for instant feedback.
Want the full version with Python, bulk cleanup and typo suggestions? Read the complete tutorial at https://apihiver.com/blog/validate-email-address-api and try the API live at https://apihiver.com/apis/email-validator/overview
