Email verification for SaaS signups

A rule for each result

Rejecting everything that is not deliverable loses real customers. This is a sensible default for most products.

• undeliverable: block it and ask them to check the address, showing the suggested correction if there is one.
• risky with reason disposable: block it if your free tier is worth abusing.
• risky for other reasons: allow it. Role addresses and catch-all domains include real business customers.
• unknown: allow it. You could not confirm it, which is not the same as bad.

Never let verification break signup

Set a short timeout and let the signup through if the check fails. An outage in any third-party service should not stop people joining your product.

async function shouldBlock(email) {
  try {
    const url = new URL("https://app.veridock.io/v1/verify");
    url.searchParams.set("email", email);
    url.searchParams.set("timeout", "3000");
    const res = await fetch(url, {
      headers: { Authorization: `Bearer ${process.env.VERIDOCK_API_KEY}` },
      signal: AbortSignal.timeout(4000),
    });
    if (!res.ok) return false;
    const { status, reason } = await res.json();
    return status === "undeliverable" || reason === "disposable";
  } catch {
    return false;
  }
}

It does not replace a confirmation email

Verification shows that a mailbox can receive mail. A confirmation link shows that this person controls it. Use verification first so that the confirmation email actually arrives and does not bounce.

Next steps

• Next.js signup guide
• Supabase signup hook guide
• Free email typo checker
• Every status and reason