Email Verification API vs Bulk CSV: Which to Use?

Most teams treat email validation as a one-off cleanup. Export the list, run it through a checker, re-import, move on.

Three months later the bounce rate is back up.

List quality has two separate problems: the bad data you already have, and the bad data arriving every day. Bulk CSV upload fixes the first. An email verification API fixes the second. If you use only one, you are leaving a leak open.

Two problems, two tools

Bulk CSV validation is a batch job. You upload a file, the tool checks each address, and you download the results with a status per row. It removes bad data that has already accumulated.

Real-time API validation checks one address at the moment it is entered: a signup form, a checkout, a lead capture page, a CRM import. It stops bad data before it reaches your database.

Think of bulk as a deep clean and the API as a lock on the door.

Why you cannot skip either

Your list decays whether you touch it or not

HubSpot's database decay simulation puts B2B contact decay at about 2.1% a month, roughly 22.5% a year. People change jobs, companies close, mailboxes are deleted. A list that was perfect in January is around 6% stale by April. That is the case for scheduled bulk validation. See why B2B lists decay.

Bad data also arrives fresh

Typos (gmial.com), fake addresses, abandoned mailboxes and throw-away domains all pass a simple "contains an @" check. Every one lands in your CRM and ESP, and every one is a future bounce. That is the case for real-time validation at the point of entry.

The margin for error is small

BounceZero's benchmarks put the safe hard-bounce ceiling at about 2%, and Google's sender guidelines ask senders to keep the reported spam rate under 0.10% and never reach 0.30%. You do not get many chances at those numbers. Our bounce guide explains what each bounce type means.

When to use bulk CSV validation

Choose bulk when you are dealing with existing or imported data:

• Before a big campaign. Validate the segment you are about to mail, especially if it has been sitting for months.
• Purchased, scraped or event lists. Never email an unverified acquired list.
• CRM and database cleanups. Quarterly hygiene keeps decay under control.
• Outbound prospecting. Validate every batch from enrichment tools before the sequence starts.
• Migrations. Moving to a new ESP is the best moment to leave dead contacts behind.

Bulk is also the cheaper way to process volume, and you can audit the results before you act on them. Bulk email verification gives you the results as separate Valid, Invalid, Catch-all and Risky downloads, plus an Overview Report you can print or save as a PDF.

When to use the API

Choose the API when data enters your systems continuously:

• Signup and registration forms. Block typos and fake addresses before the account exists. This also protects free trials from abuse.
• Checkout flows. A mistyped email means a customer who never gets the order confirmation.
• Lead capture and demo requests. Sales reps should not chase leads whose emails do not exist.
• CRM automation. Validate before a record syncs to your marketing platform.
• In-app invites and referrals. Stop invitations to dead addresses damaging your transactional reputation.

Speed matters here: a check inside a signup form has to feel instant. Design for a spinner, set a sensible timeout, and decide in advance what happens if the call fails (most teams let the signup through and re-check it later).

What an API call looks like

Authentication is an X-API-Key header, and one call checks one address:

curl -X POST "https://herobounce.com/api/v1/validation/single" \
  -H "X-API-Key: your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"email": "john.smith@company.com"}'

The response (trimmed) tells you the verdict and the reason:

{
  "email": "john.smith@company.com",
  "status": "valid",
  "sub_status": "",
  "confidence": 0.95,
  "safe_to_send": true,
  "details": { "smtp_code": 250, "provider": "google", "is_role_based": false },
  "catchall": { "is_catchall": false }
}

status is valid, invalid, risky or unknown. sub_status explains it (for example mailbox_not_found, disposable, accept_all or role_based), and safe_to_send is true when the address is valid with confidence above your threshold. A common rule for a signup form: accept valid, reject invalid, and for risky accept but flag the contact for review. Full details are in the API docs. For batches there is a bulk endpoint that takes up to 1,000 addresses per request.

The trade-offs, side by side

If you collect any data through forms, you need both.

What good validation actually checks

Whichever route you take, the result is only as good as the checks behind it. A real check goes well beyond a regular expression:

1. Syntax analysis removes malformed addresses and obvious typos.
2. DNS and MX checks confirm the domain can receive mail.
3. SMTP verification asks the receiving server whether the specific mailbox exists.

Two situations make this hard, and it is worth knowing how your tool handles them:

• Catch-all domains accept every address, so SMTP alone cannot tell whether a mailbox is real. HeroBounce does not pretend otherwise: it returns these as risky with the sub-status accept_all, and lets you download them as their own list so you can treat them with care. Our catch-all guide covers the options.
• Greylisting is when a server temporarily refuses first contact. On paid subscription plans HeroBounce retries these automatically after about 15 minutes.

On Starter and above, AI-enhanced scoring adds another layer. A domain intelligence cache keeps repeated lookups fast.

What it costs

Both methods run on the same credits.

• Free: 300 validations a month.
• Pay As You Go: from $1.05 per 1,000, dropping to $0.65 at volume. Credits last 12 months and include catch-all detection and API access. Greylist retry and AI-enhanced scoring are on subscription plans.
• Starter: $17/month for 20,000 validations. Growth: $65/month for 100,000, with up to 2 team members. Pro: $200/month for 500,000, with up to 5 team members.

If your forms generate steady signups, a subscription gives you predictable monthly volume for the API. If you validate in occasional large batches, Pay As You Go ties cost to usage. See pricing.

A practical setup

Most growing teams settle on this pattern:

1. Run one bulk validation now on your whole database to reset the baseline.
2. Add the API to every entry point: signup, checkout, lead forms, imports.
3. Re-run bulk validation before large sends and quarterly for dormant contacts.
4. Monitor bounce rate per campaign. Anything above about 2% means something upstream is leaking.

Frequently asked questions

What is the difference between an email verification API and bulk email verification?

An API checks one address in real time, at the moment it is submitted, and returns a result in seconds. Bulk verification processes a whole file of addresses in one job. Use the API to keep new data clean and bulk to clean what you already have.

How fast is real-time email verification?

It depends on the receiving mail server, because the check involves a live SMTP conversation. Many addresses return in a second or two, slow servers take longer, so build a timeout and a fallback into your form.

Should I validate emails on signup forms?

Yes, if you send mail to the people who sign up. Validating at the point of entry blocks typos and fake addresses before they reach your database and bounce later.

Can I use both the API and bulk upload on one account?

Yes. Both draw from the same credits, so you can clean your existing list in bulk and protect new data with the API without a second subscription.