Bad email addresses in a signup form don't just clutter your database, they wreck deliverability. A high bounce rate signals to mailbox providers like Gmail and Outlook that your sending domain isn't trustworthy, and that reputation hit follows every email you send afterward, not just the bad ones.
If you're building a signup flow, a CRM integration, or a bulk import pipeline, "email verification" usually gets bolted on as a regex check and forgotten. That's a mistake, regex can only tell you an address is syntactically plausible, not that it exists. This post walks through the three layers of email verification, what each one actually checks, and how to decide which one belongs in your stack.
Why regex alone isn't verification
A regex pattern confirms an address is formatted correctly, it says nothing about whether the mailbox exists. john@company-that-does-not-exist.zzz will pass most email regex patterns without complaint. So will a real-looking address at a domain with no mail server configured, or a mailbox that was deleted two years ago.
True verification requires checking three separate things in sequence: syntax, domain, and mailbox existence. Skipping straight from syntax to "trust it" is why forms full of validated-looking emails still produce 8–15% hard bounce rates on the first send.
