Verify emails in Laravel at registration

Why Laravel's built-in email rule is not enough

Laravel ships with two email validators. The plain email rule only checks that a string looks like an address, and email:dns confirms the domain has an MX record. Neither one tells you whether the specific mailbox actually exists. A registrant can type a syntactically perfect address at a real domain that will hard-bounce every welcome email, password reset, and receipt you send.

When those bounces pile up, your sending domain's reputation drops with Gmail, Outlook, and the rest, and even your legitimate transactional mail starts landing in spam. Signup forms are also a favorite target for disposable inboxes and abuse, so filtering throwaway domains at the door keeps your database clean and your metrics honest.

Verifly runs a live SMTP mailbox check and returns a deliverable / undeliverable / risky verdict plus disposable, role, and catch-all flags. Because it is a plain HTTP GET, it drops naturally into a Laravel service class, a FormRequest rule, or a queued job. You bring your API key, Laravel does the rest.

Add a custom validation rule that rejects undeliverable emails

1. Grab a free Verifly key at verifly.email/api/v1/autonomous/register — 100 credits, no card, no captcha.
2. Add VERIFLY_API_KEY to your .env and expose it under config/services.php as services.verifly.key.
3. Create an invokable rule with php artisan make:rule DeliverableEmail and call Verifly inside it using the Http facade.
4. Attach the rule to the email field in your registration FormRequest so the failure shows up as a normal validation error.
5. Optionally treat risky / catch-all as a soft pass and only hard-reject undeliverable, depending on how strict you want signup to be.

<?php

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;
use Illuminate\Support\Facades\Http;

class DeliverableEmail implements ValidationRule
{
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        $res = Http::withToken(config('services.verifly.key'))
            ->timeout(15)
            ->get('https://verifly.email/api/v1/verify', ['email' => $value]);

        if ($res->failed()) {
            return; // fail open: don't block signup on a verifier outage
        }

        $data = $res->json();

        if (($data['result'] ?? null) === 'undeliverable' || ($data['disposable'] ?? false)) {
            $fail('Please use a real, deliverable email address.');
        }
    }
}

Use the rule inside a FormRequest

Referencing the rule from a FormRequest keeps the check off your controller and lets Laravel's validator attach the error straight to the email field, so your Blade or Inertia form renders it like any other message. Fail-open on a verifier outage is deliberate: a temporary API hiccup should never lock legitimate users out of registration.

public function rules(): array
{
    return [
        'name' => ['required', 'string', 'max:255'],
        'email' => ['required', 'email:rfc,dns', 'unique:users', new \App\Rules\DeliverableEmail()],
        'password' => ['required', 'confirmed', 'min:8'],
    ];
}