Skip to content

Email Validation

Confirm that email addresses submitted through your forms are genuine, reachable, and not from disposable services.

Credits Required

Email validation is available on all plans, including free. Paid plans include a monthly credit allowance; free plan users can purchase credits manually. See Validation Credits for details.

Basin evaluates each email address through SpamCheck.ai, which performs a series of checks including DNS/MX record lookups and mailbox reachability tests via Amazon SES. Each successful check consumes one validation credit.

Enabling Email Validation

  1. Open your form and go to Settings → Spam
  2. Scroll to the Email Validation section
  3. Toggle Enable Email Validation on
  4. Configure the options below
  5. Click Save

Image showing the email validation settings panel

What Gets Checked

Each email address is evaluated across several dimensions:

Check Description
Syntax Confirms the address matches a valid email format
DNS / MX Records Verifies the domain exists and has mail server records
Mailbox Reachability Tests whether the specific mailbox can receive mail
Disposable Address Detection Flags temporary and throwaway email services
Random Input Detection Catches nonsense addresses like asdfgh@example.com

The result of these checks produces an overall verdict: HIGH, MEDIUM, or LOW quality. Your strictness setting determines which verdicts are rejected.

Validation Stage

The validation stage controls when Basin checks submitted email addresses.

Stage Description
Client Only Validation runs in the browser before submission. Can be configured to block submission if the address fails.
Server Only Validation runs on Basin's servers after the form is submitted.
Client + Server Validation runs in the browser first, then again on the server. Provides the highest coverage.

Server-side validation is a silent check — the outcome is determined by your enforcement setting.

Client + Server uses 2 credits per submission

When using the Client + Server stage, Basin runs two separate validation checks — one in the browser and one on the server. Each check consumes one credit, so each submission uses two credits for the email field.

Client-side validation requires your form to be built with Form Studio or BasinJS. It is not available for plain HTML form backends — use Server Only in that case.

Form Studio

  1. Open your form in Form Studio
  2. From the field picker, add an Email with Validation widget to your form
  3. Select the field — the settings panel will show an Enable email validation toggle and a Client side validation enforcement dropdown
  4. Set enforcement to Warn (flags but allows submission) or Block (prevents submission on failure)
  5. For full settings — validation stage, strictness level, and more — go to Form → Settings → Spam

Image showing the Email with Validation widget and its settings in Form Studio

BasinJS

BasinJS 2.11.0 Required

Email validation requires BasinJS 2.11.0 or later. See the BasinJS docs for installation and upgrade instructions.

Add the data-basin-email-validation attribute to any email input inside a Basin-managed form. Set the value to your desired enforcement mode:

<form action="https://usebasin.com/f/YOUR_FORM_ID" data-basin-form>
  <input type="email" name="email" data-basin-email-validation="warn">
  <button type="submit">Submit</button>
</form>
Mode Behavior
warn (default) Shows a warning for invalid addresses but still allows submission. Warning details are forwarded to the server.
block Shows an error and prevents submission until the address passes or the validation service is unavailable.

Validation fires as the user types (debounced) and again on blur. In block mode, Basin JS also checks the result on submit and prevents submission if the address is invalid.

Basin JS inserts an inline feedback message after the input. Multiple email fields on the same form are each validated independently.

If the validation API is unreachable or rate-limited, the field is treated as valid so submission is never blocked.

Client-Side Validation Is Not a Security Boundary

Always enable server-side validation for enforcement that matters. Users can disable JavaScript or intercept requests.

Strictness

Strictness controls which verdict levels cause a submission to fail validation.

Strictness Rejected Verdicts
Block Low Only (default) Only LOW verdict addresses are rejected. MEDIUM and HIGH are accepted.
Block Low + Medium Both LOW and MEDIUM verdict addresses are rejected. Only HIGH is accepted.

Start with Block Low Only to minimize false positives. Move to Block Low + Medium if you are seeing a significant number of poor-quality addresses slipping through.

Enforcement

Server-side enforcement controls what happens when an email fails validation.

Enforcement Behavior
Warn The submission is accepted but flagged in the Basin dashboard for review.
Block The submission is rejected and marked as spam.

Use Warn when you want to monitor results before committing to hard rejection. Use Block once you are confident the strictness level is correctly calibrated for your audience.

Rate Limiting

Session Validation Limit

Set a maximum number of email validation attempts per user session. This prevents scripts from probing your form with many different addresses.

Rate-Limited Behavior

Controls what happens when a session exceeds the validation limit:

Option Behavior
Allow with Log The submission is accepted and the rate limit event is logged.
Mark as Spam The submission is marked as spam.

Credits

Each email address validated consumes one credit from your shared validation pool. Monthly credits are used first; purchased credits are drawn on once your monthly allowance is exhausted.

If credits run out mid-month, email validation will stop checking addresses and Basin will notify you by email. See Validation Credits to purchase more or configure auto top-up.

Shared Credit Pool

Phone and email validation draw from the same credit pool. A form with both features enabled will consume one credit per phone check and one credit per email check on each submission.