One check returns evidence, not ownership proof
check-if-email-exists combines several signals. It validates syntax, resolves MX records, classifies disposable and role accounts, opens an SMTP conversation, and looks for catch-all, disabled, full, or deliverable responses. The final is_reachable field is one of safe, risky, invalid, or unknown. That vocabulary is important because mail servers can accept a recipient during verification and reject later, hide mailbox status, or block the probe entirely.
The project is available as a Rust crate, a downloadable CLI, and an HTTP backend. The CLI checks directly from the machine running it. The backend accepts a POST request and returns structured JSON, making it easier to call from other languages. The measured repository is compact at 179 files and roughly 9,221 lines of source, though compiling its 529-package Rust graph takes much longer than its checkout size suggests.
What happened when we ran it
Our sandbox installed 529 packages in 30 seconds. The Rust build completed successfully in 311 seconds, and cargo test finished in 37 seconds with 33 passed and 0 failed. We tested commit 81da93e in an unprivileged Debian container with 3 CPUs, 12 GB of RAM, and no secrets. Those results cover the repository's available automated suite, not live mailbox accuracy.
The checkout occupied 2.9 MB before compiled dependencies and included 4 CI workflow files. The lab reported no Dockerfile and no tests directory, even though cargo discovered and ran 33 tests from the source layout. We did not probe real email providers, compare results with delivered mail, test an SMTP proxy, or measure bulk throughput. No deliverability percentage can be inferred from this run.
Port 25 access is the first production gate
The Docker quick start exposes the API on port 8080, but outbound verification normally connects to recipient mail exchangers on port 25. Many cloud providers restrict that port, and some destination servers refuse or delay unfamiliar clients. Open issue 1641 shows the practical outcome: a container receives Connection refused, the SMTP section contains an IO error, and reachability becomes unknown rather than a definitive result.
That behavior is correct for incomplete evidence, but applications must be designed for it. Retrying the same blocked network path will not create certainty. A signup form should avoid rejecting a legitimate user because one probe was unavailable. Queue the result, combine it with confirmation email behavior, or allow a later correction. The tool helps rank risk; it does not replace address ownership verification through a link or code.
Volume turns IP reputation into an operating dependency
The README says direct checks from your own IP are appropriate only for very small volumes. Larger workloads need SMTP proxy servers. The API accepts SOCKS5 connection details, while the CLI exposes proxy host, port, username, and password. Operators also control the SMTP sender address and EHLO name. These values affect how a destination mail server interprets the connection.
Running bulk checks can resemble abusive enumeration to a provider, even when the input list is legitimate. Rate limits, concurrency, retry schedules, and source-IP reputation need deliberate policy. Open pull request 1638 argues for skipping catch-all probes in cases where repeated RCPT patterns could look suspicious. Whether or not that change merges, it captures the operational tradeoff: gathering more evidence can make future evidence harder to obtain.
Catch-all and provider behavior require cautious product rules
A catch-all domain accepts mail for addresses that may not correspond to real people. Some providers also conceal mailbox status or vary responses based on the connecting IP. safe therefore means the checks supported a delivery attempt, not that a human reads the inbox. invalid is useful when syntax, DNS, or a permanent SMTP response is clear. risky and unknown should remain visible rather than being collapsed into failure.
Open issue 1443 reports an environment where smtp.is_deliverable remains false even for the reporter's own mailbox. That single report does not establish a general defect, but it is a good regression case for adoption. Before using the output to block accounts or remove contacts, test addresses you control across Gmail, Microsoft, a catch-all domain, a disabled mailbox, and a domain with no MX records.
The license separates open-source and proprietary use
The repository uses a dual-license model. AGPL-3.0 is available for open-source applications with compatible terms. Proprietary sites, tools, and applications are directed to a commercial license. This is not a minor packaging detail: a team should decide its license route before embedding the crate or deploying a modified backend, then record that decision with the dependency review.
The hosted Reacher and No2Bounce offerings are separate ways to avoid operating the network path yourself. A managed vendor may be cheaper than maintaining proxies, monitoring provider-specific response drift, and answering false-positive complaints. Self-hosting makes sense when control or integration outweighs that burden and the organization is ready for the license obligations.
Releases slowed, while issue activity continued
GitHub recorded 9,485 stars, 88 combined issues and pull requests, and a last code push on March 17, 2026. Release v0.11.7 was published on January 15. Issue and pull request updates continued into June and August, including licensing, Yahoo verification, Docker SMTP failures, and bulk checking. The code push is months old, but the tracker is not silent.
That health picture is adequate for a focused tool, with one caution: email-provider behavior changes outside the repository's control. The 33 passing tests give the Rust core a sound starting point, while live accuracy needs continuous fixtures and real network monitoring. Adopt it if your application can preserve uncertainty and your operators can maintain SMTP access. A product that demands a single permanent verdict for every address is asking the protocol for more than it can prove.