Rate limits
Paid accounts can send up to 500 validation requests per second. Accounts that have not bought credits yet can send up to 20 per second. Requests over the limit get 429 rate_limited with a Retry-After header, and they cost nothing.
Limits
| Paid accounts | Accounts without a purchase | |
|---|---|---|
| Requests per second | 500 | 20 |
| Short burst | 500 | 40 |
| Requests in flight at once | no separate limit | 100 |
An account counts as paid from its first completed purchase. The limits apply per account, across all its API keys and the MCP server. Every result from /v1/validate (HTTP 200, test addresses included) carries X-RateLimit-Limit with the per-second limit that applies to the key: the account's, or the key's own when it is lower. Error answers do not carry it; a 429 carries Retry-After instead.
You can give a key a lower limit of its own, and a daily credit cap, in the dashboard (see Authentication).
How limits are counted
Limits work like a bucket that refills at the per-second rate and holds at most the burst size. A steady stream at or below the rate never hits the limit; a sudden spike can use the burst, then slows to the rate.
Spread requests evenly rather than sending them in large batches every few seconds. For lists, use a bulk job: bulk jobs are not subject to these per-second limits and schedule the work for you.
When you hit a limit
| Code | Meaning | What to do |
|---|---|---|
rate_limited | Over the per-second limit of the account or key. | Wait Retry-After seconds, then continue at a lower rate. |
key_daily_cap | The key used its daily credit cap. | Raise the cap, use another key, or wait for the next day. |
abuse_throttled | Far more requests ended without a definite answer than with one, so the account is slowed for an hour. | Stop re-checking the same failing addresses; retry them later. |
While capacity is constrained we may lower limits for a short time; you will see 429 or 503 with Retry-After, and nothing is charged.
Timeouts
A single check takes at most 15 seconds on our side; you can lower that with the timeout field (5–15 seconds). A check that runs out of time returns unknown with the reason timeout and is free. Set your HTTP client timeout to about 20 seconds.
Dashboard and free checker
Checks from the dashboard are limited to 5 per second per account. The free email checker on the website allows 5 checks a day from one IP address and is not meant for automation.