Audit your user list for fake and broken emails

How to run the audit

1. Export your users. Any CSV with an email column works: Stripe customers, Supabase or Postgres users, a form tool export, a newsletter list.
2. Drop the file on the box above, or paste addresses one per line. The audit finds the email column by its header or its contents, pulls the address out of cells like Rivera, Sam <sam.rivera@outlook.com>, and merges exact duplicates.
3. Read the summary, then act on each group as described below. Click "Try a sample" first if you want to see the output with made-up data.

On Postgres or Supabase, this exports just what the audit needs:

-- Supabase: auth.users. Plain Postgres: your own users table.
\copy (select email, created_at from auth.users order by created_at) to 'users.csv' with csv header

What the audit flags

Alias clusters collapse +tags on every domain, dots on Gmail, and alternate domains of the same provider (googlemail.com is gmail.com, pm.me is proton.me). Dots are ignored on Gmail only: for work and school accounts, Google says dots do change the address. To compare a few addresses by hand, use the Gmail alias checker.

The summary line adds it all up: the share of unique emails that look fake or unreachable, how many real people mistyped their address, and an estimated waste figure ($0.50 per fake account by default).

What a file cannot show: datacenter, VPN and burst signals need the visitor's network and timing at the moment of signup. And the audit never probes mailboxes, so an address on a healthy domain can still bounce.

Why only domain names leave your browser

A user list is personal data. Many list-cleaning services work by uploading your file so their servers can probe each mailbox. This audit does not need to:

• Parsing, column detection, deduplication, typo suggestions, alias clustering and the throwaway-list match all run in JavaScript in your tab. The throwaway list is downloaded once and checked locally.
• Only domains that still need a DNS answer (company domains that are not free mail, relays, known throwaways or typos) are sent to Vetto's /v1/audit endpoint, 20 at a time, for a mail-server lookup. No local part, no full address, no other column.
• Vetto stores no email address from the audit, so there is nothing to delete afterwards.

You can check this yourself: open your browser's developer tools, switch to the Network tab and run the audit. Each request body looks like {"domains":["acme.io","oldstartup.example"]}.

How to act on each result: fix, re-confirm, suppress or keep

• Typos: fix. These are your most valuable rows: real people who wanted in. Email the corrected address once, with a link that confirms the change. A suggestion is a guess, so let the person confirm it instead of rewriting the account silently.
• Dead domains: suppress, then re-confirm if they pay. Every send to them bounces, and bounces hurt your sender reputation. If a paying customer's company domain died, reach them through billing or support and ask for a new address.
• Throwaway inboxes: suppress. Stop emailing them and leave them out of your activation metrics. If one is still on an active trial, ask for a real address before the trial continues.
• Alias clusters: review. A cluster is a risk signal, not proof. Suped's guide to Gmail duplicates recommends keeping the address the user typed and using a normalized key only for matching. Check what each account did before you merge or close anything.
• Invalid: fix or delete. A row without a usable address cannot receive anything from you.
• Relays: keep. They forward to a real inbox.

On Pro, export the flagged rows with vetto_flags, vetto_suggestion and vetto_same_person_as columns and work through them in a spreadsheet.

What a typical signup list looks like

There is no universal benchmark: a B2B tool behind a sales call and a free AI tool posted on a deals forum attract very different signups. The public numbers give a rough frame:

• TowerData found that 8.4% of addresses entered on web forms through its validation API were invalid (tens of millions of addresses verified in 2018).
• In BounceZero's 2026 dataset of 7.8 million addresses, 6.9% were disposable, and the typo domains gnail.com, gmial.com and gmai.com showed up at 0.31%, 0.24% and 0.18%. That is vendor data from outreach, prospecting and CRM lists as well as newsletter signups, not signup forms alone.
• One Discourse forum owner reported that almost 10% of new registrants typed their email wrong or left it out. That is one forum with no method given, not a study.

So run the audit on your own export and treat the result as your baseline. Change one thing at the form, re-run the audit a month later, and compare.

Stop new ones at the form

An audit cleans up the past. New typos and throwaways arrive with every signup, so catch them where they enter: one script tag checks each email field when the visitor leaves it, offers a one-click fix for typos and blocks throwaway and dead domains.

<script src="https://usevetto.com/v.js" data-site="pk_your_public_key" defer></script>

• Free: typo rescue, throwaway and dead-domain blocking, relay tagging and a honeypot for simple bots. 1 site, 1,000 checks a month, and this audit for the first 1,000 rows.
• Pro ($12/month or $99/year): alias and repeat-signup detection as people sign up, lookalike domains, datacenter/VPN/Tor and burst signals, a deny list, signed tokens, alerts, a 90-day log, and unlimited audits with export. On Free, Pro signals run in shadow mode, so your stats show what they would have caught.

Test a single address with the disposable email checker, see which misspellings matter most with the email typo checker, or read the playbook for stopping free trial abuse if repeat trials are what brought you here.