---
title: "Onboarding verification: check signup details"
url: "https://lookvalid.com/use-cases/onboarding-verification.md"
canonical_url: "https://lookvalid.com/use-cases/onboarding-verification"
last_updated: "2026-10-19"
type: "conceptual"
summary: "Check the email domain, the phone number and the connection at the moment of signup."
related: ["https://lookvalid.com/use-cases.md", "https://lookvalid.com/products/email-domain-check.md", "https://lookvalid.com/use-cases/fraud-prevention.md"]
---

# Onboarding verification: check signup details

Check the email domain, the phone number and the connection at the moment of signup.

Check the email domain, the phone number and the connection at the moment of signup, then let clean signups straight through and send only mismatches to a second step. Clean signups go straight through, and only mismatches reach the extra step.

## The problem

A signup form accepts whatever is typed. Some of it is a typo, some of it is a throwaway address and some of it is a person trying several accounts. Without a check, all of it lands in your user table and your email sends.

Verification that asks everyone for more costs you real signups. Verification that only fires when the details disagree keeps the form short for the people you want and puts the effort where the signal is.

The FTC reported that there were more than 1.1 million reports of identity theft received through its IdentityTheft.gov website in 2024. (2024; [New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024 (Federal Trade Commission)](https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024), read 2026-10-18.)

## What LookValid does for this

- [Check the email as it is typed](https://lookvalid.com/products/email-domain-check.md): Returns syntax validity, MX, SPF and DMARC for the domain and flags disposable, free provider and role addresses. It cannot confirm the mailbox exists, so pair it with a confirmation link where that matters. (1 credit per address checked)
- [Check the number format and type](https://lookvalid.com/products/phone.md): Normalizes the number to E.164 and returns its country and the type the numbering plan assigns. Useful for catching typos and VoIP numbers; it cannot tell whether the line is active. (1 credit per valid number)
- [Compare the connection to the claim](https://lookvalid.com/products/ip.md): Returns country, region, network owner and flags for hosting ranges and Tor exits. A signup claiming one country from a data center in another is a reason for the second step, not an automatic block. (1 credit per lookup)
- [Look at the company domain](https://lookvalid.com/products/domain-age.md): For business signups, returns when the work email domain was registered and by whom, from the public registry. A very new domain next to a large claimed company is worth a second look. (2 credits per registered domain (unregistered domains are free))

## A real request and response

This request checks the email domain from a signup form. The response is a real capture: mail records, authentication policies and the disposable, free provider and role flags.

```json
{
  "email": "info@example.com"
}
```

Real response, captured 2026-10-18:

```json
{
  "found": true,
  "data": {
    "email": "info@example.com",
    "syntax_valid": true,
    "domain": "example.com",
    "mx_records": [],
    "has_mx": false,
    "null_mx": true,
    "implicit_mx": false,
    "spf": {
      "record": "v=spf1 -all",
      "record_count": 1,
      "policy": "-all",
      "valid": true,
      "issues": []
    },
    "dmarc": {
      "record": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
      "record_count": 1,
      "policy": "reject",
      "subdomain_policy": "reject",
      "pct": null,
      "rua": [],
      "valid": true,
      "issues": []
    },
    "disposable": false,
    "free_provider": false,
    "role_account": true,
    "smtp_checked": false,
    "deliverability_signal": "undeliverable",
    "deliverability_reasons": [
      {
        "code": "null_mx",
        "message": "The domain publishes a null MX record, which means it does not accept email."
      },
      {
        "code": "role_account",
        "message": "The address is a shared role mailbox such as info@ or support@, not a person."
      }
    ]
  }
}
```

## Questions

### Can this replace a confirmation email?

No. The domain check shows whether an address could receive mail and what kind of domain it is. Only a confirmation link proves the person can open that mailbox.

### Will this block people on a VPN or a free email provider?

Only if you write that rule. The lookups return flags such as free provider or hosting range, and you decide whether a flag means a second step, a note on the account or nothing.

### When in the flow should the checks run?

Run the email and phone checks when the form is submitted and the connection check on the request itself. Each is one call, so you can show a correction prompt before the account is created.

## Sources

- [New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024 (Federal Trade Commission)](https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024), read 2026-10-18

## Related

- [What teams use LookValid for](https://lookvalid.com/use-cases.md)
- [Email Domain Check API](https://lookvalid.com/products/email-domain-check.md)
- [Fraud prevention with contact and IP checks](https://lookvalid.com/use-cases/fraud-prevention.md)