ZapBounce and Firebase
Firebase puts the database in the client, which makes the same rule as everywhere else more urgent: the verification key belongs in a Cloud Function.
Firebase also has its own email verification, and it answers a different question from this one.
Firebase Auth's email verification proves control, not existence
Firebase Auth sends a confirmation link and marks the user verified when they click it. That proves the person controls the mailbox, which is the stronger claim.
It does not tell you in advance whether the address can receive mail. A mistyped address gets a verification email that bounces, and the user sits unverified with no explanation on either side.
Checking before Firebase sends the link catches the typo while the user is still on the signup screen, which is the only cheap moment.
How the data moves
Verify in a Cloud Function before creating the user
A callable function the client invokes, with the key in function config rather than client code.
Return the typo suggestion to the client
The user is on the signup screen and can accept a correction in one tap.
Store the verdict in a document the client cannot read for others
Firestore security rules scope it, the same way any user data is scoped.
Let Firebase Auth's verification do its own job
Ours says the mailbox exists; theirs says the person opened it. Both are useful and they are not substitutes.
Setting it up
- Store the API key in Cloud Functions configuration, not in the client bundle.
- Write a callable function that verifies an address and returns the verdict and suggestion.
- Call it from the signup screen before creating the Firebase Auth user.
- Show the typo suggestion as a tappable correction.
- Write the verdict to a Firestore document scoped by security rules.
- Continue using Firebase Auth's own verification link for proof of control.
Firebase: common questions
Firebase already verifies email. Why this?
Firebase proves the person clicked a link. This tells you the mailbox exists before the link is sent, which catches the typo while it is still fixable.
Where does the key go?
Cloud Functions configuration. Anything in the client bundle is public.
Should signup block on an invalid verdict?
Show the suggestion and let them correct it. Blocking outright on catch-all or unknown refuses real users.
Check a Firebase export today
100 free checks a month, no card. Unknown results and duplicates are never billed.