# When the order confirmation never arrives

_2026-09-15 · Boundstone (https://boundstone.io/blog/order-confirmation-never-arrived)_


The most expensive checkout error is not a declined card. It is an order that completes perfectly and then goes quiet, because the confirmation went to an address that does not exist.

The customer waits. They cannot find a tracking number. They open a ticket, or they file a chargeback, or they simply never buy again — and none of those outcomes tells you the actual cause, which was four characters typed wrong while the customer was already looking at the form.

## Catch it while they are still on the page

The cheapest moment to fix a bad address is the second before the order submits. After that, every path back to the customer runs through the address that does not work.

One call to `POST /v1/verify/email` returns, without sending anything:

- **`valid_syntax`** — the address is well-formed. Catches the typo class outright.
- **`mx_found`** — a live DNS lookup confirming the domain publishes mail servers. Catches dead and mistyped domains, which is where `gmial.com` dies.
- **`disposable`** — the address is on a maintained list of throwaway providers.
- **`role_account`** — it is `support@` or `orders@` rather than a person.

For a storefront, the first two are the whole game.

## Suggest, do not block

A hard block at checkout is almost always the wrong response. You will be wrong sometimes, and being wrong at the payment step costs you the order.

The pattern that works: when `mx_found` is false or the syntax fails, surface an inline "did you mean" prompt and let the customer correct it. Keep the submit button live. A customer who insists their address is right is usually right, and a lost order costs more than a bounced receipt.

Role accounts are worth knowing about and never worth blocking — plenty of legitimate business orders come from `purchasing@`.

## What this cannot tell you

Validation removes the avoidable failures. It does not promise the message lands.

`smtp_mailbox` and `catch_all` come back in `checks.not_performed` on every response, and that is a real boundary, not a caveat. Confirming a specific inbox exists requires an SMTP conversation with the receiving server, which is slow, frequently answered dishonestly, and damaging to the sending reputation of whoever runs it. A well-formed address at a domain with live mail servers can still belong to nobody.

Spam filtering is likewise invisible from outside. If confirmations are reaching valid addresses and still not being seen, the problem is deliverability — your sending domain's authentication and reputation — and no amount of address validation will move it.

## There is no app to install

Boundstone is an HTTP API. There is no Shopify app, no plugin listing, no one-click install. Validation is a request from your own checkout backend or storefront code, and the response names every check it ran and every one it did not.

If you need a drop-in store integration today, that is honest information to have before you read further. If you are already writing checkout logic, it is one call.

## Phone numbers, if you collect them

The same argument applies to SMS delivery notifications. `POST /v1/verify/phone` returns `line_type`, and sending a shipping notification to a `fixed_line` spends the message on a phone that cannot display it. Route those to email instead.

`valid: true` means the number is well-formed and sits in an allocated range — not that a handset will receive anything. `carrier_lookup`, `ported_status` and `hlr_liveness` are `not_performed` unless you request a live dip with `hlr:true`.

## The short version

- **A silent order is worse than a declined card.** The customer waits, then opens a ticket or charges back, and neither tells you the cause.
- **The cheapest fix is before submit.** Afterwards, every path back runs through the broken address.
- **Syntax plus a live MX lookup catches the avoidable share** — typos and dead domains — without sending anything.
- **Suggest, never block, at the payment step.** A lost order costs more than a bounced receipt.
- **`smtp_mailbox` and `catch_all` are `not_performed`.** A valid address at a live domain can still belong to nobody.
- **Spam filtering is invisible from outside.** If confirmations reach valid addresses unseen, that is a deliverability problem, not a validation one.
- **There is no Shopify app.** It is an HTTP call from your own checkout code.