SMTP verification, explained

SMTP verification checks whether a mailbox exists by starting the delivery conversation with the receiving server and stopping before any message is transmitted.

The handshake, step by step

• Syntax check. Is the address structurally valid under RFC 5322?
• Domain check. Does the domain resolve in DNS?
• [MX record](/learn/mx-records) lookup. Which servers accept mail for this domain?
• Connect. Open a TCP connection to the highest-priority MX host on port 25.
• EHLO. Identify the verifying server.
• MAIL FROM. Declare a sender envelope.
• RCPT TO. Ask the server whether it will accept mail for the target address.
• QUIT. Close the connection. No DATA command is ever sent, so no email is delivered.

The answer to RCPT TO is the signal: 250 means the server will accept mail for that recipient, 550 means no such user.

Why the result isn't always binary

• [Catch-all](/learn/catch-all-email) domains answer 250 for everything.
• [Greylisting](/learn/greylisting) returns a temporary 4xx on first contact, so the check must be retried later.
• Rate limiting can throttle or block a verifier that probes too aggressively from one IP.
• Some providers deliberately obscure mailbox existence for privacy.

A serious verifier handles these with distributed IPs, retry logic, per-provider behaviour models, and honest status codes instead of forcing every address into valid/invalid.

What the statuses mean

• Valid — the server confirmed the mailbox.
• Invalid — permanent rejection; do not send.
• Catch-all / accept-all — accepted, but unprovable.
• Disposable — a temporary mailbox from a throwaway provider.
• Role — a shared team inbox.
• Unknown — the check could not complete; retry.

Doing it yourself vs using a service

Writing an SMTP prober is easy; getting reliable answers is not. Most consumer ISPs block port 25 from residential and cloud IPs, unwarmed IPs get blocked quickly, and per-provider quirks need constant maintenance. That is the work a verification service absorbs — see the email verification api for how to call it in one request.