Email Verification: How MX and SMTP Checks Work

Sending email to addresses that do not exist hurts deliverability. Bounces signal poor list quality to mailbox providers, waste sending capacity and can push a domain's reputation down. Email verification checks addresses before you send, flagging those that are badly formatted, belong to domains that cannot receive mail or are likely to bounce. Most verification tools combine syntax checks, DNS lookups for mail exchange records and a conversation with the receiving mail server. This guide explains how each step works, what the results mean, where verification is uncertain and how to use it responsibly as part of list hygiene.

Why verify addresses before sending

Verification helps in several ways:

• Fewer hard bounces, which protects sender reputation
• Less wasted sending on addresses that cannot receive mail
• Early detection of typos in forms, such as misspelled domains
• Cleaner CRM data, so sales and marketing reports are more accurate

It does not replace consent or targeting. A valid address belonging to someone who does not want your email can still generate complaints.

Step 1: syntax checks

The first check is whether the address is formatted correctly: a local part, an @ symbol and a domain. Verification tools also catch common problems such as spaces, missing domains, repeated dots and obvious typos in well-known domains. Syntax checks are fast and certain, but they only confirm the address could exist, not that it does.

Step 2: domain and MX checks

Next, the tool looks up the domain in DNS. Mail exchange, or MX, records tell other servers where to deliver mail for the domain. RFC 5321, the SMTP standard, also explains that if no MX records exist, the address is treated as if it had an implicit MX pointing to the domain's own address record (RFC 5321).

A domain with no usable mail destination cannot receive email, so addresses on it are invalid. A domain with MX records may still not accept a specific mailbox, which is what the next step checks.

Step 3: SMTP mailbox checks

The tool then connects to the domain's mail server and starts an SMTP conversation as if it were going to send a message, giving a sender and the recipient address, but disconnecting before sending any content. The server's response to the recipient can indicate:

• Accepted: the server is willing to receive mail for the address
• Rejected permanently: often a 550 response such as mailbox unavailable
• Temporarily refused: a 4xx response such as 450, which may mean greylisting or temporary blocking

SMTP also defines a VRFY command for verifying addresses, but RFC 5321 notes that sites may disable it for security reasons and, if so, must return a 252 response rather than confirming or denying. In practice, verification therefore relies mostly on the recipient step of a normal conversation.

Where email verification is uncertain

SMTP checks are informative but not definitive:

• Catch-all domains accept mail for any address, so every mailbox appears valid
• Some servers accept recipients during the conversation and bounce later
• Greylisting temporarily refuses unknown senders, making results inconclusive
• Some providers limit or block repeated verification attempts
• Mailboxes can be deleted after verification

Good tools report these cases as risky or unknown rather than valid. Treat them differently from confirmed results.

Worked example: email verification results

The table below shows hypothetical results for a small batch of addresses and how a team might act on them. Addresses and outcomes are illustrative.

AddressSyntaxDomain mail recordsSMTP [email protected] [email protected] mail destinationNot attemptedInvalid domainCorrect typo or [email protected] found550 mailbox [email protected] foundAccepted for all addressesCatch-all, unknownSend cautiously or confirm another [email protected] found450 try again laterUnknownRecheck laterfrank@@example.comInvalidNot checkedNot attemptedInvalid syntaxRemove

Only clearly valid addresses go straight into sending. Catch-all and unknown results are handled with extra caution.

Other flags verification tools add

Beyond deliverability, many tools add flags that help decide how to treat an address:

• Role addresses, such as info@ or sales@, which reach a team or shared inbox rather than a person
• Disposable or temporary address domains, often used to get past sign-up forms
• Free webmail domains, which matter if you expect business addresses
• Known typo domains that closely resemble popular providers

These flags are not reasons to delete addresses automatically. They are signals to combine with your own rules, such as requiring business addresses for a trial or routing role addresses to a different follow-up.

Use real-time verification on forms

Verifying addresses when people enter them on sign-up or contact forms prevents bad data at the source. Syntax and domain checks are quick; mailbox checks may add delay, so some teams run them after submission. Suggest corrections for common typos rather than rejecting the address outright.

Verify lists before campaigns

Before sending to a list that has not been used recently, verify it in bulk. Remove invalid addresses, review risky ones and suppress addresses that previously bounced or unsubscribed. Our guide to cold email infrastructure explains how verification fits alongside domain set-up, authentication and sending limits.

Respect privacy and provider limits

Verification involves processing personal data and contacting other organisations' mail servers. To stay responsible:

• Verify only addresses you have a legitimate reason to hold
• Use reputable tools that respect server limits
• Avoid repeated checks on the same address in short periods
• Remember that verification does not create permission to email someone

For outbound prospecting, verification should come after decisions about targeting and lawful basis, not instead of them. Our guide to outbound lead generation covers how to build targeted prospect lists.

Keep lists clean over time

Verification is one part of ongoing list hygiene:

• Remove hard bounces immediately
• Track soft bounces and remove persistent ones
• Suppress unsubscribes across all tools
• Re-verify older data before reuse
• Remove long-term inactive recipients

Choose a verification tool

When comparing tools, look at how they report uncertain results, whether they detect catch-all domains, how they handle greylisting, data retention and security, integration with your CRM or sending platform and pricing for your volume.

Frequently Asked Questions

How does email verification work?

It checks address syntax, looks up the domain's mail exchange records and holds an SMTP conversation with the receiving server to see whether it will accept mail for the address, without sending a message.

Can email verification be 100% accurate?

No. Catch-all domains, greylisting and servers that accept then bounce later make some results uncertain. Good tools label these as risky or unknown.

What is a catch-all domain?

A domain whose mail server accepts mail for any address, so verification cannot confirm whether a specific mailbox exists.

Does verifying an address mean I can email it?

No. Verification only checks deliverability. You still need a lawful basis and must follow the email marketing rules that apply to you.

Send to addresses that will arrive

We set up verification on forms and lists, bounce handling and suppression so your sending stays clean and your reputation stays strong. See our cold outreach and deliverability service, or talk to us about email verification.

About the Author

Manav Sharma is the founder of Insyrge and a CRM solutions architect. He works across Zoho, Salesforce, HubSpot, Odoo and more, designing the CRM setups, integrations and automations that keep sales and operations teams working from the same data.