How Do I Verify an Email Address Is Real?
Confirm an email is valid before you send. Use syntax checks, MX record lookups, SMTP pings, and the major validation tools without sending a single message.
Quick Answer
The lightweight check is to confirm the address is well formed (name@domain.tld) and that the domain resolves to an MX record. The strong check is to ping the recipient's mail server with an SMTP RCPT TO command without actually sending a message; if the server returns 250 OK, the mailbox exists.
Most marketers use a paid service (NeverBounce, ZeroBounce, Hunter, Kickbox, Bouncer) to do this at scale, because doing thousands of SMTP handshakes from your own IP gets you blocklisted.
Why verifying matters
Sending to invalid addresses damages your sender reputation. Mailbox providers (Gmail, Outlook, Yahoo) track bounce rates and start filtering your future mail into spam if more than 2 percent of a campaign bounces. Cleaning a list of 50,000 contacts down to the 47,000 deliverable addresses typically lifts open rates by 10 to 15 percent.
For developers, verification at signup blocks fake registrations and reduces the moderation backlog. For sales teams, it protects expensive cold outreach domains from getting cooked in a single afternoon.
The three-tier verification funnel
1. Syntax check
Confirm the address matches the modern RFC 5321 / 5322 format. Easy regex catches the common cases: exactly one @, no spaces, a valid TLD on the right side. Most language standard libraries already ship a validator (validate_email in Python, EmailAddressAttribute in .NET, validator.isEmail in JavaScript).
Syntax alone catches typos like john@gmailcom but says nothing about whether the mailbox exists.
2. Domain and MX record lookup
Run a DNS query for the MX records of the domain. If no MX record exists, the domain cannot receive mail.
From a terminal: dig MX example.com +short on macOS or Linux. The output should list one or more mail servers ranked by priority. If the answer is empty, mark the address invalid.
If the MX record points to a free provider known to accept any address (catch-all domains), note that the next step may report a false positive.
3. SMTP handshake
The deepest check is to talk SMTP to the mail server and stop one step short of actually sending. The conversation goes:
- Connect to the MX server on port 25 (or 587).
- HELO yourdomain.com.
- MAIL FROM:<verifier@yourdomain.com>.
- RCPT TO:<target@example.com>.
- If the server replies 250, the mailbox is real. If it replies 550, the mailbox does not exist.
- QUIT.
Note: Yahoo, Microsoft 365, and Google increasingly accept all RCPT TO commands and defer the real check to after the body is delivered. SMTP probing is no longer reliable against those providers, which is part of why paid services charge what they do.
Catch-all and disposable domains
- Catch-all domains are set up to accept mail at any address (anyone@yourdomain.com lands in a single inbox). SMTP probing returns 250 for every address, valid or not. Verification tools flag these separately as "Accept-all" with lower confidence.
- Disposable domains are services like 10minutemail, mailinator, and tempr.email that hand out throwaway inboxes. A maintained blocklist (such as the disposable-email-domains project on GitHub) lets you reject these at signup if your business model relies on real customers.
- Role accounts like info@, sales@, abuse@ are valid but often shared. Many B2B platforms exclude them from cold outreach quotas.
Tools worth trying
- NeverBounce: popular for one-off list cleaning. Pay-per-check pricing.
- ZeroBounce: strong on catch-all detection and abuse account flagging.
- Hunter.io: bundled with their email finder; convenient for sales teams.
- Kickbox: developer-friendly API with a sandbox tier.
- Bouncer: EU-based, GDPR-friendly, competitive price.
- MX Toolbox: free single-address lookups when you only need to spot-check a domain's MX configuration.
Most charge between $4 and $10 per 1,000 verifications, with discounts at higher tiers. Free tiers (typically 100 to 250 checks) are enough for a small audit.
Verification at signup
Two patterns dominate.
- Real-time API call. When a user submits the form, your server calls the verifier and rejects invalid addresses before storing the record. Latency is 100 to 500 ms, fine for most flows.
- Double opt-in. Send a confirmation email with a unique link. Only after the user clicks do you mark the address verified. Slower, but it confirms the human and the mailbox in one step.
For paid product signups, double opt-in is the gold standard. For low-friction lead magnets, an API check at submission keeps conversion rates high.
What never to do
- Do not run mass SMTP probes from your production mail server. You will get rate limited or blocklisted within an hour.
- Do not buy email lists and then "verify" them. Even a 100 percent valid list of strangers who never opted in will tank your sender reputation.
- Do not skip verification because the user "should know their own email." Typos in a single character account for the majority of failed transactional emails.
FAQs
Can I verify a Gmail address without sending mail?
Partially. Gmail accepts all RCPT TO commands during the SMTP handshake, so probing always succeeds. You can still confirm the domain MX is gmail-com.mail.google.com, but you cannot prove the specific mailbox exists without sending.
How fresh do verifications stay?
Treat results as valid for 90 days. People change jobs, mailboxes get archived, and previously-deliverable addresses become bounces over time.
Is email verification GDPR compliant?
Yes, when run on data you have a lawful basis to process. Choose an EU-hosted verifier (Bouncer, Captain Verify) if your contacts are EU residents.
The takeaway
Three layers, in order: syntax, MX, SMTP. For more than a hundred addresses, hand the job to a paid verifier and feed the cleaned list into your sender platform. Bounce rates fall, open rates rise, and your sender reputation stays out of the spam folder.