Most email format validators check whether an address looks like it could be valid — correct syntax, a real domain, an existing TLD. But a properly formatted address can still hard bounce if the specific mailbox doesn't exist.
SMTP email verification solves this problem by actually connecting to the recipient's mail server and asking whether the mailbox exists — using the same protocol that email servers use to deliver real messages.
What Is SMTP?
SMTP (Simple Mail Transfer Protocol) is the standard protocol used to send email across the internet. Every time someone sends an email, their email client or server uses SMTP to transfer the message to the recipient's mail server.
The SMTP protocol involves a handshake conversation between two servers:
SMTP email verification performs steps 1-4 — then closes the connection without ever sending a message.
How SMTP Email Verification Works Step by Step
Here's the exact sequence BounceZero follows for SMTP verification:
Step 1: DNS MX Lookup
First, we look up the MX (Mail Exchange) DNS records for the email's domain. These records tell us which mail servers are responsible for accepting email for that domain. If no MX records exist, the domain cannot receive email — an immediate undeliverable verdict.
Step 2: TCP Connection
We open a TCP connection to the highest-priority MX server on port 25. If the server refuses the connection or times out, we try secondary MX records.
Step 3: SMTP EHLO/HELO
We announce ourselves with an EHLO command, identifying the connecting server. The receiving server responds with its capabilities.
Step 4: MAIL FROM
We issue a MAIL FROM command with a generic probe address. This initializes the SMTP transaction.
Step 5: RCPT TO
We issue RCPT TO with the email address we're verifying. The server responds with:
- 250 OK: The mailbox exists and will accept the message
- 550 / 551 / 553 / 5xx: The mailbox doesn't exist or is rejected
- 452 / 4xx: Temporary failure (greylisting, server overload)
Step 6: QUIT
We close the connection without sending any message content. The entire process typically takes 1-3 seconds.
What Are Catch-All Domains?
A catch-all domain is configured to accept any RCPT TO command — regardless of whether the specific mailbox exists. When you email user123@example.com, the server accepts it even if that mailbox is completely fictional.
This makes basic SMTP verification useless for catch-all domains: every address appears deliverable. In reality, many of those addresses will soft-bounce or silently drop the message at delivery time.
BounceZero detects catch-all behavior using a 3-probe algorithm: after verifying the target address, we send RCPT TO commands with three obviously fictional random addresses (e.g., xrandomtest123456@domain.com). If all three return 250 OK, we know the server is a catch-all — and we classify the original address as Risky / Catch-All rather than Deliverable.
When SMTP Verification Fails: Probe Blocking
Some of the world's largest email providers actively block SMTP verification probes:
Gmail / Google Workspace: Returns 250 OK for all RCPT TO commands, regardless of whether the mailbox exists. This makes Gmail addresses appear universally deliverable via SMTP.
Outlook / Hotmail / Microsoft 365: Similarly returns positive responses to probes, making SMTP verification unreliable for Microsoft domains.
Yahoo Mail: Blocks verification probes from datacenter IPs.
For these providers, BounceZero switches to alternative verification methods:
- Gravatar lookup (checks if the address has a registered profile)
- Breach database correlation
- Domain and provider reputation scoring
- ML model trained on historical delivery outcomes for that provider
This multi-method approach maintains high accuracy even when direct SMTP verification is blocked.
What About Greylisting?
Greylisting is a spam reduction technique where a mail server temporarily rejects first-time SMTP connections with a 4xx (temporary failure) response code. The idea is that legitimate mail servers will retry, but spam bots often won't.
A naive SMTP verifier would mark a greylisted address as Unknown or even Undeliverable. BounceZero handles greylisting by:
For bulk verification jobs, greylisting retries happen asynchronously so your job completes as soon as all retriable addresses have been resolved.
SMTP Verification vs. Other Methods
| Method | What it checks | Catch-all detection | Gmail accuracy |
|---|---|---|---|
| Syntax only | Format | No | High (but false positives) |
| DNS / MX | Domain exists | No | Medium |
| Basic SMTP | Mailbox existence | No | Low |
| BounceZero 5-Stage | All + ML + catch-all | Yes | High |
BounceZero's approach combines all methods with ML scoring for maximum accuracy across all provider types.
Frequently Asked Questions
Does SMTP verification send emails to the address being checked?
No. SMTP verification closes the connection after the RCPT TO command — before any message content is transmitted. The target mailbox owner has no way of knowing a verification occurred.
Is SMTP verification legal under GDPR?
Yes. SMTP verification is a standard technical process that does not involve sending messages or collecting personal data. It uses only publicly accessible mail server infrastructure. BounceZero processes addresses under the legitimate interest basis (GDPR Article 6(1)(f)) for deliverability verification.
Can SMTP verification detect whether a Gmail address is real?
Not directly via SMTP — Gmail returns 250 OK for all probes. BounceZero uses Gravatar lookup, breach correlation, and ML scoring trained on historical Gmail delivery data to estimate deliverability with high confidence.
What does a 550 SMTP response code mean?
A 550 response code means the mail server rejected the RCPT TO command — typically because the mailbox doesn't exist or is blocked. This is a permanent failure and the address should be removed from your list.
Try SMTP Verification Free
Verify any email address instantly with our 5-stage pipeline. No signup required for single checks.
Try Free Email Verifier