Email list validation is the process of checking every address in your list before sending - verifying syntax, DNS records, SMTP response, and domain reputation to classify each address as valid, invalid, risky, or unknown. This guide covers how the process works, what different validation results mean, when to run validation, and what to do with the results from each classification bucket.
Validates the email format against RFC 5321 rules: correct use of @ symbol, no illegal characters, valid local-part length (max 64 chars), valid domain format. This catches typos like missing @ or double dots. Fast - sub-millisecond, no network call needed.
Queries the domain’s DNS for MX records - the mail exchange servers that receive email for that domain. If no MX record exists, the domain cannot receive email (guaranteed bounce). Also checks whether the domain itself resolves (A record). Catches domains that expired or were never set up for email.
Connects to the receiving mail server and issues a RCPT TO command asking if the mailbox exists, without actually sending any email. The server responds with a 250 (exists), 550 (does not exist), or another code. This is the most informative check - and the most complex, because mail servers vary in how they respond.
Applies additional signals: Is this a known disposable email provider? Is the domain on a blocklist? Is it a known role-based address (info@, admin@)? Does the domain pattern match known catch-all configurations? These secondary checks refine the raw SMTP result into an actionable classification.
| Classification | What it means | What to do |
|---|---|---|
| VALID | SMTP confirmed the mailbox exists and will accept email | Send - this address is deliverable |
| INVALID | SMTP confirmed the mailbox does not exist (permanent 5xx) | Suppress immediately - guaranteed hard bounce |
| CATCH-ALL | Domain accepts all RCPT TO commands - can’t confirm individual mailbox | Use catch-all score to decide: send high-confidence, suppress low-confidence |
| DISPOSABLE | Temporary email address from a service like Mailinator, Guerrilla Mail, etc. | Suppress for marketing; review for transactional (user may have done this intentionally) |
| UNKNOWN | SMTP timed out, rate-limited, or returned ambiguous response | Retry after 30 min; if still unknown, suppress from cold email, OK for warm lists |
| RISKY | Role-based address (info@, sales@), or pattern suggests shared inbox | Suppress from cold outreach - low reply rate + higher complaint risk |
If you haven’t verified the list in 60+ days, validate it before sending. A 10,000-address list verified 6 months ago could have 1,200-1,800 stale addresses. One bad campaign can damage your sender reputation for months.
Cold email lists built from Apollo, LinkedIn scrapes, or Clay enrichment should be verified monthly. These lists combine freshly scraped + enriched data from many sources - quality varies significantly.
Whenever you combine lists from different sources, validate the merged list. Different sources have different quality standards and age, so the merged list’s health is unpredictable.
If your bounce rate exceeds 2% on a warm email list or 5% on cold, validate immediately. A spike signals either list decay or a quality issue in a new data source.
Catch-all domains (also called accept-all domains) are the hardest part of email list validation. These are domains configured to accept all incoming mail at the server level, regardless of whether a specific mailbox exists. This means when a validator sends RCPT TO [email protected], the server replies 250 OK - even if no such mailbox exists.
In B2B email, catch-all domains are extremely common. Most corporate domains are catch-all because companies route undeliverable mail to a catch-all inbox for monitoring. In some industries (finance, legal, enterprise SaaS), 30-50% of valid B2B domains are catch-all.
⚠️ Do not bulk-suppress all catch-all results. If you do, you’ll remove 30-50% of your valid B2B contacts. Instead, use a validator with catch-all domain scoring - BounceZero estimates whether a specific catch-all address is likely real based on domain history, pattern analysis, and secondary signals from historical SMTP responses.
These addresses passed SMTP confirmation. Import them directly into your sequencer. No action needed.
Add to a global suppression list in your ESP. Do not re-add them from a different data source without re-validating. A 550 RCPT TO failure is a permanent rejection.
Run catch-all addresses through a secondary scoring pass. Send the high-confidence ones (BounceZero score 70+). Suppress low-confidence. Never bulk-suppress the entire bucket.
For cold outreach, suppress entirely - disposable addresses signal a low-intent contact. For transactional flows (signup confirmation, password reset), the user may have intentionally used a temp email; decide based on your product’s verification requirements.
Re-run unknown results after 30-60 minutes (SMTP timeouts are often temporary). If still unknown after retry, suppress from cold outreach campaigns. For warm newsletters or transactional, you can attempt to send - the worst outcome is a bounce, not a complaint.
Role-based addresses like info@, admin@, support@ are shared inboxes. They have very low individual reply rates and a higher complaint risk because multiple people monitor them. Suppress from cold outreach entirely. For newsletter opt-ins, you can keep them if the user explicitly provided the address.
| Term | Scope | Input | Use case |
|---|---|---|---|
| Email list validation | Full list cleaning pass | CSV / bulk upload | Clean a list before a campaign |
| Email verification | Single-address real-time check | One address via API | Validate at point of capture (form, import) |
| Email list hygiene | Ongoing maintenance process | Automated, scheduled | Keep list quality high over time |
| SMTP verification | One step inside validation | Part of the validation pipeline | Confirm SMTP-level mailbox existence |
Email list validation is the process of checking every email address in a list to determine whether it is deliverable, risky, or invalid before sending a campaign. A validator checks syntax, DNS/MX records, SMTP response, and domain reputation. The output is a classification for each address - typically valid, invalid, catch-all, disposable, or unknown - so you can suppress the emails that would harm your deliverability.
Validate your list before every major campaign if it hasn’t been verified in the past 60 days. For actively growing lists, validate monthly. Email addresses decay at roughly 2-3% per month for B2B lists.
Catch-all domains accept all SMTP commands, so verification can’t confirm whether a specific mailbox exists. Do not bulk-suppress catch-all results. Use a verifier with catch-all scoring - BounceZero estimates the probability a given catch-all address is real based on domain reputation and historical signals.
Upload a CSV, get classified results - valid, invalid, catch-all, disposable, unknown - with individual confidence scores. Export the clean list straight to your sequencer.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Deep-dive guides on how email verification and inbox placement work
272,446-domain census: DMARC gap, provider divide, catch-all rates
10.2M verifications: 12.3% of addresses are dead, and where they hide
826K re-verifications: only 19% of valid addresses survive 90 days
True catch-all is 1.4% - most of what looks catch-all is unprobeable providers
info@ bounces 4.5x more than personal addresses - measured, not guessed
The 3x invalid-rate gap that vanishes when you control for domain size
Explore other topics