SMTP verification connects to a recipient mail server and asks if a mailbox exists — without sending an actual email. This guide explains the handshake, response codes, catch-all detection, and the limitations of pure SMTP verification.
SMTP verification is the process of connecting to a recipient mail server via the Simple Mail Transfer Protocol and sending a RCPT TO command to determine whether a specific mailbox exists — without delivering a message.
No email is sent. The connection closes after the RCPT TO response. The server cannot distinguish this from a legitimate sending client at this stage.
250
550
551
421
452
530/534
A catch-all server is configured to accept all incoming messages regardless of whether the specific mailbox exists. When you send RCPT TO, it responds 250 for every address — even ones that do not exist. SMTP alone cannot determine individual mailbox existence on these servers.
Browser oracle: For Gmail and Outlook specifically, BounceZero uses browser-based checks against password recovery and account existence flows — achieving definitive verdicts without sending email.
ML scoring: For other catch-all domains, BounceZero scores 40+ signals (domain age, MX provider, sender history patterns, social profile presence) and returns likely_valid or likely_invalid with a confidence percentage.
Return 250 for all addresses. Cannot confirm individual mailbox existence via SMTP alone.
Some servers block all RCPT TO verification. Gmail and Outlook do not reveal mailbox status.
Server temporarily rejects with 451 on first attempt. Requires retry after 5–15 min.
Servers throttle too-fast RCPT TO sequences. Verification must be paced to avoid IP blocks.
SMTP only tells you if a mailbox exists — not if it is a spam trap, role address, or disposable.
If the mail server is temporarily down, result is unknown rather than invalid.
This is why comprehensive verification tools combine SMTP with DNS intelligence, browser oracles, ML scoring, spam trap databases, and social signal checks. SMTP is stage 3 of 5 in BounceZero — not the entire pipeline.
SMTP verification connects to a recipient mail server via the Simple Mail Transfer Protocol and issues a RCPT TO command to determine whether a specific mailbox exists — without delivering any message. The server responds with 250 (exists) or 550 (does not exist).
A catch-all server is configured to accept all incoming messages regardless of whether the specific mailbox exists. SMTP verification cannot determine individual mailbox existence on catch-all domains — tools use ML scoring and browser oracles to compensate.
No. Gmail and Outlook do not reveal mailbox existence via SMTP. BounceZero uses browser-based oracle verification (checking account existence flows) to achieve definitive results for these providers.
550 means the mailbox does not exist or was permanently rejected. Sending to a 550 address will result in a hard bounce. Remove these addresses from your list immediately.
SMTP verification is legal in most jurisdictions. It queries the publicly exposed SMTP interface of mail servers in the same way a legitimate mail transfer agent would. No message is delivered; no personal data is accessed beyond what the server publicly exposes.
5-stage pipeline including browser oracles for Gmail and Outlook. 100 free verifications.
Start FreeDeep-dive guides on how email verification and inbox placement work
How the 5-stage pipeline checks a mailbox without sending email
Why domains accept everything and how ML classifies deliverability
Temp addresses, how to detect them, and why they matter
Hard vs soft bounces, SMTP codes, and how to fix them
Get from 5-15% to under 0.5% in 6 steps
Authentication, list hygiene, IP warmup, ISP monitoring
Follow BounceZero