SMTP Verification Explained: How We Check Mailbox Existence

Syntax checks and MX record lookups tell you whether an email address is plausible. SMTP verification goes further: it asks the actual mail server whether a specific mailbox exists, without sending a single email.

The SMTP Handshake

SMTP (Simple Mail Transfer Protocol) is the protocol mail servers use to communicate. Every time someone sends you an email, their mail server opens an SMTP conversation with yours. ValidoAPI uses this same protocol to ask "does this mailbox exist?" — a technique known as an SMTP probe or callback verification.

Full SMTP probe sequence:
TCP connect → port 25 of the MX server
← 220 mx.example.com ESMTP ready
→ EHLO probe.validoapi.com
← 250-mx.example.com Hello
→ MAIL FROM: <probe@validoapi.com>
← 250 OK
→ RCPT TO: <target@example.com>
← 250 OK          ← exists!
   or
← 550 5.1.1 The email account does not exist
→ QUIT

Limitations: The Catch-All Problem

Some mail servers are configured as "catch-all" — they accept email for any address, even non-existent ones, to avoid giving away which accounts exist. When we probe a catch-all server, it responds 250 OK to everything, making it impossible to determine whether the specific mailbox exists. ValidoAPI marks these emails as catch_all so you know the SMTP check was inconclusive.

Why Not Just Send a Test Email?

Sending test emails to verify addresses is a terrible idea. It damages your sender reputation with ISPs (who see unexplained, high-volume sends to cold addresses), can be flagged as spam activity, and violates CAN-SPAM and GDPR in some interpretations. SMTP probing achieves the same result without these risks because no message body is ever transmitted.

Accuracy Numbers

For non-catch-all domains, SMTP verification has a false-positive rate below 0.5% in our testing. The main source of error is temporary 4xx responses from servers that are experiencing issues — ValidoAPI retries these automatically before returning a result.