How SMTP mailbox verification works (and its limits)

The most direct way to check an address is to ask the server that hosts it. This works because the protocol that delivers email, SMTP, lets a sender announce a message before sending it, and the server answers whether it would accept it for each recipient.

The conversation

A verifier connects to the domain's mail server (found through MX records) and runs the start of a normal delivery, then stops:

S: 220 mail.example.com ready
C: EHLO verifier.example.net
S: 250 hello
C: MAIL FROM:<check@verifier.example.net>
S: 250 ok
C: RCPT TO:<maria@example.com>
S: 250 ok          <- the mailbox is accepted
C: QUIT

The key moment is the reply to RCPT TO. A 250 means the server would accept mail for that mailbox. A 550 with a message such as "user unknown" means it would not. The verifier never reaches the DATA command, so no email is ever sent.

What the replies mean

• 250: accepted. The mailbox probably exists.
• 550 / 5.1.1: the mailbox doesn't exist. Invalid.
• 4xx: temporary refusal, often greylisting. The server wants you to try again later.
• Other 5xx with wording about policy or blocklists: the server is refusing us, which says nothing about the address.

Why it isn't always conclusive

1. Catch-all servers accept everything, so a 250 proves nothing (explained here).
2. Some servers (some Microsoft 365 and Google Workspace company domains) accept every address, so a 250 proves little unless you test for it (how).
3. Greylisting delays unknown senders, so the first attempt may be inconclusive.
4. Blocking. Servers may refuse connections from addresses with poor reputations, or from networks that don't allow outbound port 25.
5. Rate limits. Too many checks too fast get you blocked, so a responsible verifier spaces out its requests to each server.

What a good verifier does about it

• Reports "unknown" instead of guessing when the answer isn't clear.
• Separates what the server said from what we conclude, so you can see the reason.
• Doesn't probe providers known to be unreliable.
• Uses a clearly identified, properly configured sending host with matching reverse DNS, as mail servers expect.

What it means for you

A mailbox check lifts a result from "the domain accepts mail" to "this mailbox exists", which is a meaningful step up in confidence. Just remember that unknown, risky and catch_all are honest answers, and the right response is to treat those addresses as a separate segment, not to assume they are good or bad.