Verifying Gmail, Outlook and other big mailbox providers

Free-mail addresses make up most consumer lists, so how a verifier treats Gmail, Outlook, Yahoo and iCloud matters. They do not all behave the same way.

Gmail: a direct answer

During the SMTP conversation Gmail's servers say whether a mailbox exists. A missing address is refused with a 550 5.1.1 ("no such user") reply, and a real one is accepted with 250. The verifier stops before any message is transmitted, so nothing is sent to the person.

Two cautions apply. Google throttles hosts that make many checks quickly, so a responsible verifier spaces them out. And an accepted address only means the mailbox exists, not that the person reads it.

Hotmail, Outlook and Live: also a direct answer

Microsoft's consumer service rejects unknown addresses too, with a 550 5.5.0 "mailbox unavailable" reply, and accepts real ones. It does limit how many recipients you can try in one connection, so a verifier should check one address per connection and not rely on a second "random address" test there.

Company domains on Microsoft 365 or Google Workspace: it depends on the tenant

A business domain hosted by Microsoft or Google is configured by its owner. Many reject unknown users straight away (Microsoft 365 uses 550 5.4.1 Recipient address rejected). Others are set to accept everything and sort mail afterwards, which makes a 250 meaningless. A verifier handles this by also trying a random address at that domain: if that is accepted too, the domain is catch-all and the result is "risky", not "valid" (catch-all domains).

Yahoo, iCloud and Proton: cautious

These providers commonly throttle, delay or refuse connections from hosts they don't know, and their replies are inconsistent. Mailsure does not probe them by default: a wrong "invalid" or a false "valid" is worse than saying the mailbox is unconfirmed.

What you can know for any address

Even without a mailbox answer you can still tell:

• the address is well formed and not a typo of the provider (typos)
• the domain has working mail servers
• it isn't a disposable address or a role account
• the provider is identified, which helps segmentation

For addresses typed by a real person into a form, the most common problem is a typo, and those are caught without any probing.

How to handle the unconfirmed ones

1. Trust the engagement signal. Opens and clicks tell you more than a probe could.
2. Use confirmation where it matters. A double opt-in link proves the mailbox exists (the trade-off).
3. Suppress on bounce. If one does bounce, it is a hard fact; remove it.
4. Read the mailbox field. "Valid" with mailbox: not_checked means the address is well formed and the domain accepts mail, not that the mailbox exists.

Related: how SMTP mailbox verification works.