In short. You verify an address in three steps: syntax (is it written correctly), whether the domain has mail servers (MX records in DNS), and the server's answer for the specific mailbox (an SMTP RCPT TO check). The first two give a reliable result in seconds; the third often lies — mail servers deliberately answer "ok" to any address so as not to hand spammers a list of live mailboxes. So a 100% "does it exist" check without actually sending a message doesn't exist — and you shouldn't chase one: aggressive checking easily lands your server on a blacklist. Below is how to check safely and when it's even needed.
Why verify an address
Sending to non-existent addresses hurts sender reputation. Every message into the void comes back as a hard bounce, and mailbox providers (Gmail, Outlook, Yandex) read a high bounce rate as a sign of spam — and start sending even your good mail to the spam folder. So cleaning the list before a campaign protects deliverability; it isn't fussiness.
Verifying an address isn't about "catching" a user — it's about saving your own reputation: one percent of dead addresses in a campaign costs more than it looks, dragging the rest of your mail into spam.
Three levels of checking
Level 1. Syntax
The cheapest filter: is there an @, are the characters allowed, is the domain non-empty. It catches typos like ivan@@mail and ivan mail.com. But a syntactically valid address isn't a real one: nobody@example.com is written correctly, yet the mailbox doesn't exist.
Level 2. The domain's MX records
If a domain has no MX records (mail-server addresses), it can't receive mail, and any address on it is dead on arrival. This is a fast, reliable way to reject whole domains. Check MX via a DNS lookup or in the terminal:
dig +short MX example.com
# empty = the domain accepts no mail, every address on it is undeliverable
# an answer (e.g. "10 mx.example.net") = a mail server existsHow MX records work is in the mail-setup guide.
Level 3. The SMTP check (and why it lies)
In theory you can connect to the domain's mail server and ask about a specific mailbox with RCPT TO: the server answers 250 OK (accepted) or 550 (no such user). In practice this is the least reliable step:
- Catch-all. Many domains accept mail for any address and say "ok" even to a non-existent mailbox — you can't learn the truth about a specific address.
- Anti-spam defense. Gmail, Yandex, Outlook deliberately answer the same for a live and a dead address, to avoid leaking a list to spammers.
- Greylisting. A server may temporarily reject an unknown checker (
4xx), and you get "unclear" instead of an answer. - Risk to you. Bulk SMTP probes from one IP look like a spammer's reconnaissance — your address lands on a blacklist fast, and your real mail stops arriving.
The only 100% check that an address exists is to send it a message and get (or not get) a rejection. Everything else is a probability estimate, not a fact.
How to check safely
- Validate on input. Check syntax + MX presence right in the signup/registration form — it rejects typos and dead domains with no risk at all.
- Double opt-in. The gold standard: after signup you send a message with a confirmation link. Only real, consenting addresses enter the list — existence is confirmed and it's legally clean.
- Watch your bounces. Process returns and immediately remove hard-bounce addresses from the list — that's the real "existence check," by delivery fact. More in the bounce-handling article.
- Don't hammer someone's server with SMTP probes. To assess a domain (does it accept mail at all, are SPF/DKIM/DMARC fine) use an email-setup check — it inspects the domain's configuration rather than pounding a specific mailbox.
Frequently asked questions
There are online "check if the email exists" services. Trust them?
They do exactly the same three steps — syntax, MX, SMTP probe — and hit the same limits: catch-all and anti-spam make the answer unreliable for large providers. As a quick filter for typos and dead domains they're useful, but a "green check" on a Gmail address doesn't prove it's live.
How do I check whether a user made up an address at signup?
Only with confirmation: an activation-link email (double opt-in). Until the user clicks the link, the address is unconfirmed. This beats any SMTP probe and also blocks bots and other people's addresses.
Why did the message send, when the "check" said the address didn't exist?
Most likely greylisting or a temporary server hiccup at probe time — the address is live, but on a one-off request the server answered evasively. One more reason not to trust an instant SMTP check.
Checklist to remember
- Three levels: syntax → the domain's MX records → SMTP probe; the first two are reliable.
- No MX on a domain — every address on it is dead, a fast rejection.
- The SMTP probe lies: catch-all, anti-spam, and greylisting make the answer unreliable.
- The only 100% check is a real send; build the list via double opt-in.
- Don't probe others' servers — you'll blacklist yourself.