"Email verification" sounds simple. In practice it's a negotiation with thousands of mail server personalities — Google throttling your IP, Microsoft returning policy blocks, Yahoo requiring Verifly fallback, and catch-all servers saying yes to everything.
Here's exactly what happens when you click Verify on Email Validator.
Step 1: Syntax & Sanitization
Before any network call:
- Strip invisible Unicode (zero-width spaces, BOM)
- Validate RFC 5322 format
- Normalize Gmail dots (
john.doe@gmail.com→ dedup key) - Check disposable domain blocklist (10,000+ domains)
- Check spam trap patterns
Fails here → invalid or disposable — no SMTP needed, no credit charged.
Step 2: DNS MX Lookup
We query DNS for MX records. No MX → invalid (domain can't receive mail).
MX priority determines which server we probe first. Multiple MX hosts get tried with IP rotation across our GRE/Hetzner pools.
Step 3: SMTP Conversation
Typical probe sequence:
>>> EHLO verify.email-validaton.com
<<< 250 OK
>>> MAIL FROM:<verify@email-validaton.com>
<<< 250 OK
>>> RCPT TO:<target@company.com>
<<< 250 OK ← or 550 / 552 / 450
>>> RCPT TO:<randomfake@company.com> ← catch-all test
<<< 550 ← good: server rejects fakes
Catch-all detection: if the fake address also gets 250, domain is catch-all — individual mailbox unconfirmed.
Step 4: Response Classification
Our classifier maps SMTP text to statuses:
| Response pattern | Status |
|---|---|
| 250 on real, 550 on fake | valid |
| 250 on both | catch_all |
| 550 user unknown | invalid |
| 552 mailbox full | over_quota |
| 450 / greylist hints | risky (retry) |
| Policy block, inconclusive | risky or unknown |
Step 5: Provider-Specific Handling
Some providers can't be verified reliably via raw SMTP:
- Yahoo / AOL → Verifly API fallback
- Mail.ru → Verifly with Mail.ru-specific mapping
- Google 452 sender throttling → may return over_quota with retry guidance
We never mark valid unless confidence is high.
Step 6: Caching & Credits
Definitive results (valid, invalid, catch_all, over_quota, disposable) cache per user — repeat checks within TTL skip SMTP.
Billable: valid, invalid, over_quota
Free: catch_all, risky, unknown, disposable, error
Internal gate failures (rate_limited) map to unknown before you see them — customers never get charged for inconclusive infrastructure states.
Why This Matters for Your List
Understanding SMTP verification explains why:
- Catch-all isn't "valid" — the protocol literally can't prove the inbox
- Over quota isn't invalid — the mailbox exists
- Risky needs re-verification — greylisting is temporary
- Same engine powers Single Check, bulk, API, and Company Finder
See it live — Try Single Check →
Related: Catch-All Explained · Statuses Guide