How to Make Sure an Email Address Is Valid Before You Hit Send
You send 2,000 cold emails on Monday. By Wednesday, 240 have bounced - a 12% bounce rate. Your ESP flags the domain, deliverability tanks, and the next campaign lands in spam. We've watched this happen to teams that skip verification, and it's always the same story. Email lists decay 20-30% per year, so if you want to make sure an email address is valid, you need more than a gut check. You need layered verification.
Validation vs. Verification
Validation asks "does this look like an email?" Verification asks "can this mailbox actually receive mail?" Checking for an @ sign is the most basic formatting check - it proves almost nothing. A syntactically perfect address like jane.doe@deadcompany.com passes validation every time. Only verification catches it. (If you want the deeper breakdown, see validation vs verification.)
Five Ways to Verify an Email Address
1. Syntax and Format Check
A fully RFC-compliant regex exceeds 6,000 characters. Nobody should use that in production. Use a simple pattern like /^[^\s@]+@[^\s@]+\.[^\s@]+$/ to catch obvious garbage, or let <input type="email"> handle browser-level validation for free. This layer stops the worst offenders but proves nothing about whether the mailbox exists. For tool options, compare email ID validators.
2. DNS and MX Record Lookup
MX records tell you whether a domain can receive mail at all. Run dig MX example.com in your terminal - it takes seconds and eliminates defunct companies and typo domains instantly. It won't confirm a specific mailbox exists, but it filters out domains that can't receive anything, which is a surprisingly common problem in scraped lists. If you're doing this for outbound, follow an email verification for outreach workflow.
3. SMTP Verification
This is where it gets real. The process simulates sending an email without actually delivering one:
- Look up the domain's MX records
- Open a TCP connection to the mail server on port 25
- Send HELO/EHLO, then MAIL FROM, then RCPT TO - and read the response
| Response Code | Meaning | Action |
|---|---|---|
| 250 OK | Mailbox accepted | Mark valid |
| 550 | No such user | Mark invalid |
| 450/421 | Temporary failure | Retry in 15-30 min |
Greylisting servers intentionally reject the first attempt with a 450, then accept retries. Without exponential backoff, you'll misclassify valid addresses as failures. And catch-all domains return 250 for everything - more on that below. (Related: SMTP authentication.)
4. Use a Verification Tool
Manual SMTP checks don't scale. Here's the uncomfortable truth about accuracy claims: a LaGrowthMachine test of 12 tools across 47,000 emails showed top performers hitting 99.1%. But Hunter's benchmark of 15 tools on 3,000 emails found dramatically lower numbers across the board, with Hunter itself scoring highest at 70%. The gap comes down to dataset composition, how "unknown" results are counted, and whether catch-all domains are included.
Any tool claiming 99%+ accuracy on every list is lying to you. Your results depend entirely on your list composition. A clean SaaS prospect list and a scraped e-commerce list will produce wildly different accuracy numbers from the same tool.
Layered verification - syntax, MX, SMTP, plus risk flags like catch-all, disposable, and role-based detection - is the right instinct. It's exactly what dedicated verification tools automate for you. If you're building a stack, start with cold email marketing tools and then narrow down to email checker tools.
5. Send a Confirmation Email
The gold standard for proving ownership: send a unique token link and store the address as "pending" until clicked. Essential for signup forms, completely impractical for cold outreach. You can't ask a prospect to confirm their email before you email them. For a broader framework, see email validity check.
You just read about syntax checks, MX lookups, SMTP verification, catch-all handling, and spam-trap removal. Prospeo runs all five layers automatically through a proprietary 5-step verification pipeline - so bad emails never touch your CRM. At 98% accuracy and $0.01 per email, you get cleaner data than tools charging 8x more.
Get verified emails, not bounce notifications.
Edge Cases That Trip People Up
Catch-all domains accept every recipient address, valid or not. SMTP always returns 250 OK. The detection method: test a gibberish address at the same domain. If it also returns 250, flag the domain as catch-all and treat those addresses as "unknown," not "valid." Catch-all domains are one of the biggest drivers of "unknown" results in B2B lists, and their configurations change - re-verify every 60-90 days.
Disposable and role-based emails are different problems entirely. Disposable inboxes self-destruct in as little as an hour. Suppress them. Role-based addresses like info@ and support@ deliver fine but correlate with low engagement and high spam complaints. Skip them for cold outreach. (If you need suppression lists, start with a disposable email domains list.)
The "valid-but-wrong" problem is the sneakiest one we see. john@gmaiol.com passes syntax checks and even MX lookup if someone registered that domain. Build domain-suggestion logic that catches common misspellings like swapped letters. Mine your bounce logs for recurring typo patterns - you'll be surprised how often the same mistakes show up across campaigns. For more, see invalid emails.
Mistakes That Kill Deliverability
Let's be honest: most deliverability problems aren't mysterious. They're predictable.
Verify-and-forget. After four weeks, roughly 2% of a verified list goes invalid. People change jobs, companies shut down, IT teams decommission mailboxes. Re-verify before every major send. (More on decay benchmarks: B2B contact data decay.)
Treating catch-all as valid. It's unknown. Segment it accordingly and send to those addresses at lower volume with careful monitoring.
Ignoring soft bounces. If the same address soft-bounces across 3-5 consecutive sends, treat it as a hard bounce and remove it. Your ESP won't always do this automatically. If you're troubleshooting, start with hard bounce.
The thresholds that matter: under 2% bounce rate is healthy, over 5% is critical. Gmail's spam complaint threshold sits at just 0.3%. B2B/SaaS lists typically run 0.5-1.5% bounces; e-commerce runs 1.5-3%. For a full playbook, use an email deliverability checklist.
Email Verification Tools Compared
| Tool | Cost / 10k | Tested Accuracy | Best For |
|---|---|---|---|
| Prospeo | $100 / 10k (~$0.01/email) | 98% | B2B prospecting + auto-verify |
| Clearout | $40 | 98.4% | Budget bulk verification |
| NeverBounce | $80 | 99.1% | High-accuracy bulk cleaning |
| ZeroBounce | $80 | 96.5% | Deliverability suite |
| Bouncer | $49 | 97.8% | Mid-range bulk verification |
Accuracy numbers come from the LaGrowthMachine benchmark. The tool that wins on a clean test dataset won't necessarily win on your messy CRM export. Pick based on how you work. If you need verification baked into prospecting so bad emails never reach your CRM, that's a different tool than a standalone list cleaner. (If you want more options, see AI email verification.)
In our experience, the freshness gap matters more than a percentage point on a benchmark. Prospeo runs a 5-step verification pipeline with catch-all handling, spam-trap removal, and honeypot filtering on a 7-day data refresh cycle, compared to the 6-week industry average. For teams running outbound at scale, stale data is the silent killer - a "verified" email from six weeks ago might already be dead.
If you're only doing occasional list cleaning and don't need a full prospecting platform, Clearout or Bouncer will get the job done at a lower price point. Skip ZeroBounce if you don't need their full deliverability toolkit - you're paying for features you won't use.
Stale data is the silent killer this article warns about. While most providers refresh every 6 weeks, Prospeo refreshes every 7 days - with catch-all detection, honeypot filtering, and spam-trap removal built in. That's why teams using Prospeo keep bounce rates under 4% while tripling pipeline output.
Stop re-verifying lists that were stale the day you bought them.
FAQ
How accurate are free email verification tools?
Free single-check tools typically score 60-85% accuracy and lack catch-all handling, spam-trap detection, and risk filtering. For anything over 100 emails, use a paid service - verification costs fractions of a cent per address and the ROI is immediate when you factor in domain reputation.
How often should I re-verify my email list?
Re-verify every 60-90 days. Lists decay 20-30% per year, and roughly 2% of a freshly verified list goes invalid within four weeks. Always run a fresh check before large sends to keep bounces under 2%.
What's an acceptable bounce rate?
Under 2% is healthy, under 1% is excellent, and over 5% is critical - ISPs will throttle or block your domain. Gmail's spam complaint threshold is just 0.3%. If you're consistently above 2%, your list hygiene has a gap that needs immediate attention.
Can SMTP verification catch every invalid address?
No. SMTP verification fails on catch-all domains, which return 250 OK for any address, and greylisting servers, which reject first attempts by design. That's why layered verification - syntax, MX, SMTP, plus catch-all detection and disposable-email filtering - is the only reliable approach.
