The Best Way to Verify Cold Email Addresses
The best way to verify cold email addresses is a layered pipeline: strip syntax errors and disposable domains, confirm the domain has live MX records, run an SMTP-level check through a reputable third-party verifier, and then treat the results as three buckets. Send to valid, discard invalid, and route catch-all/unknown to isolated sending infrastructure where a bounce can't damage your best domains. No single tool returns a clean yes/no on modern B2B lists. The goal isn't a perfect verdict on every address. It's keeping hard bounces under ~2% on the mailboxes that matter while losing as few real prospects as possible.
That last part is where most guides stop being useful. They recommend a tool and move on. But verification accuracy has degraded sharply as Microsoft 365 changed how it responds to probes, as security gateways swallowed millions of B2B domains, and as catch-all configuration became the default at most mid-market companies. Below is how verification actually works, why your tool disagrees with the next one, and how to build a process that survives those limitations.
How does email verification actually work?
Every real verifier runs the same core sequence. Understanding it tells you exactly where it breaks.
- Syntax check. Does the address parse against RFC 5322? Catches typos, stray spaces, missing TLDs. Free and instant.
- Domain and MX lookup. Does the domain resolve, and does it publish MX records? A domain with no MX cannot receive mail. This eliminates dead companies and misspelled domains (
gmial.com) before you spend a credit. - Disposable and role detection. Is it a throwaway domain, or a shared alias like
info@,sales@,admin@? Both are technically deliverable and both are bad for cold outreach. - SMTP probe. The verifier connects to the domain's MX host on port 25 and starts a conversation it never finishes.
That last step looks roughly like this:
EHLO verifier.example.comMAIL FROM: <>, a null sender, so nothing is actually deliveredRCPT TO: <[email protected]>- Server replies
250 OK(accepted) or550 5.1.1 User unknown(rejected) QUIT, and the verifier disconnects before sendingDATA
The entire verification industry rests on that RCPT TO response. Which is a problem, because receiving servers have spent the last several years making that response deliberately less informative.
Why do two verification tools give different answers for the same address?
Because they're interpreting ambiguous SMTP responses differently, and each has its own house rules for what counts as "valid."
- Greylisting. The server returns a temporary
4xx, meaning "try again later," to deter bulk senders. One vendor retries and eventually gets a clean answer. Another marks it unknown immediately. - Rate limiting and tarpitting. Google and others slow down or drop connections from IPs issuing many
RCPT TOcommands. A vendor with a large, well-distributed IP pool gets answers where a smaller one times out. - Catch-all configuration. The domain accepts every recipient, so every address returns
250. One vendor labels this accept-all, another labels it valid, and you've just been sold a false positive. - Cached or inferred results. Some vendors return a cached verdict from weeks ago, or infer validity from a pattern database rather than probing at all. Fast and cheap, but it's a guess wearing a verdict's clothing.
The practical consequence: a "valid" from a verifier is a claim, not a fact. Treat vendor labels as probabilistic, and grade vendors on the two errors that actually cost you: false valid (a bounce you paid for with domain reputation) and false invalid (a real prospect you deleted).
What is a catch-all domain, and how should you handle it?
A catch-all (or accept-all) domain is configured to accept mail for every address at that domain, including ones that don't exist, and sort it out internally afterward. RCPT TO always returns 250, so SMTP verification carries zero information there.
Catch-alls are extremely common in B2B, and they're the single largest source of unverifiable addresses in a typical prospect list. Anything sitting behind a security gateway (Proofpoint, Mimecast, Barracuda, Cisco) is effectively catch-all by design. You can spot these from the MX record before you spend a verification credit.
Your options, in order of how much they're worth:
- Corroborate the pattern. If you have three confirmed addresses at
target.comand all three arefirst.last@, then[email protected]is a reasonable bet. If the confirmed pattern isflast@, yourfirst.last@guess is probably wrong. - Corroborate the person. A second independent source showing the same address, such as a press release, a public repo commit, a conference listing, or a data provider that cites a source, moves it from guess to likely.
- Segment and send. Put catch-alls on separate mailboxes and separate sending domains from your verified core. If the segment bounces at 12%, the damage is contained to infrastructure you were willing to risk.
- Drop them. Valid if your list is large and your domains are precious. Understand that you are throwing away a large slice of the mid-market.
What you should not do is let catch-alls sit unlabeled in your main sequence. That's how a 1.5% bounce rate quietly becomes 9%.
Why is Microsoft 365 harder to verify than Google Workspace?
Exchange Online's behavior depends on tenant configuration, and Microsoft has progressively made its RCPT TO responses less useful to outside probes.
Tenants using Directory Based Edge Blocking will reject unknown recipients at the edge, which is verifiable. Tenants with a connector or gateway in front, or with DBEB disabled, accept everything and sort it later, indistinguishable from catch-all. On top of that, Microsoft rate-limits and returns generic responses to connections that look like directory probing, so the same address can return different verdicts on different attempts from different IPs.
Google Workspace remains the more reliably verifiable of the two, but Google aggressively throttles verification traffic. Expect a higher unknown rate on Microsoft-hosted domains than on Google-hosted ones, and don't interpret that gap as your vendor being bad at its job. Check the MX record and you'll usually see why.
This is also why knowing which provider hosts your own mailboxes matters when you interpret bounces later. Google Workspace and Microsoft 365 write different NDR text for the same underlying failure.
How do you test whether your verification tool is actually accurate?
This is the step almost nobody does, and it's the one that separates teams who know their bounce rate from teams who are surprised by it. Build a known-truth seed list and score every vendor against it.
- Collect 60–100 addresses where you already know the answer. Include: addresses on domains you control (Google-hosted and Microsoft-hosted); addresses you've deliberately deleted from those domains, so you know they're dead; a catch-all domain you configure yourself; role addresses; and real addresses of people who have replied to you in the last 30 days, which are confirmed live.
- Add known-dead real-world addresses. Former employees at companies where you've since had a hard bounce, with the NDR saved as proof.
- Shuffle it and run it through each vendor blind.
- Score four numbers: false-valid rate, false-invalid rate, unknown/risky percentage, and cost per 1,000.
Weight false valids most heavily. A false invalid costs you one prospect. A false valid costs you a bounce, and bounces compound against the sending reputation of the mailbox and domain that generated them. Re-run this test every six months. Vendor accuracy drifts as receiving servers change behavior, and the vendor that won last year may not win now.
A reasonable production setup after testing: one primary vendor for the full list, one second-opinion vendor run only against the primary's risky/unknown bucket. Paying twice for 10% of your list is cheap. Paying twice for all of it is not.
Should you verify from your own sending IPs or mailboxes?
No. Issuing large volumes of RCPT TO commands from your sending infrastructure looks exactly like a directory harvest attack, because mechanically it is one. Receiving servers and blocklist operators watch for that pattern, and the outcome is a flagged IP or a blocked sending domain, the precise thing verification was supposed to prevent.
Keep the two functions separate. Verification is a third-party vendor's job, on their IPs, with their reputation at stake. Your sending infrastructure's job is to send, and to give you clean feedback when something fails.
That feedback loop is where owning your mailboxes rather than renting seats on shared infrastructure pays off. With full admin access to your own Google Workspace and Microsoft 365 tenants, which is what Inboxlogy provisions at $2.80 per mailbox per month with 100% ownership and admin rights, you can open the actual bounce NDRs at the mailbox level, export them, read the real SMTP status codes, and feed genuine failures back into your data. On reseller infrastructure where you only see a summary in a dashboard, you're working from someone else's interpretation of what happened.
Cheap per-mailbox pricing also makes segmentation practical. A pool of mailboxes on throwaway domains dedicated to catch-all and risky segments costs very little, and it keeps your proven domains out of the blast radius. (Warmup itself runs in your connected sending tool, whether Instantly, Smartlead, or ReachInbox, against whichever mailboxes you point it at.)
How fresh does verification need to be?
A verification result is a snapshot with a shelf life. People change jobs, companies migrate providers, and mailboxes get deprovisioned. An address verified in March and sent in September was verified against a company that may no longer employ that person.
Practical rules:
- Verify in batches, timed to the send. Not the whole list at once at the start of a quarter. Verify each batch in the week before it enters a sequence.
- Re-verify anything older than 30 days before it sends. Verification credits cost fractions of a cent at volume. A burned domain costs weeks.
- Re-verify multi-step sequences at the start, not at each step. If step 1 delivered, steps 2–5 will almost certainly deliver. Bounces cluster on first contact.
- De-duplicate before verifying, not after. Dedupe on the address, and also check for the same person appearing under two domains after an acquisition. You'll pay twice and potentially email them twice.
What bounce rate should you target, and how do you read bounces correctly?
Aim to keep hard bounces under 2% per mailbox, and treat anything sustained above 4–5% as a stop-and-fix signal. Most cold email platforms will flag or auto-pause sequences somewhere in that range.
But the number matters less than reading bounces correctly, and this is where a lot of otherwise careful teams corrupt their own data:
550 5.1.1/ "User unknown" / "Recipient address rejected": a genuine invalid address. Remove it, and feed it back to your data source.552/452 4.2.2/ "Mailbox full": the address is real. The person is on leave or ignoring their inbox. Suppress, don't delete.4xxtemporary failures: greylisting or throttling. Your platform should retry. Not a data problem.550with reputation or policy language: "message rejected due to sender reputation," "blocked using Spamhaus," "not permitted to relay." This is not a bad address. This is your infrastructure being rejected. If you mark these as invalid, you delete good prospects and hide the real problem.
That last distinction is the single most valuable thing in this article. A rising "bounce rate" that's actually policy rejections means your SPF/DKIM/DMARC alignment, your IP reputation, or your content is the issue, and no amount of list verification will fix it. Check the raw NDR text before you conclude your data is bad.
What can verification NOT fix?
Verification confirms that a mailbox exists. It says nothing about whether mail to it will land in the inbox, and nothing about whether you should be sending it.
- Pristine spam traps. Addresses seeded by blocklist operators that have never belonged to a person. They accept mail, so they verify as valid. The only defenses are source hygiene and never sending to scraped or purchased lists.
- Recycled traps. Abandoned addresses reactivated as traps. These often go through a period of hard-bouncing first, which is why promptly honoring hard bounces is itself trap protection.
- Authentication failures. If SPF, DKIM, and DMARC aren't correctly configured and aligned for every sending domain, verified addresses still won't see your mail. This should be automated at provisioning, not hand-edited in DNS per domain.
- Spam placement. A verified address whose mail lands in Junk is functionally a bounce that doesn't show up in your metrics.
- Phantom engagement. Security gateways at catch-all domains open and click every link to scan it. Those opens and clicks are robots. If you're optimizing subject lines on gateway-heavy segments, you're optimizing for Proofpoint.
- Consent and legality. Verification is not permission. GDPR, CAN-SPAM, PECR and equivalents govern whether you may contact someone, entirely independently of whether the address resolves.
What does a complete pre-send workflow look like?
Put together, here is the sequence worth running before any batch enters a sequence:
- 1. Normalize and dedupe. Lowercase, trim whitespace, strip Gmail dot-and-plus variants, remove duplicates across the full database, not just the batch.
- 2. Drop the obvious. Syntax failures, disposable domains, role addresses, and personal free-mail addresses if you're selling B2B.
- 3. Resolve MX and classify by provider. No MX means no mail. Tag Google, Microsoft, and security-gateway domains now. This tells you in advance how much of the batch is unverifiable.
- 4. Run the primary verifier. Full batch.
- 5. Second-opinion the risky bucket only. Escalate unknown and risky to a second vendor.
- 6. Split into three send tiers. Verified valid → primary domains and mailboxes. Catch-all with pattern corroboration → isolated domains and mailboxes. Unknown with no corroboration → hold or discard.
- 7. Send a small canary batch first. A few hundred addresses per tier. Check the bounce rate before releasing the full volume. This catches a bad data source before it costs you a domain.
- 8. Read the bounces properly. Separate invalid-address bounces from policy rejections. Feed invalids back to the data source. Investigate policy rejections as an infrastructure problem.
- 9. Suppress permanently. Hard bounces go on a global suppression list, not just out of one campaign. Re-mailing a known hard bounce is one of the fastest ways to be treated as a spammer.
Steps 6 through 8 are infrastructure decisions rather than data decisions, and they're only available to you if you control the mailboxes: separate domains for separate risk tiers, real NDR visibility, and correct authentication on every domain from the start. That's the argument for owning your sending estate rather than renting it. Verification tells you what you can't send to, but only your own infrastructure tells you the truth about what happened when you did.
FAQ
Is free email verification good enough for cold email?
Free tools generally cover syntax and MX checks, which is real but shallow filtering. They typically skip the SMTP probe, catch-all detection, and retry logic on greylisted domains, which is where the expensive errors live. At sub-cent pricing for paid verification at volume, the cost difference is trivial compared to one damaged sending domain.
Should I delete catch-all addresses or send to them?
Send to them, but only from isolated mailboxes and domains, and only where the address pattern is corroborated by confirmed addresses at the same company. Deleting all catch-alls means discarding a large share of mid-market B2B. Sending to them from your primary domains means gambling those domains on unverifiable data.
Does verifying my list improve deliverability?
It protects deliverability rather than improving it. Verification lowers hard bounces, which prevents reputation damage, but it does nothing for authentication, IP and domain reputation, sending volume ramp, or content. A perfectly verified list sent from misconfigured infrastructure still lands in spam.
How often should I re-verify a list I bought or built months ago?
Re-verify any address more than 30 days old before it sends, and verify in batches timed to each send rather than all at once upfront. B2B data decays continuously as people change roles and companies change mail providers, so the age of the verification matters as much as the quality of it.