B2B sales email verification techniques: what each check proves

How to read a result

Each address gets one of four statuses. The reason matters more than the label, so here is what to do with each.

A free-provider address such as Gmail or Outlook is marked valid but noted: in business-to-business work it often means a sole trader, and that changes the legal position in the UK (see below).

The techniques, weakest evidence first

Treat every check as a claim with a scope. Moving down the table, each check proves a little more and costs a little more to run. The last row, real sending, is the only one that settles the question.

Address rules that trip people up

• The part before the @ is case-sensitive under RFC 5321. Many providers ignore case, but the standard does not let you assume it, so this checker changes the case of the domain only.
• Limits: 64 bytes before the @, 255 for the domain, and in practice about 254 characters for the whole address.
• A plus tag (name+news@) is legal and usually delivers to the same person. Ignoring dots in the name is a Gmail habit, not a standard; never strip them for other domains.
• Addresses can contain non-Latin characters under RFC 6531, and quoted names are allowed by RFC 5322. Both are valid and both are flagged, because many systems still reject them.

What DNS answers mean

A domain check is three different answers, and treating them alike is the commonest mistake in list cleaning. Only one of them justifies deleting an address.

Mail routing follows RFC 5321, section 5.1: use the MX records if there are any; if there are none, deliver to the domain's own address. A domain that wants no mail publishes a single MX with priority 0 and a target of ".", the null MX of RFC 7505. That record, not a missing MX, is the reliable sign of a domain that takes no email.

Why this tool does not probe mailboxes

Mailbox verifiers open an SMTP conversation with the recipient's server, name the address in a RCPT command, and hang up before sending anything. The answer is weaker evidence than it looks:

• Catch-all servers accept every name at the domain, so "accepted" proves nothing about your contact.
• Some servers only check recipients after the message has been sent, then bounce it later (RFC 5321, section 3.3).
• Servers may switch off the VRFY command and must then answer 252, which means neither yes nor no (section 7.3).
• Servers may cut off a client that tries many wrong recipients, the standard defence against address harvesting (section 7.8).
• Greylisting answers a first attempt with a temporary 4xx refusal on purpose.

There is also a legal edge. The FTC lists harvesting addresses and generating them by dictionary attack as aggravated CAN-SPAM violations. Guessing name patterns at a company and probing each one sits close to that line. For reference, these are the replies a probe or a real send can get:

A 550 on its own is ambiguous, because servers use it for policy blocks as well as unknown users. The enhanced status code from RFC 3463 that follows it tells the two apart.

What the recipient's SPF record tells you

Checking a single address also shows the domain's SPF record. It describes how the company protects its own outgoing mail, not whether your contact exists. A domain with a tidy SPF record is usually run by someone who pays attention to email; a domain with none is often a small business or a parked name. Treat it as context, never as a reason to include or drop an address.

Rules for your own sending domain

Clean lists keep bounces and complaints down, but the big mailbox providers judge the sender first. Their current rules, as published:

One-click unsubscribe is defined in RFC 8058. Google's sender FAQ lists requests not honoured within 48 hours as a failure. Google also advises against buying lists or mailing people who did not sign up, which is worth remembering on any cold-outreach plan.

Bounces after you send

Sending is the final verification step. A permanent failure (5xx) on a bad mailbox means suppress the address at once and never retry it. A temporary failure (4xx) means retry, and suppress only after repeated failures across several sends. A policy refusal is a problem with your setup or reputation, so fix that instead of deleting contacts.

Deliverable is not the same as allowed

A checker answers "will this reach an inbox?". Whether you may send is a separate question, answered by where the recipient is and how you got the address. A short map, not legal advice:

United States: CAN-SPAM

The FTC guide is explicit that business-to-business commercial email is covered. Headers must be accurate, subject lines honest, the message identified as an ad, and a valid postal address included. Opt-outs must work for at least 30 days after sending and be honoured within 10 business days, and opted-out addresses may not be sold or passed on. You remain responsible for anyone who sends on your behalf. Each violating email can cost up to $53,088; the FTC adjusts the figure for inflation, so check the current amount.

United Kingdom: PECR and UK GDPR

PECR splits recipients by subscriber type. For corporate subscribers (companies, LLPs, Scottish partnerships and some government bodies) the marketing email consent rule does not apply, but you must say who you are and give a working opt-out address. Sole traders and some partnerships count as individuals, so you need consent or the soft opt-in. The ICO says that if you cannot tell which type a contact is, treat them as an individual. That is why this checker notes free-provider addresses.

UK GDPR applies when an address identifies a person, such as j.smith@company. A generic info@ address with no named person is not personal data. For named contacts the usual basis is legitimate interests, which needs the three-part test; if you got the data from a third party or a public source you must tell the person within a month; and their objection to direct marketing is absolute, so keep them on a suppression list rather than deleting them. The ICO's email marketing pages note that they are under review after the Data (Use and Access) Act.

Six claims to stop repeating

No MX record means the domain cannot receive mail.

Without MX records, senders deliver to the domain’s own address record (RFC 5321, section 5.1). A domain that refuses mail says so with a null MX (RFC 7505).

Gmail and Yahoo penalise a 2% bounce rate.

Neither publishes a bounce threshold. Their published limits are on spam complaints, authentication and unsubscribe handling.

Keep spam complaints under 0.30%.

Google’s target is below 0.10%. 0.30% is the level never to reach.

A 250 reply proves the mailbox exists.

Catch-all servers accept every recipient, and many servers only check after the message is sent.

Verification removes spam traps.

Trap addresses are not published, so no checker can find them. Traps are avoided by collecting addresses with consent.

A verified address may be emailed.

Deliverable says nothing about whether you are allowed to send. That depends on the law where the recipient is and how you got the address.

Questions

Sources and data

• RFC 5321, Simple Mail Transfer Protocol
• RFC 5322, Internet Message Format (section 3.4.1, addresses)
• RFC 7505, A "Null MX" No Service Resource Record
• RFC 3463, Enhanced Mail System Status Codes
• RFC 7208, Sender Policy Framework (SPF)
• RFC 6531, SMTP Extension for Internationalized Email
• RFC 2142, Mailbox Names for Common Services, Roles and Functions
• Google, Email sender guidelines
• Google, Email sender guidelines FAQ
• Yahoo, Sender best practices
• Microsoft, Outlook requirements for high-volume senders (April 2025)
• FTC, CAN-SPAM Act: A Compliance Guide for Business
• ICO, Business-to-business marketing
• ICO, Electronic mail marketing
• ICO, Legitimate interests
• disposable-email-domains (CC0 1.0)

Disposable domains: 9,185 entries from the https://github.com/disposable-email-domains/disposable-email-domains project, dedicated to the public domain under CC0 1.0, pinned to commit 0655284 of 2026-09-27. Role names follow RFC 2142 plus common shared inboxes. Typo suggestions use our own edit-distance matching against major providers. Think a domain is listed by mistake? Tell us.