How to Verify Email Addresses (The 2026 Operator Guide)

If you send cold email, your list rots faster than you think. Up to 40% of a typical purchased or scraped lead list is already dead — invalid mailboxes, role accounts, disposables, and catch-all domains that quietly burn your sender reputation.

This guide walks through how email verification actually works, what to do about risky and catch-all addresses, and the exact steps to clean a CSV before your next send.

1. The three layers of email verification

Real verification is not one check — it is a pipeline.

Syntax check. Is name@domain.com a structurally valid email? This catches typos like gmaill.com and missing @ signs. It is free and instant, but it tells you almost nothing about whether the mailbox exists.

Domain & MX check. Does the domain resolve? Does it have a mail server? A domain with no MX record cannot receive email — period. This filters out abandoned domains.

SMTP / mailbox check. This is the real test. The verifier opens an SMTP conversation with the receiving mail server and asks, "does this mailbox accept mail?" — without actually delivering one. The server answers with one of:

• 250 OK → mailbox exists
• 550 user unknown → invalid
• 252 will try / accept-all → ambiguous (catch-all domain)
• timeout / greylist → try again later

A real-time SMTP check beats a stale database lookup every time. Databases are guesses from months ago; SMTP is the answer right now.

2. The catch-all problem

Catch-all domains accept any address you throw at them — random-string@theircompany.com returns the same 250 OK as ceo@theircompany.com. The SMTP check cannot tell you whether the mailbox is real.

This is where most verifiers stop and flag the address as "risky" or "unknown" — and where most operators get burned. You either:

• Send anyway and risk bounces, complaints, and a tanked sender reputation, or
• Cut everything and throw away half your list, including legitimate prospects.

A proper verifier runs a second pass on risky addresses — additional heuristics, alternate SMTP probes, and pattern checks against known role accounts — and resolves as many as possible to a confident Valid or Invalid. The rest stay flagged, and you decide.

3. Step-by-step: verify a CSV before your next send

Here is the exact flow we recommend.

1. Export your list as a CSV with the email column clearly named (email, Email, or email_address).
2. Upload it to a verification tool. A good one accepts up to 10,000 rows per file and returns a labelled CSV (Valid / Invalid / Risky / Role / Disposable) in minutes.
3. Filter out Invalid and Disposable — these will always bounce or burn your domain.
4. Run a Verify+ rescue pass on the Risky bucket. This is the catch-all rescue described above. You will typically recover 30–60% of risky addresses as confident sends.
5. Decide on Role accounts (info@, support@, sales@). Some workflows want them, most don't.
6. Send only the Valid bucket through your sending tool.

A 5,000-row list usually finishes verification in under 10 minutes and removes 30–40% of dead weight.

4. What "accuracy" really means

Vendors love to claim "99% accuracy." Read the fine print. Most are measuring against their own internal benchmarks on clean test data — not your scraped lead list at 2am on a Tuesday.

The metric that matters: how confident is each result? A verifier that returns "Valid" or "Invalid" on 70% of your list with high confidence — and refunds the credit on the other 30% because it isn't sure — is more honest, and more useful, than one that confidently mislabels 15% of your list.

That is the standard we hold ourselves to. Uncertain answers are auto-refunded; you only pay for verdicts we're sure of.

5. Common mistakes to avoid

• Verifying once and reusing the list for months. Mailboxes go stale. Re-verify before each major send.
• Trusting "free" verifiers that only do syntax. They will mark ceo@madeup-domain-12345.com as valid because the syntax is fine.
• Ignoring catch-all domains entirely. That is a huge chunk of B2B email. Use a rescue pass, don't blanket-cut.
• Sending to the Risky bucket without resolving it. The fastest way to land in spam.

Ready to clean your list?

Upload a CSV, get an inbox-ready list in minutes. No subscription, no setup. You only pay for confident results.

Try the OS Email Verifier →