You’ve got an email address. Maybe it came from a signup form, a business card, a spreadsheet someone forwarded you three reorganizations ago. And you need to know one thing before you hit send: is it real?
Not “does it look real.” Real. As in, will an actual message land in an actual inbox, or will it bounce back in an hour with a red flag next to your sender reputation.
There are seven ways to check, ranging from “glance at it for ten seconds” to “run it through a tool that actually pings the mail server.” Some take five seconds. Some take five minutes and a terminal window. None of them require you to actually send the email and hope for the best — which, if you’ve ever done that with a list of any size, you already know is a bad way to find out.
Here’s how to verify an email address using each one, starting with the free stuff you can do right now, and working up to the method that actually combines everything.
1. Check the syntax first
This is the fastest filter and it catches more typos than you’d think. A valid email address needs a specific shape, and most of the “bad” addresses in any list break one of these rules in a way you can spot in a couple of seconds:
One “@” symbol, no more, no less
A local part before the @ (no spaces, no illegal characters like , or ;)
A domain after the @ with at least one dot (like gmail.com, not just gmail)
No trailing spaces or obvious typos — “gmial.com” instead of “gmail.com” is the single most common mistake in manually typed lists
Here’s why this step matters more than it looks like it should: humans typing addresses by hand — at a trade show table, into a paper sign-up sheet later transcribed into a spreadsheet, dictated over the phone — introduce a predictable set of errors. Swapped letters. Dropped characters. A “yahooo.com” instead of “yahoo.com.” None of these are hard to catch once you know to look, but scanning a list of 500 by eye for these patterns takes real time and real attention, and attention runs out well before row 500 does.
This step won’t tell you if the mailbox exists. It just tells you the address isn’t obviously broken. Think of it as spell-check, not fact-check — a first filter, not a final answer. Every email verification tool worth using runs this check first, before spending any heavier computational effort on the next layers, because there’s no point pinging a mail server about an address that’s already malformed.
2. Look up the domain’s MX records
Every domain that can receive email publishes MX (Mail Exchange) records — basically a signpost telling the internet which server handles mail for that domain. If a domain has no MX record, no email is getting through, period, no matter how correctly the address is spelled.
This catches a specific and surprisingly common failure mode: a company’s domain expired and nobody renewed it. A startup rebranded and moved off their old domain, but old business cards and email signatures are still floating around with the dead address. Someone types “gnail.com” instead of “gmail.com” — a domain that might resolve as a website in some cases but has no mail server behind it at all.
You can check this yourself with a free MX lookup tool (search “MX lookup” and any of the top results will do), or from a terminal:
nslookup -type=MX gmail.com
If that returns a list of mail servers, the domain can receive email. If it returns nothing, you’ve found a dead end without even needing to check the specific address. This is a genuinely useful skill to have even outside verification — if you’re troubleshooting why your own outgoing mail isn’t landing anywhere, checking your own domain’s MX records is one of the first diagnostic steps, and it’s the same lookup either direction.
One nuance worth knowing: a domain can have a working website and still have no MX record at all, or a broken one. Web hosting and email hosting are separate services under the hood, even though they often live at the same domain, and it’s entirely possible for a company to have let their email hosting lapse while their website stays up. That’s exactly the kind of thing a quick MX check surfaces that a glance at the domain in a browser never would.
3. Do a manual SMTP handshake
This is the closest you can get to “asking the mail server directly” without actually sending anything. You connect to the domain’s mail server on port 25 and step through the SMTP conversation — HELO, MAIL FROM, RCPT TO — and stop right before the DATA command that would actually send a message.
The server’s response to RCPT TO tells you a lot: a 250 means the mailbox exists and will accept mail, a 550 usually means it won’t. It’s a real technique, and we cover it command-by-command in our SMTP verification walkthrough, but it’s slow to do manually, and a growing number of mail servers (Gmail among them) don’t give a clean answer this way anymore. They accept everything at this stage and sort out real vs. fake later, which defeats the point for those specific domains.
Here’s roughly what that conversation looks like if you were doing it by hand in a terminal:
You connect and say HELO, identifying your own mail server
You state MAIL FROM, the sender address you’re claiming to send from
You state RCPT TO, asking the receiving server whether it’ll accept mail for a specific address
The server responds with a numeric code — accept, reject, or something ambiguous in between
You disconnect before ever sending DATA, the actual message body
This works, and it’s a real, legitimate way to check a mailbox without sending anything to it. But doing it by hand doesn’t scale past a handful of addresses, and it doesn’t handle the retry logic needed when a server temporarily rejects a check (a behavior called greylisting, common enough that a one-shot manual attempt will sometimes misread a real address as invalid). That’s part of why automated tools exist — not because the underlying technique is complicated, but because doing it correctly, at scale, with proper retry handling, is tedious to build by hand every time.
4. Send a test email and watch for a bounce
The blunt-force method. Send something, wait, see what comes back. A hard bounce (permanent failure, mailbox doesn’t exist) tells you the address is dead. A soft bounce (mailbox full, server temporarily down) tells you nothing conclusive — try again later.
The problem: this method burns your sender reputation. Every bounce is a data point mailbox providers use to decide whether your future emails go to the inbox or the spam folder. Do this at scale and you’re training Gmail and Outlook to distrust you. Fine for one address, when you genuinely need an answer and have no better option. Reckless for a list of 500, where the cumulative bounce count starts actively damaging your ability to reach the addresses that were real all along.
There’s a second, quieter cost to this method too: time. A hard bounce can come back in seconds. A soft bounce might sit for hours before you get a definitive answer, or might never resolve into a clear signal at all if the receiving server just goes quiet. If you’re checking one address before an important one-off email, waiting is tolerable. If you’re trying to clean a list before a campaign launch on a deadline, it isn’t.
5. Use your email client’s autocomplete or contacts
If you’ve emailed someone before, your email client already knows their address works — that’s why it autocompletes. This isn’t a verification method so much as a memory check, but it’s worth mentioning because people sometimes re-verify addresses they’ve already confirmed through actual correspondence. If Gmail or Outlook is suggesting the address as you type, you likely don’t need to check it again.
This method has an obvious limit: it only works for people you’ve already exchanged mail with. It’s useless for a fresh list, a new lead, or an address you’ve never contacted. But it’s worth knowing as a free first pass on any list where some contacts overlap with people already in your address book — no reason to spend a verification check on someone your inbox has already confirmed is reachable.
6. Check for catch-all and disposable domains
Some domains accept mail to any address at that domain — a “catch-all” — which means even a bounce test won’t tell you if a specific mailbox is real. Others are disposable domains (Mailinator, Guerrilla Mail, and similar) created specifically for temporary, throwaway signups.
Neither of these show up from a syntax check or MX lookup. A catch-all domain has a perfectly valid MX record and will happily accept a test send to any address, real mailbox or not — which means methods 1 through 4 above will all report it as “fine,” even when the specific mailbox never existed. You need a tool that specifically flags catch-all behavior and checks the domain against known disposable-email lists. We go deeper on exactly what these look like, and why they’re such a common blind spot, in our guide to spotting fake, disposable, and catch-all emails.
It’s worth understanding why catch-all domains exist in the first place, because it’s not usually a sign of anything suspicious. Some companies configure their mail server this way intentionally, so a typo in a colleague’s name (jon@ instead of john@) doesn’t bounce and get lost — it still lands somewhere, even if it’s the wrong inbox. Others simply never changed the default configuration when they set up their mail server. Either way, a catch-all domain doesn’t mean the specific address you’re checking is fake. It means the check genuinely can’t tell you, one way or the other, and that’s a different and more honest answer than a false “valid.”
7. Run it through a real email verification tool
This is the method that actually combines everything above — syntax, MX records, SMTP-level mailbox checking, and catch-all/disposable detection — without you doing each step by hand or risking your sender reputation on a live test send.
That’s what sfemailverifier.com does. Paste an address into the checker on the homepage and it runs through all six prior checks in a few seconds, no signup required. If you’ve got more than one address — a spreadsheet, a signup list, an old CRM export — the bulk email verifier does the same thing across an entire file at once, and the developer API exists for anyone who wants this running automatically inside a signup form or backend pipeline rather than checked manually.
The reason this consolidated approach matters isn’t just convenience, though it is more convenient. It’s that each layer catches a different kind of problem, and skipping any one of them leaves a real gap. Syntax alone misses dead domains. MX alone misses individual dead mailboxes on a domain with working mail service. SMTP alone gets fooled by catch-all domains. Only running all four together gets you close to a complete picture, and doing that manually for anything beyond a handful of addresses just isn’t realistic on a normal workday.
A quick example
Say you’re a freelance designer named Priya, and a lead magnet on your site collects emails for a free portfolio-review PDF. You check your list after a month and see 340 signups. Some are obviously fake — “asdf@asdf.com,” a few Mailinator addresses from people who didn’t want to give a real one. Others look fine on the surface but bounce the moment you send the PDF, which is what actually happens when the domain has no MX record or the mailbox never existed.
If Priya had run that list through a verifier before her first send, she’d have caught the dead addresses ahead of time — instead of after her sender reputation took the hit. Here’s what that would have actually looked like in practice: uploading her 340-row export to a bulk verifier, getting back a status for each row within a couple of minutes, and sorting her send list into “definitely send,” “probably fine,” and “skip” before a single email went out. Instead, she found out the hard way — a bounce report three days later, a dip in her open rate on the next campaign too, because the bounces from the first send had already started nudging her sender reputation down.
That second-order effect is the part people underestimate. It’s not just that the 30-odd bad addresses in her list wasted her time. It’s that mailing them at all made her next email, to her genuinely good subscribers, slightly less likely to land in the primary inbox. One unchecked list doesn’t just cost you once.
Is this actually worth the trouble?
Maybe you’re thinking: for one address, why not just send it and see? Fair. For a single, one-off email, that’s a reasonable call, and nobody’s suggesting you run a full verification pipeline before emailing your cousin.
But the moment you’re sending to a list — a newsletter, a cold outreach batch, a signup export — the math changes. Mailbox providers track your bounce rate. Cross a threshold (generally cited around 2-5%, depending on the provider) and your deliverability drops for everyone on the list, not just the invalid addresses. Verifying first isn’t extra caution. It’s cheaper than the alternative, and the “cheaper” part isn’t abstract — it’s the difference between a five-minute upload and days of a dampened sender reputation you can’t fully undo just by being careful going forward.
There’s also a compounding version of this worth naming directly. If you send a list unchecked once, take the reputation hit, and then send an unchecked list again next month, the damage doesn’t reset to zero in between. Sender reputation with major providers builds and decays gradually, which means repeated unchecked sends can leave you in a chronically worse position than a single clean habit would. Verifying isn’t a one-time fix for one bad list. It’s closer to basic hygiene that protects every list after it, too.
What “good enough” actually looks like in practice
Not every list needs the same level of scrutiny, and it’s worth being honest about that rather than treating every single address as if it demands the full seven-step process. A quick mental framework:
One address, one important email — a syntax glance and maybe an MX lookup is plenty. You don’t need a bulk tool for this.
A handful of addresses from a form you trust — spot-check the ones that look odd, and don’t sweat the rest.
Any list over roughly 50-100 addresses, or any list you didn’t personally collect — this is where a real verification pass earns its keep, because manual spot-checking simply can’t catch catch-all domains or dead mailboxes reliably at that scale, no matter how carefully you look.
Anything going into a paid ad, cold outreach, or a platform migration — verify first, no exceptions, because the downside of skipping it (flagged sending domain, wasted ad spend on unreachable leads, a bad first impression on a new platform) is disproportionately larger than the cost of checking.
Try it before your next send
Paste an email into the free checker on the sfemailverifier.com homepage — no signup, results in a few seconds. If you’ve got a whole list to get through, the bulk verifier handles a CSV upload the same way, just at scale.
