How I verify B2B emails without sending a single message

Most "verified" B2B lead lists still bounce on the first send. Here is the actual technique behind a real deliverability check — without ever sending an email — and why honest confidence labels beat a fake "100% verified" badge.

The core trick: talk to the mail server, then hang up

Every domain that receives email publishes MX records. To check whether a mailbox exists, you:

1. Resolve the domain's MX hosts (DNS).
2. Open an SMTP connection to the top MX host on port 25.
3. Walk the handshake: HELO -> MAIL FROM -> RCPT TO for the target address.
4. Read the server's response code to RCPT TO, then QUIT before DATA.

You never send a message. You just ask "would you accept mail for this mailbox?" and listen — the same no-send probe the commercial verifiers use.

with smtplib.SMTP(timeout=6) as smtp:
    smtp.connect(mx_host, 25)
    smtp.helo("checker.local")
    smtp.mail("probe@checker.local")    code, _ = smtp.rcpt(address)   # the answer lives here
    smtp.quit()                    # QUIT before DATA: nothing is sent

Why "valid" is never fully ironclad

• Catch-all domains accept every local part, so a 250 on RCPT TO does not prove that exact mailbox exists. Detect it by probing a random bogus address on the same domain — if that is accepted too, it is catch-all.
• Gmail / Outlook / M365 often return an ambiguous accept up front and only reject at final delivery. "The server did not reject it" is not "guaranteed deliverable."
• Greylisting returns a temporary 4xx — not a no, just "try again later."

The honest move: tiers, not a badge

Instead of stamping everything "100% verified," label each address by how confident the check really is:

• valid — MX exists, RCPT accepted, not catch-all
• catch_all — accepts anything, cannot confirm this exact mailbox
• published — the address is published on the company's own website (a real human contact) even when SMTP stays inconclusive
• unknown — the server blocked or greylisted the probe

A buyer who sees the label knows exactly what they are getting. That honesty outperforms an inflated number that bounces.

One speed lesson

If a domain's mail server never answers the probe at all, do not retry five guessed patterns against it — each one eats a full timeout for nothing. Detect "unreachable domain" once and bail. That single change cut a run from minutes to seconds on niches whose mail hosts refuse port-25 probes.

I build data and automation tools, and I just opened a Fiverr gig doing exactly this — verified B2B lead lists with honest confidence labels, filtered by industry and location. If dead-inbox lists annoy you as much as they annoy me: it is right here.