How SMTP Mailbox Verification Works: MX Lookup, RCPT TO & 550 Codes
A technical walkthrough of how mail servers verify whether a domain and mailbox can receive email using DNS MX records and SMTP response codes.
Before an email ever lands in an inbox, two servers negotiate over the Simple Mail Transfer Protocol (SMTP). Understanding how that handshake works explains how email verification tools check deliverability—and why some answers are definitive while others are intentionally ambiguous.
Step 1: DNS MX Resolution
First, the sending server queries DNS for the recipient domain's MX records (for example, gmail.com or any domain you test in our Disposable Email Domain Checker). If the domain has no MX (and no fallback A record), mail cannot be delivered at all.
Step 2: The SMTP Envelope Handshake
When an MX server is reachable on port 25, a verification check walks up to the RCPT TO command without transmitting message data:
220 mx.example.net ESMTP Ready
EHLO verifier.example.org
250-mx.example.net Hello
MAIL FROM:<[email protected]>
250 2.1.0 OK
RCPT TO:<[email protected]>
550 5.1.1 The email account that you tried to reach does not exist.
QUITReading Common SMTP Status Codes
- `250 2.1.5 OK`: The server accepted the recipient address for delivery (either the specific mailbox exists or the domain operates as a catch-all).
- `450 / 451` (Temporary Deferral / Greylisting): The server asks the sender to retry in a few minutes—common anti-spam defense on unfamiliar IPs.
- `550 5.1.1` (Permanent Failure): The mailbox does not exist, or policy blocks delivery.
Why SMTP Verification Isn't Always 100% Definitive
Modern mail servers protect user privacy against directory harvesting (VRFY / RCPT probing) in several ways:
- Catch-All Domains: Accept every syntactically valid local-part at the SMTP stage (
250 OK), including disposable email platforms that route dynamic addresses on the fly. - Accept-Then-Bounce / Silent Drop: Corporate gateways like Proofpoint or Mimecast often return
250 OKduring SMTP and filter invalid recipients internally. - Greylisting & Rate Limits: Aggressive probing triggers temporary
4xxblocks.
To inspect any domain's live MX routing and disposable status safely without sending raw SMTP probes, use our Disposable Email Domain Checker.
Related Guides
A Separate Email Address for Every Website: Privacy & Leak Tracking
Why giving every online service its own unique email address stops cross-site tracking, pinpoints data breaches immediately, and keeps spam out of your inbox.
Punycode (xn--) Email Domains Explained: IDN Routing & Homograph Safety
Learn what xn-- Punycode email domains are, how Internationalized Domain Names (IDNs) route through DNS, and how to spot look-alike homograph phishing domains.
Subdomain Email Addresses Explained: How DNS Routing Works
What subdomain email addresses (like [email protected]) are, how independent subdomain MX records work, and how to isolate temporary mail on your own subdomain.
Try Email Generator Free
Generate a temporary email address instantly and receive incoming verification emails through an easy-to-use online inbox. No sign-up required.