What Is Email Verification?
Email verification is the process of confirming that an email address is correctly formatted, points to a domain that can receive mail, and belongs to a mailbox that actually exists — without sending an email to find out. It is not the same thing as a regex check. A regex check only confirms that a string looks like an email address (name@domain.tld); it says nothing about whether that domain accepts mail or that mailbox is real.
Real verification goes further: it resolves DNS and mail-exchange (MX) records for the domain, opens a live SMTP connection to the receiving mail server, and asks whether the specific mailbox exists — the same conversation your own mail server would have before delivering a message, just without actually sending one. SendSure runs this through a 27-stage engine that layers cheap, instant checks (syntax, DNS, disposable-domain lookups) ahead of expensive ones (live SMTP, external signal checks, AI resolution) — so the free signals do most of the work and the costly stages only run when they're actually needed.
The output isn't a single yes/no. It's a status (valid, invalid, risky, accept-all, disposable, greylisted, or unknown), a confidence score, and a reason — enough to decide what to do with every address, not just the easy ones. For a deeper walkthrough with worked examples, see our full explainer on how email verification works.
What Email Verification Actually Checks: Inside the 27-Stage Engine
Every address SendSure checks moves through a cost-optimized waterfall: free, instant checks run first and can resolve a result immediately; only inconclusive addresses reach the expensive stages. Grouped by what they're actually testing, the 27 stages break down into five layers.
1. Syntax and Structural Checks
Before anything touches the network, SendSure validates the address against RFC 5322 syntax, flags likely typos (e.g. "gmial.com"), detects role-based inboxes (info@, support@), no-reply addresses, sub-addressing tags (+newsletter), and extracts a probable first/last name from the local part. All free, all instant — this alone filters out a meaningful share of bad addresses before any DNS lookup runs.
2. Domain and MX Record Validation
Next, SendSure resolves the domain's DNS and MX records to confirm there's a mail server to even deliver to — an address on a domain with no MX record is invalid, full stop. It also checks SPF and DMARC records and detects the provider type (Google Workspace, Microsoft 365, or self-hosted), which shapes how the SMTP stage behaves next. Disposable domains are caught here too, against a static list of 123,000+ known providers plus real-time fingerprinting for new burner domains that haven't been listed yet.
3. Live SMTP Mailbox Verification
This is the stage most "email checkers" skip entirely. SendSure opens a real SMTP handshake with the receiving mail server and asks it directly whether the specific mailbox exists — without delivering a message. Handshakes run through load-balanced VPS infrastructure to avoid the rate-limiting and IP-reputation issues that trip up single-server verifiers. The server's response determines VALID, INVALID, or GREYLISTED (a temporary delay that clears on retry).
4. Catch-All and Unknown Handling
Some domains are configured as catch-all (accept-all) — the SMTP handshake says "yes" to every address, real or not, which makes the mailbox check above inconclusive on its own. This is the single biggest source of "unknown" results industry-wide, and it's the exact problem SendSure's AI catch-all resolver is built to solve — covered in detail below.
5. Risk and Quality Scoring
The final stages score every address 0-100 for risk (spam-trap patterns, suspicious structure, poor domain reputation) and 1-10 for overall quality, in the style of the scoring buyers already expect from ZeroBounce-class tools. Combined with the status and reason code, this is what turns a raw SMTP response into an actual send/don't-send decision.
How SendSure Resolves the "Unknown" Results Other Verifiers Give Up On
Here's the part of email verification most providers quietly skip: on a catch-all domain, the SMTP handshake accepts every address — real or fake — with the same response. That means the single most reliable check in the entire waterfall goes silent on exactly the domains where getting it right matters most (custom business domains, the bulk of a B2B list). Most verifiers respond by shrugging: they return "unknown" or "accept-all" and leave you to decide what to do with a third of your list.
SendSure doesn't stop there. When the SMTP handshake is inconclusive, the address moves into an AI catch-all resolver that cross-references a database of 54,000+ real first names against the address's local part (does "jennifer.walsh@" match a plausible real name pattern, or does it look generated?), then fans out to independent, free-to-check external signals: a Gravatar profile match (88% confidence a real person owns the address), a GitHub account tied to the email (85% confidence), and — for cases that still need it — a paid Have I Been Pwned breach-database lookup (82% confidence) as a last resort. Historical engagement data (has this address opened or clicked anything before?) feeds into the same decision.
No single signal is treated as proof on its own — they're combined into a confidence score, and SendSure only reports a resolved status when the evidence actually supports it. That's the GOD Rule behind every result: state what you actually know, and don't round an inconclusive signal up to look more confident than it is.
"SendSure resolves what others give up on."
Verification-only competitors are, by design, weakest exactly here — high unknown rates on catch-all domains are the industry's blind spot, not SendSure's. Read more on how catch-all detection works or dig into the mechanics of SMTP verification itself.
Email Verification Statuses, Explained
Every address SendSure checks resolves to one of seven statuses. Each one carries a specific, honest customer-facing message — never a vague "error."
Email verified and deliverable
Confirmed by a live SMTP handshake, engagement history, or a definitive external signal (Gravatar, GitHub).
Mailbox does not exist
The mail server rejected the address outright, or DNS/MX lookups found no route to deliver.
Domain accepts all emails — delivery likely
The domain is catch-all: it says "yes" to every address. This is where the AI resolver adds a real answer.
Potential delivery issues detected
Spam-trap patterns, poor domain reputation, or other signals that make sending inadvisable.
Unable to verify email
SMTP was inconclusive and no external signal resolved it — the honest result when nothing else is certain.
Temporary email service detected
Matched against a static list of 123,000+ disposable domains, plus real-time MX fingerprinting for new burner services.
Temporarily unable to verify
The receiving server delayed the SMTP response as an anti-spam tactic. Retry — this usually resolves.
Why Email Verification Matters for Deliverability
Every email you send to a dead address counts against your bounce rate. Cross roughly 2-5% and inbox providers start treating your domain as a risk; cross 5% and you're looking at blacklisting and campaigns landing in spam for everyone, including subscribers who were engaged. Unverified lists — scraped, purchased, or just aged — routinely carry 10-20% bad addresses. Verifying before you send removes that liability before it touches your sender reputation, not after.
This compounds. A cleaner list means a lower bounce rate, which protects the sending reputation your other campaigns rely on — including ones sent to a completely different list. It also makes your engagement metrics honest: open and click rates calculated against real inboxes tell you something; calculated against 15% dead weight, they don't.
API, Bulk, or Form Widget: How to Verify
Same 27-stage engine, three entry points depending on when you need the result.
Real-Time API
Verify one address per request, in under 3 seconds, as part of your signup or lead-capture flow.
See the API docsBulk Upload
Upload a CSV of any size and get every address checked and scored — 30,000+ emails per minute.
Verify a listForm Widget
Drop a lightweight embed into any signup form to catch typos and fake addresses before they submit.
Add to your formGetting Started
Every new account starts with 10 free credits — enough to run a handful of addresses through the full 27-stage engine, catch-all resolver included, before you decide whether it's worth trusting with a real list. From there, verify a single address through the API, an entire CSV through bulk upload, or embed the form widget directly on a signup page.
Frequently Asked Questions
It checks whether an address is correctly formatted, whether its domain can receive mail, and whether the specific mailbox exists — confirmed with a live SMTP connection, not a guess. SendSure runs this through a 27-stage engine that also flags disposable, role-based, and risky addresses before it ever touches the network.