# SMTP Verification — Email Deliverability Glossary & Technical Reference > The core technical stage of email verification where a verifier connects to the recipient domain's MX server over TCP port 25, negotiates `EHLO` / `STARTTLS`, sends `MAIL FROM` and `RCPT TO:`, and evaluates the server's 2xx, 4xx, or 5xx response before closing the session (`QUIT`) without sending a `DATA` payload. - **Author**: Alex, Co-Founder (Reviewed by MailVeri Deliverability Research Lab) - **Source**: https://mailveri.com/glossary/smtp-verification - **Glossary Index**: https://mailveri.com/glossary - **AI Reference**: https://mailveri.com/llms-full.txt --- ## What is SMTP Verification? The core technical stage of email verification where a verifier connects to the recipient domain's MX server over TCP port 25, negotiates `EHLO` / `STARTTLS`, sends `MAIL FROM` and `RCPT TO:`, and evaluates the server's 2xx, 4xx, or 5xx response before closing the session (`QUIT`) without sending a `DATA` payload. ## Why SMTP Verification Matters in Production Direct SMTP handshaking is the only non-intrusive way to verify whether a specific mailbox actually exists without sending an email to the recipient. Accurate SMTP verification must also probe whether the server is a catch-all and parse provider-specific over-quota (`452`) and disabled-account codes. ## Engineering & Sender Best Practices - Never run raw port-25 SMTP probes from your own application server or office IP—ISPs will rapidly block your IP on Spamhaus. - Use a managed verification API (MailVeri) that handles provider-specific SMTP quirks across Gmail, Microsoft 365, Yahoo, and custom MTAs. - Account for catch-all servers where `RCPT TO` returns `250 OK` for every address by testing a synthetic random local-part first. - Treat unresolved `4xx` greylisting or temporary throttling responses as `UNKNOWN` (0 credits billed) rather than guessing. Real-World Production Scenario ## Handling Provider-Specific SMTP Nuances Across Gmail, Microsoft 365 & Custom MTAs An internal engineering team tried building a DIY Python script to check `RCPT TO` on Port 25 from their AWS EC2 instance. Within 20 minutes, AWS blocked outbound Port 25, Spamhaus listed their IP on PBL/SBL, and Yahoo/Outlook returned fake `250 OK` responses to every probe. Switching to MailVeri's managed verification API ($9 per 10K) gave them accurate 7-status results without managing MTA infrastructure. Production Outcome: Achieved 99%+ verification accuracy with zero infrastructure maintenance or IP blacklisting. ## Technical Implementation & Wire Example ```http S: 220 mx.example.com ESMTP Postfix C: EHLO verifier.mailveri.com S: 250-mx.example.com S: 250 STARTTLS C: MAIL FROM:<> S: 250 2.1.0 Ok C: RCPT TO: S: 250 2.1.5 Ok C: QUIT S: 221 2.0.0 Bye ``` By terminating the SMTP session with QUIT immediately after the RCPT TO response, no email is ever delivered to the user. ## SMTP Reply Codes & Bounce Classification Reference RFC 5321 & Enhanced RFC 3463 Status Codes | SMTP Code | Bounce Classification | Server Meaning | MailVeri Status & Action | | --- | --- | --- | --- | | 250 2.1.5 | Deliverable (`2xx`) | Recipient `RCPT TO` accepted by destination MTA | `VALID` (or `CATCH_ALL` if wildcard server) | | 452 4.2.2 | Soft Bounce (Storage) | Recipient mailbox has exceeded storage quota | `FULL_INBOX` — pause sends for 30 days | | 421 / 450 4.7.1 | Soft Bounce (Transient) | Temporary greylisting or concurrent connection deferral | `UNKNOWN` (0 credits billed) | | 550 5.1.1 | Hard Bounce (`5xx`) | User unknown / mailbox does not exist on server | `INVALID` — suppress permanently | | 550 5.7.1 | Policy / Reputation Block | Rejected due to sender reputation, RBL, or DMARC failure | Check sender domain DNSBL & authentication | Primary Engineering & Deliverability Playbook ## [Understanding SMTP Verification: How Direct Mail Server Handshakes Work →](https://mailveri.com/blog/understanding-smtp-verification) Walk through the exact RFC 5321 EHLO, MAIL FROM, and RCPT TO wire protocol used to verify email addresses silently. [Read Primary Guide](https://mailveri.com/blog/understanding-smtp-verification) · [Pay-As-You-Go Verification ($9/10K, $59/100K, $299/1M)](https://mailveri.com/pricing) Related 2026 Technical Deep Dives & Benchmarks [RFC 6647 — What Is Greylisting in Email? RFC 6647 451 Deferrals & Impact on Verification →](https://mailveri.com/blog/greylisting-explained) · [API Integration — How to Verify Emails in Clay Using HTTP API: Save 80% on Enrichment Credits →](https://mailveri.com/blog/how-to-verify-clay-waterfall-enrichment-emails-http-api) ## Free Bounces & SMTP Signals Tools & Workflows [Bounce Rate Calculator — Check 2% ESP safety thresholds](https://mailveri.com/tools/bounce-rate-calculator) · [Free Email Verifier — Test live SMTP & MX status](https://mailveri.com/tools/email-checker) · [MX & Gateway Lookup — Detect Proofpoint / Mimecast / EOP](https://mailveri.com/tools/mx-lookup) Connected Workflows: [Instantly →](https://mailveri.com/integrations/instantly) · [Smartlead →](https://mailveri.com/integrations/smartlead) · [Amazon SES →](https://mailveri.com/integrations/aws-ses) · [2026 Catch-All Benchmark →](https://mailveri.com/resources/b2b-email-decay-catch-all-benchmark) ## Frequently Asked Questions About SMTP Verification ### Why does SMTP verification stop before the `DATA` command? In the RFC 5321 state machine, the receiving server validates the recipient address immediately upon receiving `RCPT TO:
` and replies with `250 OK`, `4xx`, or `5xx`. Sending `QUIT` right after `RCPT TO` confirms mailbox existence without transmitting a message body or notifying the recipient. ### Why can't I run raw Port 25 SMTP verification from my own cloud server or laptop? Cloud providers (AWS, GCP, Azure, DigitalOcean) block outbound TCP port 25 by default, and residential/datacenter IPs lacking matching rDNS (PTR), HELO alignment, and established sender reputation are immediately blocked or fed false replies by ISP anti-harvesting filters. ### How does SMTP verification distinguish a real `250 OK` from a catch-all `250 OK`? When a target domain accepts a probe for a non-existent random address with `250 OK`, a standard `RCPT TO` check on your real lead will also return `250 OK`. MailVeri detects this wildcard behavior and returns `CATCH_ALL` rather than falsely labeling the address `VALID`. ## Closely Related Terms [Email Verification](https://mailveri.com/glossary/email-verification) · [MX Records](https://mailveri.com/glossary/mx-records) · [Catch-All Domain](https://mailveri.com/glossary/catch-all) · [Bounce](https://mailveri.com/glossary/bounce) · [Email Validation](https://mailveri.com/glossary/email-validation)