The whole check is a short conversation with the receiving mail server. Your tool says EHLO and gets a 250. Next comes MAIL FROM with a sender address, and another 250. Then RCPT TO names the address you want to check, and that reply is the verdict. QUIT closes the line before any message content exists.
Reading the reply is the skill. A 250 means the server accepts the recipient, and a 550 means no such user. A 4xx code is temporary, often greylisting that clears on a retry. A 252 means the server will take mail but won't confirm the mailbox, a stance built to stop address harvesting. Our post on reading bounce codes covers the rest.
You can run this by hand with telnet, and two things trip most people up. Most residential ISPs and many cloud providers block outbound port 25, so the connection never opens. Gmail and Microsoft 365 also block SMTP probes from cloud IPs, so a script on a rented server often gets refused.
A clean handshake still can't settle every address. A catch-all domain accepts any recipient, so a proper check also probes a made-up address at the same domain. When that gets a 250 too, you've learned the domain accepts everything, and the honest result is catch-all.
ZapBounce runs this check with its own SMTP engine on port 25. Try one address in the free email verifier, or send a list through the API or a bulk upload. You get 100 free checks a month with no card, then $5 for 1,000. Every result carries the literal smtp_code, so you can audit how we read the reply.
Related questions
Can I verify an email address with telnet?
Yes, if your network allows outbound port 25. Connect to the domain's MX host, send EHLO, MAIL FROM and RCPT TO, read the reply code, then send QUIT. Most residential ISPs block port 25, so the connection often fails from a home line.
Will the person know I checked their email address?
No. The check stops before the DATA step, so nothing arrives in their inbox. There is no message for them to open, read or report.
Is pinging an email address the same as verifying it?
Yes, "pinging" an email usually means this same SMTP handshake. It asks the server about one recipient and ends before any message goes out. A network ping to the domain says nothing about a mailbox.
Why does my manual check return 250 for a fake address?
The domain is catch-all: its server accepts every recipient at the SMTP step. Try a random address such as xk7q2 at the same domain. When that also gets a 250, no SMTP check can confirm one mailbox there.