First, find out whether a gateway sits in front of the domain. Look up its MX record in the MX lookup tool. Mimecast-hosted domains point at mimecast.com hosts, and Proofpoint-hosted domains point at pphosted.com or ppe-hosted.com. When you see one of those names, the server you reach on port 25 is the gateway.
A gateway answers the RCPT TO step in one of three ways. If it checks recipients against the company directory, it rejects unknown users with a 550 and you get a clean verdict. If it accepts every recipient and sorts mail out later, the domain behaves as catch-all. And if it reads your probe as suspicious, it throttles, delays or refuses the connection.
ZapBounce reports each case as what it is. A directory-backed gateway gives valid or invalid, with the literal smtp_code and the mx_host we spoke to in the row. An accept-everything gateway returns catch_all after one probe to a random address at the same domain. A refused or throttled probe comes back unknown, with a reason such as probe_blocked or throttled, and costs you nothing.
Gateway domains turn up often on B2B lists, since larger companies buy them. About 28% of addresses in a 10,000-email B2B benchmark sat on catch-all domains. Treat those rows as their own send: mail them in a small batch after your valid rows, and stop if bounces pass the 2% level Amazon SES recommends.
Re-check unknown rows later instead of guessing. A gateway that throttled a burst of probes can answer a slower second pass. Our page on why the unknown rate runs high covers the other causes, and ZapBounce pricing shows the rule: $5 for 1,000 checks, and unknowns are never billed.
Related questions
How do I know if a domain uses Mimecast?
Look up the domain's MX record. Mimecast customers point MX at mimecast.com hosts, so the host name gives it away. The mx_host field in every ZapBounce result shows the same thing row by row.
Why do Proofpoint domains come back catch-all?
Some Proofpoint setups accept every recipient at the SMTP step and filter afterwards. A random made-up address then gets a 250 as well, which is what catch-all means. Setups that validate recipients against a directory return plain valid or invalid.
Are unknown results from gateway domains billed?
No. ZapBounce never bills an unknown, whatever the cause: a throttled probe, a refused connection or a timeout. You pay one credit only for valid, invalid or catch_all.
Should I email catch-all addresses at gateway-protected companies?
Yes, with care. Send them in a small batch after your valid rows and watch the bounces. Stop the batch if bounces pass 2%, the level Amazon SES recommends.