Picture the alternative. A server that answered honestly would let anyone try john@yahoo.com, john1@yahoo.com, john2@yahoo.com and record which ones came back accepted. In an afternoon you would have a list of live accounts worth selling. Yahoo closed that door by refusing to distinguish.
Two response codes carry the refusal. Sometimes it is a plain 250, which looks like acceptance. Sometimes it is a 252, which says outright that the server cannot verify the recipient but will take the message anyway. The second is more honest and equally unhelpful.
What happens next is asynchronous. The message is accepted, Yahoo works out that nobody is there, and a bounce arrives hours later. The failure has simply moved from the handshake to a report you read the following morning.
Yahoo is not alone in this posture, only the most consistent. Gmail and Microsoft 365 block verification probes from cloud infrastructure entirely, and Microsoft additionally throttles repeated connections. Between them, a very large share of consumer addresses is out of reach of the protocol.
The honest handling is to say so. A verifier that returns valid for a Yahoo address has told you what the server said, not what is true, and folding those results into a valid count is how a 99% figure gets built.
A newsletter list that's 30% Yahoo
Say you run a consumer newsletter with 20,000 subscribers, and 6,000 of them use Yahoo or AOL addresses. No verifier can give a mailbox-level verdict on those 6,000. Your coverage on this list tops out near 70% before a single probe goes out, and that's true with any vendor. With us most of those 6,000 come back catch-all, and each one costs a credit, because the label is a finding: it tells you a valid on those rows from anybody is a guess. The ones Yahoo won't answer at all come back unknown and cost nothing.
So stop looking to verification for that group and look at your own records. Your email platform already knows which of those addresses opened or clicked in the last 90 days. Keep those. It also knows which ones hard-bounced, and those should already be suppressed.
What's left is the quiet middle: Yahoo addresses that never bounced and never opened. For that group, age is your best signal. Anything that joined more than a year ago and has shown no sign of life belongs in your sunset rule, whatever its domain.
More of your list is Yahoo than the domain names suggest
Counting addresses that end in yahoo.com undercounts the problem. The same mail system sits behind ymail.com and rocketmail.com, and behind AOL's domains. It also hosts mail for some large internet providers. Addresses at att.net, sbcglobal.net and bellsouth.net are handled by Yahoo, and verizon.net mailboxes moved to AOL years ago.
You can check any domain yourself with an MX lookup. If the mail servers it returns end in yahoodns.net, the domain will behave the way Yahoo does, whatever name is on the address.
This matters most for lists built in the United States, where those provider addresses are common among older subscribers. If you sell to that group, expect a larger unresolved share than a vendor's sample report shows. It also explains why two lists of the same size can come back with very different coverage. One might lean on Gmail while the other leans on provider mailboxes opened in 2004.
Related questions
Can any service verify a Yahoo address?
Not at mailbox level over SMTP. The server refuses to distinguish real recipients from invented ones, which is a deliberate design choice rather than a fault.
Does that mean Yahoo addresses are bad?
No. Most are perfectly real. The check could not run, which is a different thing from a negative result.
Should I mail unresolved Yahoo addresses?
Send them as a separate batch so any bounces stay out of your main campaign, then use the outcome to decide.
Do Gmail and Outlook behave the same way?
Differently. Gmail and M365 block probes from cloud addresses outright, and Microsoft throttles repeated connections. The effect on coverage is similar.