Home

Notes

Arguments rather than announcements. Mostly about the gap between what this industry measures and what it publishes.

Building a signup form that rejects junk

Most bad addresses got in through a signup form that checked format only. Add an MX lookup first, suggest typo fixes, and never block on a timed-out check.

Catch-all verification is inference

On a catch-all domain every address gets the same 250 reply, so any verdict past catch_all comes from outside signals, never from the mailbox itself.

Credits that expire are a second price

Do email verification credits expire? Kickbox and Hunter expire them after 12 months, 14 of 17 verifiers never do, and ZapBounce credits never expire.

DMARC for people who hate DNS

DMARC only works once SPF or DKIM passes for the domain in your From header. Align one, publish p=none, read reports for two weeks, then raise the policy.

Email lists decay by event, not by calendar

Hunter measured 5.5% of verified addresses degrading in 8 weeks (Nov 2025). What drives email list decay, and how often to re-verify each kind of list.

Four results, and unknown is never billed

ZapBounce returns one of four results for every address: valid, invalid, catch_all or unknown. You pay for the first three and never for unknown.

Greylisting, and why it fools verifiers

Greylisting answers a first contact with a temporary 4xx and waits for a retry, so a one-shot verifier calls a live mailbox invalid. See the fix.

How our benchmark is built

Why the ZapBounce benchmark scores against known send outcomes, reports coverage beside accuracy, and splits results across mailbox providers.

How SMTP verification actually works

SMTP verification checks syntax and MX, connects on port 25, sends RCPT TO, reads the response code, and closes before DATA. No email is ever sent.

How to audit a purchased list

Verifying a purchased list tells you which addresses exist. It says nothing about consent, pristine spam traps or legal exposure, which decide the risk.

How to audit a verifier's accuracy claim

To audit an email verifier's accuracy claim, ask what it divides by, what share of the list got a verdict, and how often a valid result still bounced.

Microsoft 365 answers verifiers on its own clock

Microsoft 365 rejects unknown recipients with 550 5.4.1 and throttles new IPs with 451 4.7.500-699. Verification works; answers can shift between runs.

Nobody can remove spam traps

A pristine spam trap accepts mail exactly like a real mailbox, so no verifier can detect or remove one. Consent and sunsetting are what protect you.

Price verification per usable verdict

The real price of email verification is cost per usable verdict: what you paid, divided by the addresses that came back with an answer you can act on.

Reading an email header

An email header lists every server hop in reverse order, plus the receiver's SPF, DKIM and DMARC verdicts. Read Authentication-Results first.

Reading bounce codes properly

A 550 5.1.1 is a dead mailbox and a 550 5.7.1 is a policy block on you, yet both land in the hard bounce bucket. The text after the code is the diagnosis.

SPF flattening is a time bomb

SPF flattening swaps includes for hardcoded IPs to beat the ten-lookup limit, then breaks silently when a vendor changes ranges. Use a subdomain instead.

The 99% accuracy problem

Vendors reach 99% accuracy by leaving unknowns out of the math. Hunter's 2025 test of 15 verifiers measured 31.2% to 70.0%. Read why.

The bounce rate that gets ESP accounts suspended

Amazon SES reviews an account at a 5% bounce rate and may pause it at 10%, and it recommends staying under 2%, which is the safest target for any sender.

The IP pool nobody mentions

Port 25 is blocked by most residential ISPs and restricted on new cloud accounts, so a verifier's coverage depends on the reputation of its probing IPs.

The two numbers a verifier should print

Accuracy claims mean little without coverage and the false positive rate beside them. How to read both, and how to measure them on your own list.

Verifications.io leaked what it chose to keep

The Verifications.io leak exposed 808 million records because a verifier kept its uploads. The safest list is one your verifier deletes on your schedule.

Verify your list at these five moments

Verify an email list at capture, before sending to data over eight weeks old, before a migration, and after every import or purchase.

What a catch-all domain really means

A catch-all domain answers 250 for every address, even an invented one, so no verifier can confirm the mailbox. Expect it on about a quarter of a B2B list.

What a dirty list actually costs

Mailing 8,000 dead addresses costs a few dollars. The real cost is a bounce rate that sends your 92,000 good addresses to junk. Do the math here.

What deliverability tools cannot fix

Seed tests, DMARC monitors and blocklist alerts show where mail lands. Placement comes from 2 things: recipient behavior and your sending history.

What February 2024 changed

Since February 2024, anyone sending over 5,000 messages a day to Gmail needs SPF, DKIM, DMARC, one-click unsubscribe and spam complaints under 0.3%.

What Gmail blocks, and why

Gmail rejects nonexistent addresses with a clear 550 5.1.1, but it refuses or tarpits probes from many cloud IP ranges. A 421 from Google means unknown.

What scale does to verification results

Coverage follows the mailbox providers in a list more than its size. Gmail resolves well; catch-alls, 28% of a B2B list, do not. See the split.

Why a regex cannot validate an email address

A regex can confirm an address is well formed, not that the domain exists or the mailbox takes mail. Keep the pattern loose, then check MX records.

Why we do not bill for unknowns

Billing for results a verifier could not resolve pays it the same for failing. ZapBounce never charges for unknown results or duplicate rows.

Why we publish our pricing and our methods

ZapBounce publishes its price per 1,000 checks, its billing rule and how its check works, so you can test every claim before you spend a dollar.

Why we report coverage alongside accuracy

An accuracy figure covers only the addresses a verifier chose to judge, so guessing on hard ones raises it. Coverage and accuracy together cannot be gamed.

Why Yahoo says yes to everything

Yahoo answers 250 or 252 to every RCPT TO as an anti-harvesting policy and bounces bad addresses hours later. No verifier can confirm a Yahoo mailbox.

Why your verified list still bounced

A verified list still bounces: addresses die after the check, catch-alls were never confirmable, and a 550 5.7.1 is about the sender. Here's why.

Your ESP's built-in validation runs too late

An email platform finds a bad address when it bounces, after the send counts against your reputation. Verification belongs before import and at signup.

Run a sample through it

100 free checks a month, no card, and the unknowns come back labeled.

Get an API key How we report accuracy