Send a probe to any address at yahoo.com and the server accepts it. Invent a local part of forty random characters and it accepts that too. The response is 250 or 252, and 252 has a precise meaning in the specification: cannot verify the user, but will accept the message and attempt delivery.
Yahoo means it literally. They will take the message, try to deliver it, and bounce it back to your return path hours later if there is nowhere to put it.
The reason is address harvesting. Before this policy, a spammer could iterate through likely local parts at a domain and build a list of confirmed mailboxes for nothing. Answering honestly turned the SMTP protocol into a directory service for people you would rather not help.
AOL runs on the same infrastructure. So do att.net, sbcglobal.net and bellsouth.net, because AT&T outsourced its mail to Yahoo years ago. On a US consumer list that is a substantial share of addresses, all of them unverifiable for the same reason.
What a confident Yahoo verdict actually is
Some verifiers return valid or invalid on yahoo.com addresses with apparent confidence. There is no protocol path to that answer, so it comes from somewhere else: a heuristic about the shape of the local part, or a database of addresses that bounced for somebody previously.
Those can be right. A database of previously bounced addresses is genuinely useful information. It is not a measurement of the mailbox today, and it is being presented as one.
The tell is consistency. Ask the same vendor about an address you know exists and one you invented, both at yahoo.com, and see whether the answers differ in a way the protocol could support.
Where this argument costs us something
The short version
- Expect Yahoo, AOL and the AT&T domain family to come back unresolved from any honest verifier.
- Segment them and judge them on engagement history rather than on a verification verdict.
- Watch the asynchronous bounces after a Yahoo-heavy send, because the send report will look clean and the truth arrives the next day.
Questions people ask
Does this apply to AOL too?
Yes. AOL runs on Yahoo infrastructure, as do att.net, sbcglobal.net, bellsouth.net and the other AT&T legacy domains. One policy, many brand names.
Will Yahoo ever change this?
There is no reason for them to. The policy protects their users from enumeration, which is exactly what it was built to do.