Send a probe to any address at yahoo.com and the server accepts it. Invent a local part of forty random characters and it accepts that too. The reply is 250 or 252. In the spec, 252 means: can't verify the user, but will accept the message and try to deliver it.
Yahoo means it literally. They will take the message, try to deliver it, and bounce it back to your return path hours later if there is nowhere to put it.
The reason is address harvesting. Before this policy, a spammer could try likely names at a domain and build a list of live mailboxes for free. Answering honestly turned the SMTP protocol into a directory service for people you would rather not help.
AOL runs on the same infrastructure. So do att.net, sbcglobal.net and bellsouth.net, because AT&T outsourced its mail to Yahoo years ago. On a US consumer list that is a substantial share of addresses, all of them unverifiable for the same reason.
What a confident Yahoo verdict actually is
Some verifiers return valid or invalid on yahoo.com addresses with apparent confidence. No protocol path leads to that answer, so it comes from elsewhere. It's a guess from the shape of the address, or a database of past bounces.
Those can be right. A database of previously bounced addresses is genuinely useful information. It is not a measurement of the mailbox today, and it is being presented as one.
The tell is consistency. Ask one vendor about a yahoo.com address you know exists and one you made up. See if the answers differ in a way the protocol could support.
The bounce that arrives the next day
The short version
- Expect Yahoo, AOL and the AT&T domain family to come back unresolved from any honest verifier.
- Segment them and judge them on engagement history rather than on a verification verdict.
- Watch the asynchronous bounces after a Yahoo-heavy send, because the send report will look clean and the truth arrives the next day.
Questions people ask
Does this apply to AOL too?
Yes. AOL runs on Yahoo infrastructure, as do att.net, sbcglobal.net, bellsouth.net and the other AT&T legacy domains. One policy, many brand names.
Will Yahoo ever change this?
There is no reason for them to. The policy protects their users from enumeration, which is exactly what it was built to do.