What is domain validation?

The check looks for MX records first, then falls back to an A record, which the standard permits as an implicit mail destination. Neither present means undeliverable, full stop.

It is the cheapest filter in the pipeline and removes a lot. Typo'd domains, expired registrations and parked names all fail here in a single DNS query, before anyone opens a connection.

The MX answer also tells you who runs the mail, which shapes everything after it. A domain pointing at Google behaves like Google during verification, and that prediction is worth having before the probe.

Results are cached per domain because they change slowly. Checking a list of 5,000 addresses across 400 domains is 400 lookups, not 5,000, and the caching is why bulk verification is fast.

Run the DNS stage on a small sample and the outcomes aren't all the same kind. For acme-logistcs.example, a misspelling, DNS says the name doesn't exist. That answer is definitive, and every address there is invalid. A second domain resolves, has a website and publishes no MX, but it has an address record, so mail will be attempted there. Most verifiers keep going and let the SMTP stage decide.

A third publishes a null MX, the explicit statement that the domain takes no mail. It's invalid, and no connection is needed to say so. The fourth has an MX naming a host that doesn't resolve to any address. Such a record exists and leads nowhere, so treat it as undeliverable.

With the fifth, the lookup times out or the domain's name servers return a failure. That's the dangerous one, because it says nothing about the domain. A careful verifier retries, and if DNS still won't answer, it reports unknown instead of invalid.

Domain validation can't see who owns a domain. Companies close, merge or rebrand, and their old domains expire. Expired names that still receive traffic get bought up fast, sometimes by speculators and sometimes by people who set up a mail server that accepts everything, specifically to collect whatever still arrives.

An address at such a domain passes every stage. There's an MX, the server answers, and the mailbox appears to exist, since they all do. Your invoice, password reset or customer newsletter then goes to a stranger.

What gives it away is history. If a contact's company was acquired two years ago and the domain now shows a parked page or an unrelated site, the verification result doesn't matter and the address should be retired. Look for the pattern in bulk as well: a cluster of old contacts at one domain, all coming back catch-all, none opening in years. No DNS check will flag that for you, and your CRM's notes about the account are what catch it.