What is mailbox validation?

Mechanically it is one exchange: connect to the MX host, greet it, declare a sender, name the recipient, read the answer, hang up. The interesting part is entirely in interpreting the answer.

This is where a verifier's real quality lives. Any tool can run the handshake. Whether it retries a temporary failure, runs a catch-all control probe, and refuses to guess when the server refuses to answer is what separates them.

Infrastructure decides how often it works at all. Port 25 must be open outbound, the connecting address needs a reputation, and a cloud IP will be blocked by the largest providers regardless of everything else.

On a typical B2B list a substantial minority of addresses cannot be resolved at this stage for reasons that belong to the receiving server. Reporting that share honestly is the whole argument.

Sort a hypothetical 10,000-address B2B file by the mail host behind each domain, because that predicts the result better than anything about the addresses. Say 3,400 are on Google Workspace, 3,100 on Microsoft 365, 1,100 behind third-party filtering gateways, 1,600 on self-hosted or small-provider servers, and 800 at Yahoo and AOL.

The self-hosted group tends to answer plainly with a 250 or a 550. Yahoo and AOL return the same acceptance for everyone, so it contributes nothing. Gateways often accept every recipient and show up as catch-all.

That leaves Google and Microsoft, 65% of this file, and here the outcome turns on the prober, not the list. Both providers refuse SMTP probes from most cloud address ranges, and Microsoft throttles hard. From addresses those providers trust, a good share of that 65% gets a straight answer. Probe from poorly regarded ones and most of it comes back unknown. Two vendors running the same handshake on the same file can differ by thousands of verdicts for this reason alone.

Build a small file whose answers you already know. Include 20 colleagues and friends whose mailboxes are live. Add 20 addresses you know are dead: former staff whose accounts IT has confirmed closed, and old personal addresses of your own. Finish with 10 invented local parts at your company's domain, the kind of string nobody would register.

Run the file and score it on two numbers. Coverage is how many of the 50 received a definite valid or invalid. Accuracy is how many of those definite verdicts matched the truth. Count false positives separately, because a dead address marked valid is the mistake that costs you at send time.

Watch the 10 invented addresses most closely. If your domain rejects unknown users, all 10 should come back invalid. On an accept-all domain, the right answer for every address there, real or invented, is catch-all, and any tool that marks the invented ones valid has shown you how it treats what it can't determine. Fifty rows is a smoke test, not a benchmark.