A telnet check is the same handshake every email verifier runs, done by hand. It's worth doing once, because you'll see exactly what a verifier sees and why some answers come back unclear.
You need a machine that can reach port 25 on the internet. Most home broadband providers and many cloud hosts block that port, so the connection often fails before the server says a word. The steps below show the commands, and the sections after them explain each reply code.
The short version
- A terminal with telnet (or nc) and nslookup or dig
- A network that allows outbound connections on port 25
The steps
Find the mail server
Run
nslookup -type=mx example.comordig mx example.com +short. Pick the host with the lowest preference number, such asmx1.example.com. No MX record and no A record means the domain can't receive mail at all. Our MX lookup tool shows the same records in a browser.Open the connection on port 25
Run
telnet mx1.example.com 25. A working server greets you with a line that starts220. If the command hangs or says the connection timed out, your network is blocking port 25.Say hello
Type
EHLO yourdomain.comand press Enter. The server answers with several lines that start250, listing what it supports. Use a domain you own, because some servers check that the name resolves.Give a sender
Type
MAIL FROM:<check@yourdomain.com>. A250reply means the server accepts that sender and is ready for a recipient.Ask about the mailbox
Type
RCPT TO:<ada@example.com>. This is the line that matters. Read the three-digit code at the start of the reply, and note the words after it.Test a random address at the same domain
Type
RCPT TO:<zq8x7k2m@example.com>, a string nobody would pick. If this also gets250, the domain is a catch-all and the first250proved nothing about Ada.Quit before DATA
Type
QUIT. You never sentDATA, so no message was created and nobody received anything. The server logs a short connection and nothing more.
Reading the reply codes
A 250 at RCPT TO means the server accepted the recipient. A 550 means no such user, which is the clearest answer you'll get. Our 550 bounce code entry lists the common wordings.
A 4xx code, such as 450 or 451, is temporary. It often means greylisting: the server refuses a first attempt on purpose and waits to see if you come back. A 252 means the server won't confirm the mailbox but will accept mail for it. A 530 means the server wants you to log in first, so your probe was blocked.
Why the test fails on Gmail and Microsoft 365
Gmail and Microsoft 365 block SMTP probes from cloud IP ranges, so a telnet test from a cloud server often gets refused or cut off. Microsoft also answers inconsistently and throttles repeat connections. Yahoo and AOL return a 250 or 252 for every recipient to stop people from listing their users, then bounce the message later.
So your manual test may end with a clear 550, an accept-everything 250, or a closed connection. Those are protocol facts, and every verifier meets them. What differs is how each one reports the unclear cases.
Doing the same check for a whole list
A telnet session checks one address in a few minutes. ZapBounce runs this exact handshake for you, with its own SMTP check on port 25: MX lookup, RCPT TO, the random-address probe for catch-alls, and a close before DATA. You get valid, invalid, catch_all or unknown, with the smtp_code the server sent so you can audit the reading.
An unknown is never billed. That covers greylisting, throttling, a blocked probe or a 252. Checks cost $5 for 1,000 and credits never expire. Try one address with the SMTP test tool, or upload a file on the bulk page.
Questions people ask
Does verifying an email with telnet send a message?
No. A telnet check stops after RCPT TO and sends QUIT, so the DATA step never happens. No message is created, and the person at that address sees nothing.
Why does telnet on port 25 time out?
Most home broadband providers and many cloud hosts block outbound port 25 to stop spam. The connection times out before the mail server can greet you. Try from a network that allows port 25, or use a verification service.
What does a 250 reply to RCPT TO mean?
A 250 means the server accepted the recipient at that moment. It proves the mailbox exists only if a random address at the same domain gets a 550. If the random address also gets 250, the domain is a catch-all.
Can I verify a Gmail address with telnet?
Often not from a cloud server, because Gmail blocks SMTP probes from cloud IP ranges. From a residential line, port 25 is usually blocked instead. A verification service with its own sending reputation is the practical route.