B2B Email Verification: How It Works and Where It Stops

To verify a B2B email address, a checker looks up the domain's mail servers and asks the receiving server whether it would accept mail for that exact address, then disconnects before any message is sent. If the server answers clearly, you know whether the mailbox exists. Some servers, including catch-all domains, many Microsoft 365 setups and corporate security gateways, do not give a clear answer, so those addresses often cannot be confirmed either way.

This guide explains how verification works, what each result means, where it cannot help, and when to check a list again.

What does email verification actually check?

Email verification answers one question: will this specific mailbox accept mail? It is different from checking whether a domain exists, and different from deciding whether a contact is a good fit for your offer.

A full check usually runs through three layers:

1. Syntax. Is the address well formed, with no illegal characters or typos such as a missing dot?
2. Domain and mail records. Does the domain exist, and does it publish MX records, which tell the internet which servers receive its mail?
3. Mailbox. Does the receiving server accept the exact address?

Only the third layer tells you about the person. Many free or quick checks stop at the second layer, which is why a green "valid" label can still bounce.

How does an SMTP mailbox check work?

SMTP is the protocol mail servers use to hand messages to each other. A mailbox check uses the first steps of a normal delivery and then stops.

1. Find the mail server. The checker looks up the MX records for the domain, for example company.com.
2. Open a connection to that server and introduce itself, as any sending server would.
3. Name a sender with the MAIL FROM command.
4. Name the recipient with the RCPT TO command, using the address being checked.
5. Read the answer. A code starting with 250 usually means "accepted". A code like 550 usually means "no such user". Codes starting with 4 mean "try again later".
6. Disconnect before sending any message content. No email reaches the person.

Secwyn checks work emails this way: an SMTP check, with no email sent. You are charged for a verification only when the mailbox is confirmed to exist.

What do the different verification results mean?

The important difference is between "invalid" and "cannot confirm". Invalid is a clear no. Cannot confirm means the check could not see inside the mailbox system, not that the address is bad.

Why can't catch-all and Microsoft 365 addresses be confirmed?

A catch-all domain accepts mail for any address, including ones that do not exist. The server answers "accepted" to every RCPT TO, so a checker cannot tell a real mailbox from a guess. Companies set this up so mail to misspelled addresses is not lost, then sort it later.

Some large hosted mail services, including many Microsoft 365 setups, limit or block repeated checks from outside servers, or answer in ways that do not reliably separate real mailboxes from fake ones. Many companies also put a security gateway in front of their mail. These gateways often accept everything at the edge and decide later, or refuse checks entirely.

A careful checker marks these addresses as not confirmed rather than guessing. A checker that reports them as definitely valid is repeating the server's answer, not describing the mailbox.

What should you do with addresses that cannot be confirmed?

You do not have to throw them away. Use a careful routine:

• Check the pattern. If the company's website shows other staff emails, does your address follow the same format?
• Check the person. Make sure the name comes from a current source, such as the company's own team page.
• Send small. One or two unconfirmed addresses per company, at a low daily volume.
• Watch for bounces. A bounce from one address means the pattern is probably wrong for the rest.
• Use other channels. The company's contact form, main phone number or LinkedIn page.

Takeaway: "cannot confirm" is a reason to go slowly, not a reason to stop.

What does verification not tell you?

Verification is narrow by design. A valid result does not mean:

• The person still holds that role. People change jobs; mailboxes are sometimes kept open after they leave.
• The mailbox is read. Shared inboxes such as info@ or sales@ may be monitored loosely.
• The company is a good fit. A real mailbox at a company that will never buy is still wasted effort.
• Your email will reach the inbox. Spam filtering depends on your domain, content and sending pattern.

Fit is a separate question. See qualifying B2B leads from company websites and cold email to US B2B buyers for those parts.

When should you re-verify a B2B contact list?

B2B contact data goes stale as people change jobs, companies merge and domains change. As a working rule:

1. Verify every new address before its first email.
2. Re-verify before each campaign if the last check is more than about 90 days old.
3. Re-verify immediately after any bounce at the same domain.
4. Re-check the person, not just the mailbox, when a contact's role or title looks outdated on the company website.
5. Remove hard bounces at once and never re-add them.

Lists bought or exported long ago need a full re-check before any sending at all.

Where do verified contacts come from?

Verification works best on addresses tied to a real person at a company that fits. A Secwyn company reveal shows the company profile, the roles to contact and the people found on the company's own website, and you can then verify their work emails. The company directory home page shows the industries covered, and the manufacturing directory shows the sub-industries in Secwyn's verified data as of 2026-10-06.

If you are comparing tools, choosing a B2B prospecting tool as an exporter lists questions to ask about verification methods and charges.

Frequently Asked Questions

Does email verification send an email to the person?

A proper SMTP check does not. It connects to the receiving mail server, asks whether the server would accept mail for the address, reads the answer and disconnects before any message content is sent. The person receives nothing. Some tools offer other methods, so ask a provider exactly how its checks work.

What is a catch-all email domain?

A catch-all domain is set up to accept mail for any address at that domain, even addresses that do not exist. Companies use it so misspelled emails are not lost. Because the server accepts everything, a verification check cannot tell whether a specific mailbox is real, so results are reported as catch-all or not confirmed.

Why do so many corporate addresses come back as "unknown"?

Many companies use hosted mail services or security gateways that limit outside checks, accept all mail at the edge, or answer slowly to discourage probing. In these cases the checker gets no reliable answer about the mailbox. Unknown does not mean the address is bad; it means it could not be confirmed.

Is a verified address safe to send to?

It is much safer than an unverified one, because the mailbox exists. It still does not prove the person holds the same role, reads that inbox, or wants your offer. Combine verification with a fit check, a relevant message, steady pacing and a working unsubscribe link to keep both results and your reputation healthy.

How often should I clean my B2B email list?

Verify each new address before its first email, and re-verify before each campaign if the last check is older than about 90 days. Re-check right away after any bounce at a domain. Remove hard bounces and opt-outs permanently. Older lists that have not been used for months need a full check before sending.

Should I pay for verifications that cannot be confirmed?

That depends on the provider's pricing model, so ask before you buy. Some charge for every check regardless of result. Secwyn charges for a work email verification only when the mailbox is confirmed to exist, so catch-all and unconfirmable addresses do not use verification credits.

Next steps

Run every new address through a mailbox check before its first email, and set a reminder to re-verify lists older than about 90 days. Keep unconfirmed addresses at low volume and watch for bounces. If you want people and verified work emails for companies that already fit your buyer profile, Secwyn can find both from the company's own website.