How to verify an email address before you hit send

You hit send on a new campaign. By the end of day one, bounces are piling up and your domain’s reputation is already taking the hit. Gmail and Outlook notice before you do, and now every valid lead on that list is paying for the dead ones sitting next to them.

This happens because nobody checked the addresses before the campaign launched. A verified list catches the dead mailboxes, the typos, and the catch-all domains before they ever touch your sender reputation.

In this article, I’ll walk you through how to verify an email address before you send, step by step. You’ll learn how verification actually works under the hood, what each result means (deliverable, risky, catch-all, unknown), and what to do with the ones that come back uncertain instead of just hoping for the best. I’ll also show you how lemlist handles this automatically, so you’re not manually re-checking lists before every send.

Get this right and bounces stop being a mystery. You’ll know exactly which addresses to send to, which ones to hold, and which ones belong on LinkedIn or the phone instead of your inbox.

Why verify emails before cold outreach

You verify an email address by running it through a verification process that checks the format, the domain, and the mailbox itself before you send anything. The result tells you whether the address is safe to email, risky, or dead.

When you send to an address that doesn’t exist, the receiving server returns a hard bounce. That bounce tells Gmail, Outlook, and Yahoo that you’re mailing a dirty list, and each one chips away at your sender reputation. Enough hard bounces in a short window and your domain starts landing in spam, even for the valid contacts on your list.

The major mailbox providers have made this worse on purpose. As of 2026, Google, Yahoo, and Microsoft all enforce bulk sender authentication requirements: SPF, DKIM, and DMARC are mandatory, spam complaint rates must stay low, and bounce rates must stay low. Enforcement is fully active across all three providers, and non-compliant bulk email now gets permanently rejected. In plain terms: authenticate your sending domain, keep complaint rates low, and make it easy to unsubscribe. If you’re mailing unverified lists full of dead addresses, you’re failing the bounce rate test before you even get to the complaint threshold. For a deeper walkthrough of the technical setup, see our email deliverability guide.

How email verification works

Verification runs through a series of layers, each one catching problems the previous layer missed.

First, the verifier checks the syntax. Is the format valid? Is there an @ symbol, a domain, a top-level extension? This catches obvious typos and broken addresses instantly.

Second, it checks the domain. Does the domain exist? Does it have an MX record, meaning it’s set up to receive email? A domain with no mail server can’t accept anything.

Third, the verifier performs an SMTP mailbox check. It connects to the receiving mail server and asks whether the specific mailbox exists, without actually delivering a message. This is where most of the value comes from, and also where things get uncertain, because some servers refuse to answer or accept everything regardless.

Finally, the verifier flags special cases: catch-all domains that accept mail for any address (real or not), disposable email services designed to be thrown away, and role addresses like info@ or support@ that rarely belong to a single decision-maker.

1. Check the syntax and the domain

This is the fastest filter. A verifier catches addresses with missing @ symbols, double dots, spaces, or characters that aren’t allowed in an email address. It also catches misspelled domains like gmial.com or outlok.com, which are more common than you’d expect when leads are entered manually or scraped from unstructured sources.

After syntax, the verifier looks up the domain’s DNS records. If the domain doesn’t exist or has no MX record pointing to a mail server, the address is dead on arrival. There’s no mailbox to check because there’s no infrastructure to receive mail.

2. Run a mailbox check without sending

Once the domain checks out, the verifier opens a connection to the mail server and asks, “Does this mailbox exist?” It does this using the SMTP protocol, the same handshake your email client uses, but it stops before delivering any message. The server responds with a yes, a no, or silence.

The “silence” part matters. Some servers are configured to accept every address during the handshake (catch-all), and others simply don’t respond to verification queries. In both cases, the verifier can’t confirm whether the mailbox is real. That’s where you get risky or unknown results, and those require a different playbook.

3. Read the verification result

Every verified address comes back with a status. Here’s what each one means and what to do with it:

The deliverable and undeliverable statuses are straightforward. The risky and unknown statuses are where most teams lose time or take unnecessary risk. The next two sections cover exactly how to handle them.

4. Decide what to do with catch-all and risky addresses

A catch-all domain is configured to accept mail sent to any address at that domain, whether the mailbox is real or not. That means a verifier can’t distinguish john.smith@company.com from gibberish123@company.com. Both get accepted during the SMTP handshake.

You have a few options:

• •

  Send to catch-all addresses in a small, separate campaign so a spike in bounces doesn’t drag down your main sequence

• •

  Cross-reference the address against a second data source to increase confidence

• •

  Skip email entirely and open with a LinkedIn connection request or a phone call, then follow up by email once you’ve confirmed the contact is real

The right choice depends on the size of your catch-all segment and how much you’re willing to risk. If catch-all addresses make up a large share of your list, sending them all at once is a gamble. For a full breakdown of how catch-all detection works and when to send, see our guide on catch-all emails.

5. Re-verify before every campaign

Email addresses decay. People change jobs, companies rebrand domains, and inboxes get deactivated. A list you verified three months ago will have dead addresses on it today.

A hard bounce means the address is permanently invalid. A soft bounce means something temporary went wrong: the mailbox was full, the server was down, or the message was too large. Soft bounces can resolve on their own, but repeated soft bounces to the same address often signal a mailbox that’s about to become a hard bounce. Our breakdown of soft vs hard bounces covers the difference in detail.

The fix is simple: re-verify your list before every new campaign. If you’re running weekly sends, verify weekly. If you’re launching a quarterly campaign from a list you built months ago, verify the full list before the first email goes out.

Methods to avoid

Sending a test email from your main domain. Some teams send a quick “test” message to see if an address bounces. This works in the narrowest sense, but every bounce hits your primary domain’s reputation. Do this across a few hundred addresses and you’ve done real damage before the actual campaign starts.

Guessing email patterns without verifying. Plugging a first name, last name, and company domain into a pattern like firstname.lastname@company.com gives you a plausible address. Plausible does not mean verified. Without a mailbox check, you’re guessing, and guessing at scale means bouncing at scale.

Trusting free single-address checkers for a whole list. Free tools that let you check one address at a time are fine for a quick spot check. They’re not built for bulk verification. Many lack SMTP-level checks, rate-limit aggressively, or return outdated results. Running a large list through a free tool one address at a time is slow, unreliable, and gives you false confidence.

How to verify emails in lemlist

When you find leads through lemlist’s waterfall enrichment, every email is sourced by querying 14+ data providers in sequence and comes back with a verification status: deliverable, risky (with a sub-label for accept all, full mailbox, or disposable), undeliverable, or unknown. You don’t need to export your list to a separate tool and re-import it. The verification happens as part of lead enrichment.

lemlist also protects your domain while campaigns are running. If your bounce rate hits 10%, you get an alert. If it reaches 50% after at least 100 leads have been contacted, the campaign pauses automatically. Bounced leads are unsubscribed from email so they never receive another message from that sequence.

For risky and unknown addresses, you can add LinkedIn steps and call steps to the same sequence. Instead of gambling on an uncertain email, you open on a channel where you know the contact exists, then follow up by email once you’ve confirmed the address. If you want to compare standalone verification tools, we’ve reviewed the top options in our email verification tools roundup.

Final takeaway

Verify every address before you send, act on the status you get back, and re-verify before each new campaign. Treat risky and unknown results as a signal to switch channels, not a reason to hope for the best. The fastest way to put this into practice is to build your first signal-based sequence in lemlist.