How to Verify an Email Address Without Sending a Single Message

# How to Verify an Email Address Without Sending a Single Message

Every signup form that says "please enter a valid email" is quietly making a bet. It wants to reject [email protected] and typos, catch fake addresses, and avoid mailing a list that's half garbage — all without actually sending anything, because sending to bad addresses is how you wreck your sender reputation. The catch is that "is this email real?" has no clean yes/no answer. What you can do is stack a series of increasingly expensive, increasingly unreliable checks, each of which narrows the uncertainty a little.

I've built this pipeline more than once, and the most valuable thing I learned is where each layer lies to you. Syntax checks reject valid addresses. SMTP probes get greylisted and blocked. Catch-all domains accept everything. Below is the honest tour: what each verification step actually proves, where it fails, and how to combine them into a deliverability score instead of a false binary — plus the ethics, because probing strangers' mail servers is not consequence-free.

Layer 1: Syntax — Cheap, Local, and Trickier Than You Think

The first check costs nothing and touches no network: is the string even shaped like an email address? Most developers reach for a regex, and most of those regexes are wrong. The full grammar in RFC 5322 permits things that look absurd — quoted local parts with spaces, comments in parentheses, and more. The fully-compliant regex is a monstrous, multi-thousand-character pattern that nobody should paste into production.