Verifying a business email means running five checks, in this order: syntax, MX records (does the domain have mail servers?), an SMTP mailbox check (does the mailbox respond, or is the domain "catch-all"?), a role or disposable address check, and an ownership check (does the domain actually belong to the company you are targeting?). Most verification tools cover the first four. The fifth is the one that quietly ruins campaigns, because a perfectly valid address at the wrong company is still a wasted send.
Last updated: October 2026.
The short version
- "Valid" means the mailbox exists and can receive mail. It says nothing about whose mailbox it is.
- Verification lowers your bounce rate. It does not, by itself, put you in the inbox β authentication, sending reputation and content decide that.
- Small batches first, then scale. Watch bounces and spam complaints from the first send.
Why verification matters: the published numbers
Mailbox providers publish thresholds, and cold outreach at volume runs into them quickly:
- Spam complaints. Google's sender guidelines tell senders to keep their user-reported spam rate below 0.1% and to prevent it from ever reaching 0.3% or higher. Bulk senders β those sending close to 5,000 or more messages a day to personal Gmail accounts β must also authenticate their mail, offer one-click unsubscribe on marketing messages, and honour unsubscribe requests within 48 hours. Gmail has been ramping up enforcement on non-compliant traffic since November 2025 (Google's sender guidelines FAQ).
- Bounces. Amazon SES, as one example of a sending platform, documents that its bounce rate should stay below 5%; at 5% or higher an account is placed under review, and at 10% or higher sending may be paused (AWS documentation). If you send through a tool built on such infrastructure, a dirty list can put your whole account at risk, not just one campaign.
Neither number is a goal; both are ceilings. A sensible target for a fresh list is to stay far below them. For authentication basics, see SPF, DKIM and DMARC for cold email.
The five checks
1. Syntax
Catches typos (gmial.com), missing parts and illegal characters. It also catches scraping artifacts: web pages contain image file names such as logo@2x.webp that look like email addresses to a naive pattern match. If the part after the last dot is a file extension, it is not an email.
2. MX records
A domain must publish mail-exchange (MX) records to receive email. No MX record means the address cannot receive mail, and it will bounce.
3. SMTP mailbox check
The verifier connects to the mail server and asks whether the mailbox would be accepted, without sending a message. Results are probabilities, not certainties:
- Some servers answer honestly; others block probes or return generic answers.
- Catch-all (accept-all) domains accept every address, real or invented, so a "pass" proves nothing. Treat these results as risky/unknown, not as valid.
4. Role-based and disposable addresses
Addresses such as info@, sales@ or support@ are deliverable but are often read by whoever is on duty rather than by a decision-maker. They can be a reasonable first contact when you cannot find a named person (purchasing@ is a common choice for importers), but keep volumes small and expect lower replies. Disposable-mailbox domains and no-reply addresses should be removed.
5. Ownership: does the domain belong to the company?
This check is the one automated verification rarely makes. A mailbox can exist, accept mail and pass every technical test while belonging to an unrelated business. Typical ways it goes wrong:
- Look-alike names. A company called "Asia Nuts LLC" in one country is matched to a similar-sounding domain belonging to a different company in another. The address verifies perfectly β at the wrong business.
- Domains made of a generic word. A domain that is just a product word (for example, a plain commodity name) rarely belongs to the small trader you are researching.
- Social profiles used as the "website." A map listing whose website field is a social-media page can lead to addresses guessed on the platform's own domain, which cannot be right.
- Parent companies and brands. An address on a group's domain may be genuine but belong to a different legal entity than the one you searched.
Free-mail addresses (Gmail, Mail.ru, 163.com and similar) are a different case. Many small firms in many markets use them legitimately, so do not discard them β but they cannot be matched to a company domain, so confirm the business by another route (phone number, address, or a registry entry).
How to check ownership in two minutes: open the domain in a browser; look for the company name, address or phone number you already have from your source; check the legal-entity details page where one exists (German sites carry an Impressum); and make sure the product range matches what you expected.
A practical routine for exporters
- Clean first. Remove syntax errors, no-MX domains, disposable and no-reply addresses.
- Separate "risky." Keep catch-all results in their own group; mail them later, in small batches, only after the ownership check passes.
- Check ownership on your best leads β the companies you would most hate to mis-target.
- Send a small first batch (a few dozen), watch bounces and replies for a day or two, then scale.
- Include a clear sender identity and an easy opt-out, and read the legal basics for your target market (GDPR guide).
- Re-verify old lists before reusing them. People change jobs and companies change domains.
How Whalentro handles this
Whalentro runs MX and SMTP checks and third-party verification on the email addresses it finds, and labels every result by source and confidence (for example verified, pattern-guessed or unverified) so you can see how an address was obtained. It also shows a warning when a found address sits on a domain that does not appear to match the company name, so you can check ownership before sending. No automated check can fully prove that a mailbox belongs to a particular company; treat the warning as a flag for manual review, not a guarantee either way.
Start your 14-day free trial β
FAQ
What is the difference between a valid email and a deliverable email?
"Valid" usually means the address passed format and server checks. "Deliverable" means a message sent to it is likely to reach a real inbox. Catch-all domains can be technically valid but uncertain to deliver to a specific person.
What is a catch-all email domain, and should I email it?
A catch-all (accept-all) domain accepts mail for any address at that domain, so verification cannot confirm that a specific mailbox exists. You can email these addresses, but do it in small batches, and only to contacts you have confirmed through another source.
Will verifying my list make my emails land in the inbox?
It reduces bounces, which protects your sending reputation, but inbox placement also depends on authentication (SPF, DKIM, DMARC), sending volume, recipient engagement and content.
How often should I re-verify a B2B email list?
Before every major campaign that reuses an older list. B2B contact data goes out of date as people change roles and companies change domains.
Can a verified email still be the wrong person or company?
Yes. Verification confirms that a mailbox exists, not who owns it or whether they are a fit for your product. That is why the ownership check matters.