My email verifier called a made-up address valid. It had never contacted the mail server.

A customer pulled about 30 addresses out of my tool and sent to them. Three bounced. One of the Outlook rejections spelled it out: no mailbox named jari at that domain.

So I went looking for the SMTP check. There wasn't one.

The only SMTP connection anywhere in the production path knocks on a random address, to find out whether the domain is catch-all. It never touches the address you actually care about. After that, anything with an MX record on a non-catch-all domain came back "valid" with a confidence score stapled to it.

I tested it with garbage. Invented local part, nonsense, on a real customer domain. Status: valid. Confidence: 0.90.

Underneath that sat a second problem. The MAIL FROM I was announcing came from probe@validator.local and verify@atlas-ai-check.com. Neither domain exists. Strict servers reject the sender before you get anywhere, one of them answered 553 5.1.8, the probe fell over, and a probe that fell over was recorded as "not catch-all". Which made the address look more trustworthy. The failure mode pointed the wrong way.

All three bounced addresses were pattern guesses. firstname.lastname@ and firstname@, generated from a person's name that never appears anywhere on that company's site.

What it does now: MAIL FROM a domain that exists, send a control address first (one that should fail), then the real one on the same connection. Valid needs a 2xx for the target and a rejection for the control. Microsoft 365's access-denied answer gets its own status instead of being called invalid, because those servers refuse everyone. About a second per domain.

Then I measured 40 real domains with the fixed version. 55% actually separate real mailboxes from fake ones. 28% are catch-all. 18% refuse the knock or block the port. So for a bit under half of them, verification is not possible at all, and the honest output there is "unverified" rather than a number.

The export now marks guessed addresses separately from verified ones, and dead addresses drop out of the send column entirely. I would rather hand someone 6 confirmed addresses than 30 with a decimal next to them.

Disclosure: this is my own product, a desktop prospecting tool. Not linking it.