MX record lookup vs SMTP verification: what each one actually proves

Two distinct tools are often confused with one another: MX record lookup and SMTP verification. Although they share a similar purpose, they serve different functions, and using the wrong tool can lead to rejecting legitimate customers or trusting fraudulent addresses.

An MX lookup, also known as an MX (mail exchanger) record check, reveals which mail servers are authorized to accept emails for a given domain. This information is obtained through a DNS query. If a domain possesses MX records, it implies that mail can be delivered to it in theory. Conversely, if there are no MX records, there is no designated mail server, and the email address cannot receive messages.

In essence, MX lookup answers a single question: does a domain possess a mailbox infrastructure? However, it does not provide any insight into whether a specific local part (the portion preceding the '@' symbol) is a legitimate inbox. For instance, when curling a MailProbe API endpoint with a non-existent email address, the response indicates "no_mx" and "no deliverable," signifying that the address's deliverability cannot be confirmed due to the absence of an MX record.

SMTP verification takes this process a step further. After identifying the appropriate mail server, it establishes a connection on port 25, transmits a request to deliver an email to the specified address, and receives a response from the server. A "250" response denotes that the mail server acknowledges the existence of the mailbox, while a "550" response indicates that it does not.

However, in practice, this method has several drawbacks. Most cloud providers block port 25 for security reasons, and reputable sending IPs often face restrictions. Furthermore, many mail servers employ catch-all mechanisms or provide misleading responses to avoid disclosing the existence of individual accounts, which attackers can exploit.

As a result, even when SMTP verification succeeds, its output is frequently an artificial affirmation.

By 2026, conducting a reliable SMTP probe will require self-hosted infrastructure with a verified sending reputation, a dedicated IP address, and the capability to handle port 25 traffic. MailProbe's hosted endpoint, for example, operates on Cloudflare Workers, which lack direct TCP support, rendering SMTP verification unavailable. To reap the benefits of SMTP-level checks, the verifier must be executed on a self-hosted server, where the team can exert control over the network environment.

Running SMTP verification on a self-hosted server entails managing reputation-related tasks, such as warming up the IP address for deliverability and building trust with receiving mail servers. This process can be time-consuming and costly, as it necessitates establishing a robust sending history and engagement with real users. Consequently, most organizations choose to rely on MX lookup as their primary filtering mechanism, reserving SMTP verification for situations where they have the necessary infrastructure to ensure its reliability.

When faced with inconclusive results, it is crucial to avoid misinterpreting "I could not prove it" as "it is invalid." A DNS query failure during an MX lookup, for example, does not inherently indicate that an email address is invalid. Instead, it suggests that the DNS query did not yield a response within the expected timeframe.

In such cases, it is prudent to treat deliverable: null with the reason "mx_timeout" as an unknown outcome, allowing the user through with a confirmation email rather than automatically rejecting the address as undeliverable. This approach acknowledges the inherent uncertainties in network interactions and prevents legitimate users from being wrongly blocked due to transient issues.