I sent 50 emails. 12 bounced despite SMTP 250 OK. Here's why.
api, #cybersecurity, #python, #webdev On July 15 I queued a campaign to fifty addresses I had already "verified" with a plain SMTP handshake. Every single one returned 250 OK . Three hours later, twelve of them bounced. That's a 24% failure rate on addresses that looked perfectly healthy in the logs. I ran the same list through a validator that reads past the SMTP greeting. One address,…
On July 15, the reporter conducted a campaign to 50 email addresses, each previously verified using a plain SMTP handshake. Surprisingly, 12 of the addresses bounced, resulting in a 24% failure rate. To investigate further, the reporter ran the same list through an email validator that examines additional factors beyond the initial SMTP greeting. One email address, test@gmail.com, emerged as a key example.
The reporter used the following curl command to test the email address:
curl --request GET --url "https://email-validator112.p.rapidapi.com/validate?email=test@gmail.com" --header "X-RapidAPI-Key: $RAPIDAPI_KEY" --header "X-RapidAPI-Host: email-validator112.p.rapidapi.com"
The JSON response provided valuable insights. The "is_role" field was set to true, indicating that the address is a role account. Moreover, the "breach_count" field revealed that the address had been involved in 579 known breaches. Despite the SMTP handshake indicating that the address was valid, the validator's score for test@gmail.com was only 75 out of 100, primarily due to the role account flag and breach history.
SMTP verification through the validator showed that the "smtp_verified" field was null, not true. This crucial difference highlighted that the SMTP response alone was insufficient to confirm deliverability. The reporter learned that a null value in this field meant that the validator couldn't confirm live delivery, but it didn't guarantee that the address was valid or deliverable.
The findings emphasized that the initial assumption of treating 250 OK as a contract for message queuing was flawed. The validator's findings uncovered issues such as role accounts, catch-all domains, greylisting, breached addresses, and free-provider misclassification that had evaded the 250 OK filter. The example of test@gmail.com demonstrated that the score alone could be misleading, as it was dragged down by the role account flag and breach history, resulting in a score below 100 despite appearing "acceptable" initially.
The validation process highlighted the limitations of relying solely on SMTP responses. The reporter realized that SMTP verification alone couldn't reliably determine deliverability, as providers often throttle, greylist, or tarpit external probes, making it challenging to obtain accurate results. The reporter had previously treated the 250 OK response as proof of a good address, but the validator's forensic report revealed that this assumption was incorrect.
The story underscored the importance of adopting a more comprehensive approach to email validation, considering factors beyond the initial SMTP handshake. It revealed that SMTP verification could be inadequate, as providers have various mechanisms that affect deliverability without necessarily indicating a problem. The incident served as a lesson in the complexities of email validation and the necessity of employing robust validation techniques to ensure accurate results.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
