ON THIS PAGE
By Efe Berke Colaker, Founder at GetleadReviewed by the Getlead editorial team for accuracy. Last updated September 2026.
Outbound campaigns fail when contact lists decay before the first message leaves the server. B2B contact data degrades at 3% per month because employees change jobs or companies rebrand. Teams usually catch this bounce rate spike after a campaign launches, forcing them to pause sending and clean the remaining data.
Real time email verification is an API process checking an address via SMTP when a user submits it or a scraper extracts it. A growth operator connects their lead capture form to a verification endpoint, dropping invalid addresses before they enter the CRM.
Consider a campaign targeting 10,000 marketing directors. If 300 emails hard bounce, the sender domain reputation drops, triggering spam filters for the remaining 9,700 valid contacts. Catching these 300 bounces requires either a 200-millisecond API call or a 45-minute bulk CSV job.
The numbers behind list decay
When a team buys a static list of 50,000 contacts, nearly a quarter of those addresses will hard bounce. Sending to those 11,950 invalid addresses destroys domain reputation and forces messages into the spam folder. Bulk verification processes that entire file at once, whereas real-time checks happen individually during extraction.
The spread between these two methods exists because API calls require dedicated server connections. Batch processing queues the SMTP handshakes during off-peak hours, saving significant compute resources. Teams should switch to real-time checks when their inbound lead volume exceeds 1,000 submissions per day.
A bulk job takes longer because the system groups addresses by domain to avoid triggering rate limits at major providers. Google enforces connection limits per IP address, as detailed in their sender guidelines. If a verification tool opens too many simultaneous connections, the provider blocks the IP.
This domain grouping is impossible during real-time checks because the API receives addresses randomly. Therefore, the API must rotate through thousands of proxy IPs to maintain the 200-millisecond response time. The proxy rotation prevents the target server from recognizing the volume of requests coming from a single vendor.
How real-time verification works at the API level
The SMTP handshake sequence
Real-time verification relies on a direct connection to the recipient mail server without actually sending a payload. The verification tool sends an EHLO command to the domain, followed by a MAIL FROM command. If the server responds with a 250 OK code, the tool issues the RCPT TO command containing the target address.
- A 250 code confirms the mailbox exists and accepts messages.
- A 550 code indicates the address is invalid or the mailbox is full.
- A server timeout means the domain uses a catch-all configuration or greylisting.
This sequence takes between 100 and 300 milliseconds per address under normal network conditions. When a user asks if there is a way to verify if an email is real, this SMTP ping is the standard technical answer. The RFC 5321 specification defines these exact response codes for all mail servers globally.
Providers like Microsoft and Google monitor how often an IP address drops the connection after the RCPT TO command. Dropping the connection prevents the tool from sending a blank message, but it signals to the provider that the IP belongs to a scanner.
To bypass these filters, enterprise verification APIs route requests through residential proxy networks. A residential proxy masks the scanner as a standard home user, reducing the chance of a 550 block. This infrastructure requirement explains why real-time API credits cost up to three times more than bulk credits.
Syntax checks happen before the SMTP ping to catch missing at-signs or invalid characters immediately. A syntax check requires zero network requests, meaning the API can reject a malformed address in one millisecond.
Bulk verification constraints and batch processing
Batch processing a CSV file of 50,000 contacts introduces a deliberate time delay to protect the scanning infrastructure. Most bulk verification platforms take up to three hours to clean a list of that size. The system reads the file, sorts the 50,000 rows by domain, and assigns each domain to a specific worker node.
A worker node handling 4,000 Microsoft addresses will insert a five-second pause between each SMTP ping. This pacing mimics human sending behavior and keeps the verification IP off public blocklists. If a user uploads a list containing 10,000 addresses from the same company, the delay increases to protect the node.
SDR leads often ask what the most hacked email provider is, but security filters matter more than breach history here. Corporate domains hosted on Proofpoint or Mimecast will ban an IP that pings them 10,000 times in one minute. Bulk processors avoid this ban by spreading the checks across a twelve-hour window if necessary.
Federal compliance laws require businesses to process opt-out requests within ten days. Cleaning a list in bulk ensures you remove these opt-outs before they trigger a spam complaint. Teams that skip this batch process often find their sending domains blacklisted within a week.
To execute a bulk verification job effectively, operators follow a specific sequence.
- Export the CRM contact list as a UTF-8 encoded CSV file.
- Remove all columns except the email address to reduce file size.
- Upload the file to the bulk verification platform.
- Download the processed file and filter out any rows marked invalid.
- Re-import the clean data into the CRM using the contact ID.
This five-step process requires manual intervention but guarantees a clean database. A marketing operations manager executing this routine weekly prevents list decay from impacting ongoing campaigns. The labor cost of this manual work remains lower than the API premium for large datasets.
Cost differences at 50,000 contacts
API calls for real-time checks cost more because they require immediate compute resources on demand. A standard API verification costs around $0.01 per address, totaling $500 for 50,000 leads. Bulk verification drops that price to $0.003 per address, bringing the total to $150.
Teams running outbound campaigns must balance this $350 difference against the cost of storing bad data.
“We spent $800 a month storing 40,000 invalid contacts in our CRM before we implemented an API block on our signup form.”
Head of RevOps at a 50-person SaaS
A CRM charges by the contact, meaning 11,950 invalid addresses inflate your monthly software bill. Founders should use bulk cleaning for purchased lists and reserve real-time API credits for inbound forms.
When a scraper pulls 2,000 leads from a directory, the operator must decide which verification mode to apply. Sending those 2,000 leads to an API endpoint adds $20 to the extraction cost immediately. Exporting the list to a CSV and uploading it to a bulk checker costs $6 and takes twenty minutes.
The operator saves $14, but they lose the ability to automate the data flow directly into their sending sequence. At a volume of 50,000 contacts, the manual CSV upload saves enough money to fund an entire secondary campaign. However, the manual process introduces human error if the operator maps the CSV columns incorrectly.
Consider a concrete ROI calculation for a 50,000-contact list. Storing 11,950 invalid contacts in a CRM like HubSpot costs an extra $240 per month. Paying $150 for bulk verification yields a positive return within the first 30 days. If the team uses the $500 API method, the payback period extends to two months.
Let us examine a secondary scenario where a team processes 5,000 inbound leads monthly. The API method costs $50 per month, while bulk processing costs $15. The $35 premium buys immediate validation, preventing fake signups from triggering automated welcome sequences. This immediate block saves SDRs from wasting hours calling disconnected phone numbers.
Consider a third scenario involving a purchased list of 100,000 contacts. The API method costs $1,000, while the bulk method costs $300. The $700 savings easily covers the cost of a dedicated SDR for a week. Startups operating on tight budgets must prioritize bulk processing for these large data acquisitions.
Handling unknown server responses
Catch-all domains and greylisting
Our data shows that 16.7% of B2B addresses return a catch-all response during verification. A catch-all server accepts every incoming message, regardless of whether the specific mailbox exists. Real-time APIs struggle with catch-all domains because a standard SMTP ping always returns a 250 OK code.
To determine if the address is valid, the tool must send a test email and track the bounce.
- The system generates a random, non-existent address at the target domain.
- It pings the fake address and records the server response code.
- If the server accepts the fake address, the system flags the entire domain as a catch-all.
This secondary check adds 500 milliseconds to the API response time. Greylisting presents another technical hurdle, as the server intentionally drops the first connection attempt from any unknown IP address.
The server expects a legitimate mail sender to retry the connection five minutes later. An API cannot wait five minutes to return a result to a web form, so it marks the address as unknown. Bulk processors handle greylisting easily because they can pause the worker node and retry the domain later.
This retry mechanism explains why bulk lists return fewer unknown statuses than real-time API scans. If an operator receives an unknown status from the API, they should queue the address for a bulk check overnight.
Integrating verification with data scrapers
Growth operators connect real-time verification to their scraping tools via webhooks. When the scraper finds an email address on a LinkedIn profile, it triggers an HTTP POST request. The API returns a JSON payload containing the validity status, the domain type, and the MX record details.
If the status is valid, the webhook pushes the contact into the outbound campaign queue. If the status is invalid, the webhook discards the record and moves to the next profile.
This automated filtering prevents SDRs from manually reviewing spreadsheets before launching a sequence. A team extracting 500 leads a day saves two hours of manual data entry by using the API.
The webhook setup requires a developer to format the JSON payload correctly. Without proper error handling, a timeout at the verification endpoint will crash the entire scraping sequence. Operators must configure their scripts to retry failed API calls after a ten-second delay.
A reliable script logs the failed checks in a separate database table for manual review. This fallback ensures you do not lose leads when the verification provider experiences an outage.
Follow these four steps to build a resilient scraper integration.
- Extract the raw text string from the target website DOM.
- Run a local regex pass to confirm basic email syntax.
- Send the HTTP POST request to the verification endpoint.
- Parse the JSON response and route the lead accordingly.
This local regex pass prevents the system from wasting paid API credits on obvious errors. If the scraper extracts a phone number instead of an email, the local script drops it immediately. The API only processes strings that look like legitimate addresses.
Provider restrictions and free tiers
Many SDRs ask if there is a free online email verifier they can use for small batches. Vendors offer free tiers, but they cap usage at 50 to 100 checks per day. These limits prevent scrapers from overloading the verification infrastructure and driving up server costs.
ZeroBounce provides 100 free credits monthly, which covers basic testing but fails at production scale. Email Hippo offers a free web interface that checks one address at a time. When users ask what the best email verification service is, the answer depends on their daily volume.
A team processing 500 leads a month can survive on free tools, but a 50,000-contact list requires paid software. Free tools rarely include the residential proxy networks needed to bypass corporate firewalls. Consequently, a free checker will return a higher percentage of unknown results on enterprise domains.
Teams testing a new data provider should run a 1,000-lead sample through a paid API to measure the true bounce rate. Relying on free web checkers for B2B lists guarantees a domain reputation penalty within the first month.
Free tools also lack the SOC 2 compliance required to process sensitive customer data legally. Founders must verify that their chosen vendor encrypts the addresses during transit and deletes them after processing.
Sources and method
We referenced the RFC 5321 specification to explain the technical handshake sequence for address validation. The Google email sender guidelines provided the rules for connection limits and rate limiting.
We consulted ZeroBounce for baseline pricing data on bulk verification versus real-time API tiers. Email Hippo served as our reference for single-address web checking capabilities.
Figures were checked in September 2026.
Frequently asked questions
Is there a way to verify if an email is real?
You can verify an email by sending an SMTP ping to the recipient mail server. The server will respond with a 250 OK code if the mailbox exists, or a 550 code if the address is invalid. This process confirms validity without sending an actual message.
What is the most hacked email provider?
While consumer providers like Yahoo and AOL historically faced large breaches, B2B senders must focus on corporate security filters instead. Providers like Proofpoint and Mimecast actively block verification scanners to protect their networks, making it difficult to verify addresses at enterprise domains.
What is the best email verification service?
The best service depends on your daily lead volume and extraction method. Teams processing static CSV files should use bulk verification platforms to save money. Growth operators capturing leads through live web forms require a real-time API to filter invalid data immediately.
Is there a free online email verifier that I can use?
Several vendors offer free online verifiers, but they restrict usage to 50 or 100 checks per day. These free tiers work for manual testing, but they lack the proxy networks needed to verify large lists accurately. Processing B2B data requires a paid subscription.
How do catch-all domains affect email verification?
A catch-all domain accepts every incoming message, returning a valid response code even for non-existent mailboxes. Standard SMTP pings cannot detect invalid addresses on these servers. Verification tools must send a hidden test message and track the bounce to confirm validity.