How 51 Mailbox Providers Answer Verification Checks (2026)
Only about half of the big consumer mailbox providers will tell a verifier that an address does not exist. On 23 October 2026 we checked a made-up address at each of 51 providers, twice. 27 rejected it as "mailbox not found", 10 accepted it as if it were real, 7 refused to answer us and 1 asked us to come back later. The other 6, Microsoft's and Apple's consumer domains, were not asked at all, because they do not confirm mailboxes. Every provider answered the same way in both rounds.
That split decides what "valid" can mean. At a provider that answers honestly, a verifier's valid or invalid comes from the provider. At the other half, any tool that says "valid" is guessing, and the honest label is risky.
Method
We sent one made-up address per provider through our own production checker, the same one behind the free email checker, in two rounds.
- Addresses. Each check used a new random local part of the form
sv-research-plus 14 random letters and digits, for examplesv-research-k3v9q0x7m2a8b1@gmail.com. These addresses were generated by us and cannot belong to anyone. No customer list, customer result or real person's address was used. - Providers. 51 consumer mailbox domains chosen for size and spread: the US and UK majors, Microsoft and Apple's consumer domains, privacy providers, and the largest national providers in Germany, France, Italy, Poland, Czechia, Russia, China, South Korea, India, Brazil, Canada, Australia and New Zealand.
- The check. A normal SMTP mailbox check: look up the MX record, connect on port 25, give
MAIL FROMandRCPT TO, read the reply, and disconnect beforeDATA, so nothing is ever sent. Our checker skips the probe for providers it already treats as not confirming mailboxes, and says so in its reason. - Rounds. Round 1 ran from 03:19 to 03:36 UTC and round 2 from 13:57 to 14:10 UTC on 23 October 2026, each with fresh random addresses. 102 checks in total, paced at one every 12 seconds or slower.
- From where. All checks came from one sending server with its own IP address and published SPF. Providers judge the checking server as well as the question, so results from a different server can differ, especially for the "refused" group.
The raw results are in the CSV linked under Key findings: one row per domain, both rounds, with the primary MX host.
Results
| What the provider did with a made-up address | Providers | Share of 51 |
|---|---|---|
| Said the mailbox does not exist | 27 | 53% |
| Accepted it as if it existed | 10 | 20% |
| Not asked: provider does not confirm mailboxes | 6 | 12% |
| Refused our check | 7 | 14% |
| Deferred our check (temporary error) | 1 | 2% |
All 51 providers gave the same kind of answer in round 2 as in round 1. None flipped between "not found" and "accepted", which matters: a provider that answered at random would make every verifier's result there meaningless.
Group 1: providers that tell the truth (27)
Gmail and googlemail.com, Proton (proton.me and protonmail.com), Zoho, Fastmail, Tuta, HEY, Yandex, Rambler, QQ, 163.com, Naver, Daum, Orange, Free, La Poste, SFR, Libero, Seznam, WP.pl, BT, Xtra, Rediffmail, UOL, BOL and Terra all rejected the made-up address at the RCPT TO step with a "mailbox not found" reply.
At these providers a mailbox check is about as good as it gets. If a verifier says an address there is valid, the provider's own server accepted it; if it says invalid, the provider said no. Gmail's codes are covered in detail in how to check if a Gmail address exists.
Real-world caveat: a company domain hosted by one of these providers can still be catch-all. Google Workspace and Zoho both let an administrator accept mail for unknown addresses, which is why a good verifier tests a random address at each domain first. See what is a catch-all domain.
Group 2: providers that accept everything (10)
yahoo.com, ymail.com, aol.com, mail.ru, att.net, sbcglobal.net, cox.net, sky.com, shaw.ca and rogers.com accepted the made-up address as if it were a real mailbox, in both rounds.
Eight of the ten have one thing in common: their MX records point at Yahoo's servers (yahoodns.net). Yahoo runs mail for AOL and for several ISPs, including AT&T, Cox, Sky in the UK and Rogers in Canada, so they all behave the same way. mail.ru and shaw.ca (whose MX is a filtering service, cloudfilter.net) accepted too.
At these domains a mailbox check cannot separate real addresses from invented ones. Yahoo reports unknown users after the message is sent instead, which is what we explain in why Yahoo addresses are hard to verify. An honest verifier returns these addresses as risky, never valid. If your tool marks a made-up Yahoo address valid, it has told you something about the tool, not the address.
To spot this group in your own list, look at the MX host. Our MX lookup shows it for any domain.
Group 3: providers we do not ask (6)
outlook.com, hotmail.com, live.com and msn.com (Microsoft) and icloud.com and me.com (Apple) were not probed. Our checker returns them as risky with the reason "provider hides mailbox status".
Microsoft's consumer mail does not confirm whether a mailbox exists, and it treats repeated recipient lookups as abuse, so probing it gains nothing and harms the checking server. We wrote that up in how to verify Outlook and Hotmail addresses. Apple's servers did not give a usable per-mailbox answer in our earlier tests either, so they are handled the same way.
This group is large in consumer lists. If a verifier claims to have confirmed a hotmail.com mailbox with an SMTP check, ask how.
Group 4: providers that refused us (7), and one that deferred
gmx.com, gmx.de, web.de and mail.com (all run by the same German group, United Internet), T-Online, Comcast and Bigpond refused our check in both rounds. interia.pl deferred it with a temporary error both times.
Read this group carefully: a refusal is a verdict on the checking server, not on the mailbox. These providers are strict about who may connect to them on port 25, and they judge the sending server's IP address, its reverse DNS and its history. A verifier running from different servers may get answers where we did not. Because we cannot tell from outside whether the refusal is a fixed policy or a judgement about our server, we report every address at these domains as risky and say why. We do not count a refusal as "invalid".
What this means for your list
- Split your list by mail host before you judge a verifier. On a Gmail-heavy B2C list most results can be definite. On a list full of Yahoo, AOL, Hotmail and AT&T addresses, a large risky share is the honest outcome, not a weak tool.
- Treat accept-all and not-asked providers as one "risky" segment. Send to confirmed addresses first. Send risky addresses in a small batch and watch the bounces. Our catch-all sending guide has the decision table.
- Test any verifier with a made-up address at gmail.com and at yahoo.com. The right answers are invalid and risky. A verifier that says valid to either has not done what it claims. More in how to tell if your verifier is lying.
- Suppress every hard bounce in every tool. For the accept-all group, the bounce is the only definite answer you will get.
Limitations
- One day, one server. Both rounds ran on 23 October 2026 from the same server. Providers change their behaviour, and the refused group in particular depends on who is asking.
- Consumer domains only. Business domains on Google Workspace, Microsoft 365 or security gateways behave differently; see verifying emails behind security gateways.
- Made-up addresses only. We tested how providers answer for an address that cannot exist. We did not check real people's addresses, so this study says nothing about how often a real mailbox is accepted.
- Our checker's labels. The reasons in the CSV are our checker's readings of each server's reply, not the raw SMTP text.
Check your own list
Paste one address into the checker above, or upload a CSV on the verify page: the first 100 email checks are free with a Google sign-in, no card. Every address comes back valid, risky or invalid with the reason from this study's groups, and you can download only the safe-to-send rows. For regular cleaning see bulk email verification and pricing; developers can use the API or the MCP server.
Full results
| Domain | Mail host (from MX) | What happened (both rounds) |
|---|---|---|
| gmail.com | Says when a mailbox does not exist | |
| googlemail.com | Says when a mailbox does not exist | |
| proton.me | Proton | Says when a mailbox does not exist |
| protonmail.com | Proton | Says when a mailbox does not exist |
| zoho.com | Zoho | Says when a mailbox does not exist |
| fastmail.com | Fastmail | Says when a mailbox does not exist |
| tuta.com | Tuta | Says when a mailbox does not exist |
| hey.com | Own servers | Says when a mailbox does not exist |
| yandex.ru | Own servers | Says when a mailbox does not exist |
| rambler.ru | Own servers | Says when a mailbox does not exist |
| qq.com | Own servers | Says when a mailbox does not exist |
| 163.com | Own servers | Says when a mailbox does not exist |
| naver.com | Own servers | Says when a mailbox does not exist |
| daum.net | Own servers | Says when a mailbox does not exist |
| orange.fr | Own servers | Says when a mailbox does not exist |
| free.fr | Own servers | Says when a mailbox does not exist |
| laposte.net | Own servers | Says when a mailbox does not exist |
| sfr.fr | No MX (address record) | Says when a mailbox does not exist |
| libero.it | Own servers | Says when a mailbox does not exist |
| seznam.cz | Own servers | Says when a mailbox does not exist |
| wp.pl | Own servers | Says when a mailbox does not exist |
| btinternet.com | Own servers | Says when a mailbox does not exist |
| xtra.co.nz | Own servers | Says when a mailbox does not exist |
| rediffmail.com | Own servers | Says when a mailbox does not exist |
| uol.com.br | Own servers | Says when a mailbox does not exist |
| bol.com.br | Own servers | Says when a mailbox does not exist |
| terra.com.br | Own servers | Says when a mailbox does not exist |
| yahoo.com | Yahoo | Accepts every address |
| ymail.com | Yahoo | Accepts every address |
| aol.com | Yahoo | Accepts every address |
| mail.ru | Own servers | Accepts every address |
| att.net | Yahoo | Accepts every address |
| sbcglobal.net | Yahoo | Accepts every address |
| cox.net | Yahoo | Accepts every address |
| sky.com | Yahoo | Accepts every address |
| shaw.ca | Vade cloudfilter | Accepts every address |
| rogers.com | Yahoo | Accepts every address |
| outlook.com | Microsoft | Not probed: provider does not confirm mailboxes |
| hotmail.com | Microsoft | Not probed: provider does not confirm mailboxes |
| live.com | Microsoft | Not probed: provider does not confirm mailboxes |
| msn.com | Microsoft | Not probed: provider does not confirm mailboxes |
| icloud.com | Apple | Not probed: provider does not confirm mailboxes |
| me.com | Apple | Not probed: provider does not confirm mailboxes |
| gmx.com | United Internet | Refused our check |
| gmx.de | United Internet | Refused our check |
| web.de | United Internet | Refused our check |
| mail.com | United Internet | Refused our check |
| t-online.de | Own servers | Refused our check |
| comcast.net | Own servers | Refused our check |
| bigpond.com | Own servers | Refused our check |
| interia.pl | Own servers | Deferred our check (temporary) |
Raw data: download the full dataset as CSV. It is free to reuse with a link back to this page.
Common questions
Which email providers can be verified without sending an email?
In our October 2026 test, 27 of 51 consumer providers answered a mailbox check honestly by refusing an address that could not exist, including Gmail, Proton, Zoho, Fastmail, Tuta, Yandex, QQ, 163.com, Naver, Orange, Free, Libero, Seznam, WP.pl, BT, UOL and Terra. For these, a verifier's valid or invalid answer comes from the provider itself.
Can you verify a Yahoo or AOL email address?
Not with a mailbox check alone. On 23 October 2026 yahoo.com, ymail.com and aol.com accepted a made-up address in both of our rounds, and so did ISP domains whose mail Yahoo hosts (att.net, sbcglobal.net, cox.net, sky.com, rogers.com). An honest verifier marks these addresses risky, not valid.
Can you verify an Outlook or Hotmail address?
Not reliably. Microsoft does not confirm whether a consumer mailbox exists, and it treats repeated recipient probing as abuse. Our checker does not probe outlook.com, hotmail.com, live.com or msn.com at all and returns those addresses as risky. The same applies to Apple's icloud.com and me.com.
Why did some providers refuse the check?
Seven providers, including GMX, Web.de, mail.com, T-Online, Comcast and Bigpond, refused our check at the connection or sender stage in both rounds. A refusal says something about how that provider judges the checking server, not about the mailbox, so a verifier on different infrastructure may get answers there. We report those addresses as risky.
Can I reuse this data?
Yes. The CSV is licensed CC BY 4.0: free to reuse with a link back to this page. It contains only results for the 102 made-up addresses we generated and the public MX record of each domain, no real person's address.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.