Method No test emails
How catch-all resolution works without sending test emails.
On a catch-all domain the mail server accepts every address, real or not. So the standard verification move — open an SMTP conversation and read the response code — returns exactly the same answer for a real mailbox and a fictional one. The technique does not degrade on catch-all domains. It stops carrying information altogether.
A 250 OK from a catch-all domain is not evidence.
Ordinary SMTP verification asks the receiving server whether it will accept mail for an address. On a normal domain a rejection is informative. A catch-all domain is configured to accept everything and sort it out later, so it answers 250 OK for a.reyes@ and for notarealperson@ alike.
This is why tools return “risky” or “accept-all” on these records. That label is not a finding about the mailbox — it is the tool reporting that its only instrument reads zero. On a typical B2B list that covers 30–60% of addresses, because catch-all is most common at exactly the large enterprises you want to reach.
Two responses follow. Send a real message and observe what happens — direct, but it puts unsolicited mail in front of someone who never asked for it and leaves a trace in their logs. Or find information elsewhere. We do the second.
Six signals, none of which require contacting the mailbox
Five are public. The sixth — observed delivery outcomes — is not: it exists only where a customer has connected their own ESP and consented, and only covers their own sends. No single signal is decisive. That is the point — the method is to combine weak, independent signals into a judgement whose confidence reflects how much they agree.
Which provider actually terminates mail for the domain, and how that provider behaves. Google Workspace, Microsoft 365 and self-hosted MTAs differ in what an accept response is worth — the same 250 means different things behind different infrastructure.
If nine addresses on the domain are demonstrably first.last and the address in hand is klwilson, that contradiction is evidence. If it matches, that is evidence too. Strength scales with how many real addresses we matched, which is why we report the count rather than just the pattern.
Whether a person by that name is publicly associated with that company — company site, press releases, public profiles. This is what separates a plausible-looking address from one belonging to a real person at a real employer.
Public CT logs and historical DNS reveal subdomains, mail infrastructure changes and domain age. A domain whose mail infrastructure appeared last week is a different risk from one stable for nine years.
SPF, DKIM and DMARC configuration, including whether DMARC is enforcing. This speaks to how the domain is run, which correlates with whether unknown addresses bounce or silently disappear.
Where a customer has connected their own ESP and consented, observed bounces and engagement on their own sends. This is the only signal here that is direct evidence about a mailbox — and it exists only for customers who opt in, on their own data.
Agreement raises confidence. Contradiction lowers it.
Signals are weighted by how much they historically carry, then combined. Where they corroborate — a matching naming pattern, a real person at that company, stable infrastructure — confidence rises. Where they conflict, it falls, and the response says which signal dissented.
When the evidence does not support a call, the answer is unknown with a confidence score, not a coin flip dressed as a verdict. An honest “we could not tell” is more useful than a confident wrong answer, because you can route it to review rather than acting on it.
Every response carries the signals that drove it and the date each was observed. Evidence ages: a naming pattern from a crawl eight months ago is weaker than one from last week, and you should be able to see which you have.
What this method cannot do.
Inference from public signals is not the same as proof of delivery, and we would rather say so here than have you discover it later:
- A person with no public footprint — recent hire, deliberately private, small company with no web presence — produces thin evidence, and thin evidence should produce “unknown”.
- A mailbox deactivated yesterday may still look valid, because public signals lag internal HR changes.
- Domains that publish nothing and follow no discernible convention are genuinely hard, and no amount of inference fixes an absence of information.
- Only observed delivery outcomes are direct evidence about a mailbox, and we only have those for customers who connect their own ESP and consent.
We do not publish a head-to-head accuracy comparison. Our historical benchmark was withdrawn from marketing use because its labels were third-party probabilistic labels rather than observed delivery outcomes. A replacement measured on real customer bounce outcomes is in progress. Until it reports, we compare on method — which you can verify today — and not on accuracy.
Try it on the records you cannot currently call.
Send the addresses your tool marks “risky” or “accept-all” and see what evidence exists. Nothing is sent to any of them.
Review my catch-alls ↗