1

I want to verify whether mail box exists for a email with SMTP. I am able to do following things :

  1. Get MX records from domain
  2. Connect to host via SMTP

Then I execute following commands :

  HELO somedomain.com
  MAIL FROM:<[email protected]>
  RCPT TO:<[email protected]>

Above commands give me 250 response for invalid emails on my local machine. But when I verify the email on some online service I get 554 response (which is correct). What is the reason behind this weird behavior (invalid results on local machine) ?

2
  • What happens when you use VRFY instead of RCPT TO:?
    – TheCleaner
    Oct 17, 2013 at 14:02
  • @TheCleaner It gives 502 Command Unimplemented
    – vedarthk
    Oct 17, 2013 at 14:08

2 Answers 2

1

Your RCPT TO: should get a 550 not a 554 technically if the mailbox doesn't exist. A 554 is used if the command fails (such as an invalid command syntax) However, like Gryphius said a lot of mail servers will respond with a 250 if the syntax used is valid. It isn't checking yet to see if the actual mailbox exists OR it simply doesn't want to tell you if the address exists or not.

The VRFY command is technically what the SMTP protocol "should" be using for verifying if an email address exists or not. But quite a few prominent mail services don't really allow for VRFY or again, simply say "Not sure, but I'll try to deliver it".

The reason that a lot of SMTP "servers" respond with 250 OK is because often they are just front end gateways for other mail servers or a "hop" in the sequence. So they will let another server down the chain handle whether the address is valid or not. Other times mail servers don't want someone to iterate through various email addresses hoping to get a list of invalid vs. valid.

2
  • I get what are you saying but how come I get different result for the same email on my local machine than that on a service like verify-email.org ?
    – vedarthk
    Oct 18, 2013 at 10:27
  • @vedarthk - are the commands identical between what you are sending and what verify-email.org is sending?
    – TheCleaner
    Oct 21, 2013 at 12:55
0

you can't rely on SMTP to do recipient verification. many mailservers only check recipient adresses after the mail has been accepted into the local queue. if the recipient account does not exist, they send back a bounce. ("accept-and-bounce" behaviour).

2
  • I am curious how verify-email.org give me correct results for the same procedure which gives me incorrect results on my local machine.
    – vedarthk
    Oct 17, 2013 at 13:51
  • Accepting and then bouncing is also called "backscattering" and is considered as a very bad configuration, as this allows to send out bounce spam via a faked sender address. This can also put your mailserver on a lot of blacklists. A correctly configured mailserver should always verify first before accepting the mail.
    – etagenklo
    Oct 17, 2013 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .