email-verifier

# Email Verifier Verify whether email addresses are deliverable by connecting to the recipient's mail server and checking if it accepts the address — without actually sending any mail. ## How It Works 1. **MX Lookup** — Resolves the domain's mail exchange server 2. **SMTP Handshake** — Connects to the MX server on port 25 3. **RCPT TO Check** — Asks the server if it would accept mail for the address 4. **Catch-All Detection** — Tests a random address to detect catch-all domains ## Dependencies ```bash pip3 install dnspython ``` ## Usage ### Single or multiple emails ```bash python3 scripts/verify_email.py user@example.com another@domain.com ``` ### From stdin ```bash echo "user@example.com" | python3 scripts/verify_email.py --stdin ``` ### From CSV (e.g., a lead list) ```bash python3 scripts/verify_email.py --csv leads.csv --email-column "Contact Email" ``` ### Options - `--helo DOMAIN` — HELO domain for SMTP greeting (default: verify.local) - `--timeout SECONDS` — Connection timeout (default: 10) ## Output JSON array to stdout. Each result contains: ```json { "email": "user@example.com", "domain": "example.com", "mx_host": "aspmx.l.google.com", "smtp_code": 250, "smtp_response": "2.1.5 OK", "deliverable": "yes" } ``` ### Deliverability values | Value | Meaning | |-------|---------| | `yes` | Server accepted the recipient | | `no` | Server rejected the recipient (invalid) | | `catch-all` | Server accepts all addresses — cannot confirm inbox exists | | `unknown` | Could not determine (timeout, block, greylisting) | ## Rate Limiting The script includes built-in rate limiting to protect your IP reputation: ```bash # Defaults: 1s between checks, max 20 per domain before 30s pause python3 scripts/verify_email.py --csv leads.csv --email-column "Contact Email" # Conservative: slower checks, lower burst limit python3 scripts/verify_email.py --delay 3 --max-per-domain 10 --burst-pause 60 email@example.com # Aggressive (not recommended from residential IPs) python3 scripts/verify_email.py --delay 0.5 --max-per-domain 50 email@example.com ``` ### Options - `--delay SECONDS` — Pause between each check (default: 1.0) - `--max-per-domain N` — Max checks to one domain before pausing (default: 20) - `--burst-pause SECONDS` — How long to pause after hitting the per-domain limit (default: 30) ### Why rate limiting matters SMTP verification connects directly to mail servers. Without rate limiting: - **Your IP gets blacklisted** — Mail servers (especially Gmail, Microsoft) flag IPs that make many rapid RCPT TO requests. Once flagged, your IP may be blocked for hours or permanently. - **Port 25 gets blocked** — ISPs monitor outbound port 25 traffic. Unusual volume can trigger automatic blocks. - **Greylisting increases** — Servers that see rapid-fire checks start returning temporary failures, making your results less accurate. - **It looks like spam reconnaissance** — Because that's exactly what spammers do. Legitimate use requires responsible pacing. ### Guidelines for agents | Scenario | Recommended settings | |----------|---------------------| | Quick spot check (1-5 emails) | Defaults are fine | | Small lead list (10-50 emails) | `--delay 2 --max-per-domain 15` | | Larger batch (50-200 emails) | `--delay 3 --max-per-domain 10 --burst-pause 60` | | Bulk verification (200+) | Use a dedicated service (ZeroBounce, NeverBounce) instead | **Rule of thumb:** Stay under 50 unique domain checks per day from a residential IP. For repeated checks to the same domain (pattern guessing), stay under 15 per session. ## Limitations - **Catch-all domains** accept all addresses; a "yes" doesn't guarantee a real inbox - **Some servers block** SMTP verification (disconnect or timeout) — result will be "unknown" - **Greylisting** temporarily rejects first attempts by design - **Rate limiting** — don't bulk-verify hundreds from one IP; use a dedicated service for large lists - **Port 25 blocked** — some ISPs/networks block outbound port 25; won't work from those environments - Residential IPs may get flagged if used heavily — for bulk verification, prefer services like ZeroBounce or NeverBounce