What a mailbox-level check tells you
Most "validators" only check that a string looks like an email. That catches typos and nothing else: [email protected] is perfectly valid syntax and perfectly dead. A real verification talks to the domain’s mail infrastructure. It confirms the domain can receive mail at all, then asks the server about the specific mailbox, and returns a verdict with a named reason.
The reason is the useful part. "Mailbox rejected" means a send will bounce. "Disposable" means the inbox will be dead in minutes and the signup behind it is probably farming a trial. "No MX" means the whole domain has no mail server: nothing sent there will ever arrive. "Risky" means the server accepted but showed signals worth respecting. Each verdict maps to a different decision, which is why a bare true/false is not enough.
The check is read-only and invisible to the address owner. No email is sent, nothing lands in anyone’s inbox, and a repeat check of the same address is served from cache, free.
Why bounce rate is the metric that hurts
Gmail, Outlook, and every serious mailbox provider keep a score on the domains that send them mail. A high bounce rate is the loudest possible signal that a sender is careless or scraping, and the penalty is quiet and brutal: your legitimate mail starts landing in spam, for everyone, including the addresses that were fine.
This is why verification belongs before the send, not after. Cleaning a list after a campaign already cost you the reputation damage. Verifying at the point of entry, on the signup form, at CSV import, before a sequence launches, keeps dead addresses out of your system entirely.
The economics are lopsided in your favor: a verification costs a single credit, and a damaged sender domain can take months to recover.
The verdicts that need judgment
Two results deserve a closer look. A catch-all domain accepts mail addressed to anything, so the server saying yes proves nothing about the specific mailbox. The verifier flags this instead of pretending certainty; the full API goes further and cross-confirms individual mailboxes on catch-all domains against the identity graph, which is how addresses on those domains still come back verified.
A "risky" verdict means the mailbox accepted the check but showed signals worth caution: treat it as sendable with your eyes open, not as a clean pass. Whether that risk is acceptable depends on what you are sending: fine for a receipt, worth thinking about for a cold sequence where every bounce is expensive.
Whatever the verdict, you get it with a name attached, so the policy stays yours: block disposables at signup, hold risky addresses for review, and send to confirmed mailboxes with confidence.