How to Build a Super Email Verifier (Four Layers, Real Code)

A "super" email verifier is a pipeline, not a product: cheap local checks first, a mailbox probe second, a stored verdict third, and a send rule at the end. Each layer removes a different kind of bad address.

Most guides on this keyword explain why verification matters. This one gives you the code and the decision table. For tool comparisons, read best email verification tools. For the concepts, read email verification explained.

TL;DR

• Run four layers in order: syntax, DNS, SMTP, then a stored status. Layers 1 to 3 cost nothing and take about 20 minutes to wire up.
• The hard part is the answer "maybe". Catch-all domains return it for every address, so the pipeline needs a rule for it, not a better probe.
• Sizing a list by emailStatus on LeadOcean spends 0 records. Pulling or enriching a person spends 1.

Prerequisites

• Python 3.10 or newer and dig on your path.
• Outbound port 25 for layer 3. Many cloud hosts block it.
• A LeadOcean key in $LEADOCEAN_API_KEY for layer 4. The free plan has 1,000 records for life and no card. The free MCP tool leadocean_count_leads also works for sizing.

Step 1: Reject what cannot be an address

Syntax is the cheapest layer, so it runs first and stays permissive. Reject only what no mail server would accept.

import re

SYNTAX = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]{2,}$")

def layer1(addr: str) -> str:
    if len(addr) > 254 or not SYNTAX.match(addr):
        return "invalid"
    return "pass"

Do not write a clever regex. A strict one rejects real addresses, and a pass proves nothing about the mailbox.

Step 2: Check that the domain can receive mail

If the domain has no mail server, nothing you send can arrive. The check is a DNS query.

import subprocess

def dig(kind: str, domain: str) -> list[str]:
    out = subprocess.run(["dig", "+short", kind, domain],
                         capture_output=True, text=True).stdout
    return [l.split() for l in out.strip().splitlines() if l.strip()]

def layer2(addr: str):
    domain = addr.split("@", 1)[1]
    mx = sorted(dig("MX", domain), key=lambda r: int(r[0]))
    if mx:
        return "pass", mx[0][1].rstrip(".")
    if dig("A", domain):          # RFC 5321: no MX falls back to the A record
        return "pass", domain
    return "invalid", None

RFC 5321 (checked September 2026) is why the fallback to the address record exists. Returning the host saves a second lookup in step 3.

Step 3: Ask the mail server, and accept "maybe"

The SMTP probe asks whether the server would take mail for the address, then quits before any message is sent. It is the only direct test of one mailbox, and the least reliable layer.

import smtplib

def layer3(addr: str, host: str) -> str:
    try:
        with smtplib.SMTP(host, 25, timeout=10) as s:
            s.helo("probe.example.org")
            s.mail("check@example.org")
            code, _ = s.rcpt(addr)
            junk, _ = s.rcpt("zz-no-such-user-91@" + addr.split("@")[1])
    except (OSError, smtplib.SMTPException):
        return "unknown"
    if code == 250 and junk == 250:
        return "catch_all"      # server accepts anything: 250 proves nothing
    if code == 250:
        return "pass"
    if code in (550, 551, 553):
        return "invalid"
    return "unknown"            # 4xx, greylisting, blocked port

The second RCPT TO is the useful trick. A server that accepts a made-up mailbox is a catch-all, so its yes for your address means nothing. Large providers also rate-limit probes, and probing from a shared IP can get it blocklisted. Run this layer from a dedicated host at a low rate, or skip it and use step 4.

Step 4: Read a stored verdict

A stored status is a verdict someone collected in bulk, so you skip steps 2 and 3 for every address in the database. LeadOcean publishes one emailStatus per person. The values are verified, catch_all_valid, catch_all, risky, unknown, untested, invalid, role, disposable, spam_trap, abuse, derived and none.

Size first. The count is free. This is the body for leadocean_count_leads, the MCP tool, with emailStatus set to one value at a time:

{
  "country": ["DE"],
  "jobLevel": ["C-Team"],
  "emailStatus": ["verified"],
  "facets": false
}

Then pull rows over REST. The body is flat JSON, filters are arrays and limit runs from 1 to 100.

curl -s https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"country":["DE"],"jobLevel":["C-Team"],
       "emailStatus":["verified"],"limit":25}'

To check one person you already hold, enrich by linkedin_url, email, phone or person_id, with reveal_email on.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"jane.doe@acme.com","reveal_email":true}'

Two rules from the API reference (checked October 2026) change how you read the answer. On a business address, verified means LeadOcean's own verifier tested it. On a personal address it only means a supplier asserted it. And a verified count at search time is an upper bound, because enrichment applies the stricter per-address rule.

LeadOcean does not verify an arbitrary address you paste in. It returns the status of addresses it holds. For one-off lists from elsewhere, keep layers 1 to 3 in front of your own data.

Step 5: Turn each status into a send rule

The pipeline only helps if every answer maps to an action. This table is the part to bookmark.

SEND = {"verified", "catch_all_valid"}
TRIAL = {"catch_all"}
DROP = {"invalid", "disposable", "spam_trap", "abuse", "none"}

def route(status: str) -> str:
    if status in SEND:  return "send"
    if status in TRIAL: return "trial_batch"
    if status in DROP:  return "drop"
    return "recheck"

LeadOcean gives no refund or credit-back for bounces, so this routing is your protection. Read the status before you send.

What you get

These counts come from leadocean_count_leads on 2026-10-21. The filter is country DE, job level C-Team, plus the single emailStatus shown. All four calls spent 0 records.

As a filter, catch_all also matches catch_all_valid, so that row includes both. The largest group is untested, more than double verified. That is the real shape of any email database: most addresses have simply never been checked. The verified figure is an upper bound at search time.

Enrichment returns a small email object. This is the response shape from the API reference, with placeholder values:

{
  "email": "jane.doe@acme.com",
  "type": "work",
  "status": "verified",
  "verified_batch_date": "2026-09-20"
}

A non-null verified_batch_date means LeadOcean's own verifier tested the address in that run. A null means the status came from a source held to the same standard, not a LeadOcean run. A whole batch shares one date, so it is not a freshness timestamp.

Troubleshooting

FAQ