Twelve layers run in parallel on every address, from a quick syntax check to a live conversation with the mailbox provider. Here's exactly what happens, in order.
This is the dashboard your team logs into. Paste an address, hit verify, and every layer above runs in under a second.
Every address moves through three stages. The moment we reach a confident verdict, we return it, typically in under a second.
We confirm the address is structurally valid per RFC rules: the local part, the @, and a well-formed domain. Malformed addresses are rejected instantly, with no network calls.
Common misspellings of major domains are caught here (gmial.com, hotmial.com) and we surface the correction so you can fix and re-send.
We resolve the domain and read its MX (mail exchange) records. No MX means the domain literally cannot receive email, an instant invalid.
The address is matched against a continuously-refreshed list of temporary and throwaway providers (10-minute mail and the like) so they never pollute your list.
Addresses like info@, support@ and admin@ are technically valid but rarely a real person. We label them do_not_mail so you decide.
Known spam-trap and complaint patterns are screened out. These are the addresses that quietly wreck sender reputation the moment you hit them.
When the mailbox is on Microsoft 365, roughly half of all business email, we use a provider-specific method instead of a naive SMTP probe, because Microsoft deliberately answers “OK” to everything to block guessing.
Google-hosted business domains get their own dedicated path, tuned to how Google's mail servers actually respond, far more reliable than a generic probe.
Personal @gmail.com mailboxes are handled with their own logic, separate from Workspace domains, for a cleaner read on consumer addresses.
For everything else, we open a real SMTP conversation with the receiving server, introducing ourselves properly and asking whether the mailbox exists, without ever sending an email.
Some domains accept every address. We detect this so a catch-all guess is never marked a confirmed valid. You get an honest catch-all instead.
Every signal is weighed into one final verdict, with the honesty rule that if the evidence isn't there, the answer is unknown, never a hopeful guess.
Most tools force every address into "valid" or "invalid." Real email doesn't work that way, so we give you a third, honest option.
The mailbox exists and accepts mail. These are safe to send to. Clean, deliverable addresses.
The mailbox doesn't exist or the domain can't receive mail. Sending here guarantees a bounce, so we filter them out.
The provider blocked verification. Instead of guessing "valid" to look accurate, we tell you the truth: we couldn't confirm it.
About half of all business email runs on Microsoft 365. To stop attackers from harvesting valid addresses, Microsoft deliberately answers "OK" to every mailbox query, real or fake.
That means nobody, not us and not the big names, can be 100% certain on every Outlook address. It's physics, not a feature gap.
Most tools hide this by labelling their best guess "valid." Kluno labels it unknown. You get fewer surprises, fewer bounces, and data you can actually trust.
A competitor would show this as "valid" and hope. We'd rather be honest.
Run your emails through all 12 layers. Start free with 500 verifications a month, no credit card.