How We Verify Emails: The Honest Two-Tier Approach

The short version

Every email in a Lyre Leads export carries one of two labels:

• Verified — an SMTP verifier opened a real conversation with the recipient's mail server and the server confirmed this specific mailbox accepts mail. Typical bounce rate: under 2%.
• Pattern-matched — the company's mail server accepts everything (catch-all configuration), so no individual mailbox can be verified. But we've SMTP-verified at least three other people at the same company using the same email format, and we've applied that format to a fourth person. Typical bounce rate: 3-8%.

Emails we can't fit into either tier don't get returned. You get the person's name and LinkedIn, no email. We'd rather ship a name-only row than dress a guess as verified.

What "verified" actually means

When you see a "verified" label, this is what happened behind it: our verification provider (MillionVerifier) established a TCP connection to the recipient's mail server, went through the SMTP handshake, and issued a RCPT TO: command with the specific address in question. The server either responded with a 250 code (mailbox exists, accepts mail) or a 550 code (mailbox does not exist). We only mark as verified the addresses that got the 250.

This is the strongest confirmation possible short of actually sending a message. It confirms three things: the domain is real and has valid mail servers, the specific mailbox exists, and the mailbox accepts mail from the outside world. Combined with syntax checks, spam-trap filtering, and disposable-domain detection, a verified email in our platform has a false-positive rate roughly matching MillionVerifier's own published accuracy: about 1-2%.

That number is small enough that verified emails should be safe to send at your normal sending cadence without warming or throttling, provided your sending domain is already in good standing.

What catch-all is, and why every tool has this problem

A catch-all domain is one whose mail server is configured to accept every incoming message, regardless of whether the specific mailbox in the To: field actually exists. It's a common setup at larger companies — the mail team enables it so that typos, forwarded addresses, and legacy aliases don't bounce. Estimates vary but roughly 30-40% of B2B SaaS domains run some form of catch-all in 2026.

The consequence for email verification is absolute: SMTP verification cannot tell you whether a specific mailbox on a catch-all domain exists. The server answers "yes" to every RCPT TO: including nonsense addresses like [email protected]. This isn't a bug in verification tools; it's how the SMTP protocol responds when the server owner configures it this way.

Every email verification tool on the market — Findymail, Hunter, Snov.io, Prospeo, Icypeas, ContactOut, Wiza, us — hits this wall the same way. What varies is how each tool handles it after the wall.

Our two tiers: verified vs pattern-matched

We built a strict vocabulary of exactly two categories, plus "no email returned."

Verified

SMTP-confirmed individual mailbox. Domain is not catch-all. This category is what most other tools mean when they say "valid" or "verified" — but for us it is only ever this, never anything softer.

Pattern-matched

Domain is catch-all. The specific mailbox cannot be individually confirmed. But: we have SMTP-verified emails for three or more other people at the same company, and all three (or more) used the same localpart format — for example, all [email protected]. In that case we predict a fourth person's email using the same format. This is a statistical prediction, not a verification.

The three-sample threshold is a deliberate trust bar. With one confirmed email at a company, the pattern could be a one-off vanity address. With two, it could still be a coincidence. At three or more, the probability the company uses a different format for a fourth person drops below 10%; at five or more, below 3%. We chose three as the minimum where the signal is strong enough to be useful while still remaining honest that it's a prediction.

No email returned

Catch-all domain with fewer than three verified samples, or a domain where all pattern candidates failed SMTP verification. You get the person's name and LinkedIn URL if we found one, but no email. This happens more often than we'd like, and we'd rather ship this than a guess dressed up as data.

What you should do with each label

Verified: send at your normal cadence. Bounce risk is under 2%, which is well below the thresholds that hurt sender reputation with Gmail, Outlook, and the major ESPs.

Pattern-matched: we recommend a small warmup send first. Split the batch: send a small opening batch (say 50 emails), watch your bounce rate on that batch alone, and only proceed with the full batch if bounces stay in the single digits. Pattern-matched emails typically bounce 3-8%; on a batch of 500 that could be 15-40 bounces, which is enough to notice in your sender reputation depending on your domain's health.

No email: reach out on LinkedIn, or add the email manually if you have it from another source. We provide the person's name and role so the LinkedIn path is straightforward.

Why the industry doesn't distinguish the two

Most email finders in 2026 fold pattern-matched addresses into their "valid" or "verified" totals. They usually disclose this — buried in an FAQ or a knowledge-base article — and often back it with a bounce guarantee (typically under 5%, refund on credits if exceeded).

That guarantee is real, and the tools that offer it are not lying. But it has two properties worth understanding:

1. The refund is on credits, not on damage. If your bounce rate ticks up past a threshold and your sending domain gets throttled or spam-foldered by Gmail, no credit refund makes you whole. The damage lives on your sender reputation for weeks or months.
2. The headline coverage number gets inflated by the ambiguity. When a benchmark reports Tool X at 65% coverage, that number counts pattern-matched addresses as full "found" — the same as SMTP-verified ones. Comparing Tool X's 65% to our old published number felt unfair on our side; comparing it to our two-tier breakdown (verified % + pattern-matched %) is the honest side-by-side.

We chose to label the two categories separately because we think the distinction matters to the person who ends up sending the email. If you know which is which, you can pick your sending strategy per tier. If everything is one bucket, you're relying on the tool's guarantee to absorb risk it doesn't actually absorb — because the credits it refunds cost cents while a burned sending domain costs weeks.

Our commitment

Two rules we won't break:

1. A pattern-matched email will never be labeled as verified anywhere in Lyre Leads — not in the UI, not in exports (CSV, XLSX, JSON), not in the API response. The email_tier field on every returned contact carries the honest label. If you rely only on email_tier === 'verified', you get exclusively SMTP-confirmed mailboxes.
2. We won't return a pattern-matched email on a catch-all domain unless we have at least three SMTP-verified samples showing the same email format. If you see a pattern-matched email in your export, at least three of that company's employees have real, working addresses using that exact format.

Both rules are enforced in code (see PATTERN_MATCH_MIN_SAMPLES in our email pipeline). Changing the threshold or blurring the tier would require a code change and a commit in our public GitHub history, so this is not just a policy — it's a technical constraint we've placed on ourselves.

On bounce rates and what we do (and don't) claim

We do not publish a public bounce number today. The reason is simple: we can't measure it. Once you export an email from Lyre Leads and send it from your own ESP, we don't see the bounce. The bounce lands in your account, not ours.

What we can measure — and will start publishing once we have meaningful volume — is the bounce rate on emails we send from Lyre Leads for our own outreach. That number will be a lower bound on what customers should expect (our sender reputation may be better or worse than any given customer's), but it will be an honest ceiling on how well the verification pipeline is doing.

Until then: if someone quotes a headline bounce rate on any email tool without showing you their measurement methodology, treat it as marketing copy, not evidence.