Skip to content
Spaw
Get your API key

Mailbox handshake

published · September 10, 2026

A mailbox handshake is an SMTP conversation opened with a domain's mail server as far as the RCPT TO step and abandoned before any message is sent.

A mailbox handshake is an SMTP conversation opened with a domain's mail server as far as the RCPT TO step and abandoned before any message is sent. The server's response to that one command is what says whether a mailbox exists. No mail is transmitted, so nobody receives anything.

What Spaw answers

smtp_checked says whether the handshake ran, smtp_checked_at when, mailbox_exists what it established, and smtp_reason why it could not establish anything when it could not — greylisted, timeout, no_connect, mx_unreachable, provider_unavailable and the rest.

When it runs, and when it does not

The handshake is the only part of an email lookup that leaves this server, so it is gated deliberately. It runs only when the domain's MX accepts mail and no free signal has already settled the address: a disposable domain, a typo-squat or a local part the provider's own rules reject is answered from DNS and open lists alone and never leaves Spaw.

A mailbox the handshake could not confirm is reported risky with the reason unverified. It is never reported deliverable — that word is reserved for a mailbox a server confirmed.

Related

markdown version: /glossary/mailbox-handshake.md

Verify addresses the same way

The Spaw API runs every check described here on each lookup, with an SMTP handshake that never sends mail. 10 free lookups a month, no card required.

Get your API key

More glossary

  • ASN

    An Autonomous System Number identifies one network that announces its own routes to the internet under a single routing policy.

  • Address register

    An address register is a country's official file of every address its authorities recognise, usually keyed on buildings rather than letterboxes.

  • CIDR

    CIDR notation writes a range of IP addresses as one address and a prefix length, so 203.0.113.0/24 means the 256 addresses sharing those first 24 bits.

  • Catch-all domain

    A catch-all domain is one whose mail server accepts mail addressed to every recipient, whether or not that mailbox exists.

  • Check digit

    A check digit is a digit computed from the rest of an identifier so that a mistyped one usually fails arithmetic before anybody looks it up.

  • Company number

    A company number is the identifier a national registrar assigns to an incorporated company, unique within that register and never within the world.

  • Credit

    A credit is the billing unit of the whole API: one credit buys one fresh lookup that produced a usable answer, on any of the six signals.

  • Datacenter IP

    A datacenter IP is an address inside a range operated by a hosting, cloud or server provider rather than by a consumer access network.