What are typical validation accuracy benchmarks?

Most reputable email validators land somewhere between 90% and 98% accuracy on what we call "normal" mailboxes. Normal here means a regular consumer or small business mailbox at a provider that actually answers SMTP probes honestly. Gmail, Yahoo, Outlook.com personal accounts, most small business mail hosted on Google Workspace or Microsoft 365, and most ISP-hosted mailboxes fall into that bucket. On those, a good validator will tell you with high confidence whether the address exists, whether it's a known spam trap pattern, whether the domain has working MX records, and whether the mailbox is full or disabled.

That accuracy number falls off a cliff on four kinds of servers, and it's worth understanding why before you trust any vendor's marketing.

Catch-all domains. A catch-all domain accepts any address at that domain, then sorts (or trashes) it internally. SMTP probes return a positive response for anything@catchalldomain.com, even garbage like asdfqwer@catchalldomain.com. The validator has no way to know if the address actually routes to a real human inbox or gets dropped into a black hole. Honest validators label these as "unknown" or "risky" rather than guessing. Roughly 15% to 25% of B2B domains are catch-all in our experience cleaning lists.

Role accounts. Addresses like info@, support@, sales@, admin@, noreply@ technically exist and accept mail. The validator will mark them "valid." But they're often shared inboxes, distribution lists, or unattended aliases, which means high complaint rates and low engagement when you send marketing to them. RFC 2142 defines the role address conventions, and most reputable validators flag these as a separate category for a reason.

Corporate mail servers. Big enterprises run Barracuda, Proofpoint, Mimecast, Cisco IronPort, and similar security gateways in front of their Exchange or Microsoft 365 tenants. These gateways are designed to lie to SMTP probes. They'll greylist, tarpit, accept-and-bounce, or just refuse to confirm whether a mailbox exists, specifically to defeat email harvesting and validation. A validator probing john.smith@bigcorp.com may get a "450 try again later" forever, or a fake "250 OK" that has nothing to do with whether John actually works there.

Privacy-protected and forwarding services. Apple Hide My Email, Firefox Relay, SimpleLogin, DuckDuckGo Email Protection, and similar services route mail through proxy domains. The probe sees the proxy accepting mail but can't tell you anything about the real human behind it, including whether they still want your emails.

The takeaway: no validator hits 100%, and any vendor claiming otherwise is either lying or counting wrong. We've audited vendor accuracy claims by sending controlled batches to known-good and known-bad seed addresses, and the marketing numbers never match reality. The math doesn't work because the SMTP protocol itself doesn't give you ground truth on catch-all or hostile-corporate domains. A vendor selling you "99.9% accuracy" is selling a number they cannot verify.

How to think about it instead. Don't shop for a single accuracy percentage. Shop for:

1. Honest labeling. Does the validator separate "valid" from "catch-all," "role," "disposable," "role corporate," and "unknown"? Lumping everything into valid/invalid is a red flag.
2. Trap detection. Does it have its own spam trap intelligence layered on top of SMTP probing? See why list hygiene matters for deliverability for why this matters more than the headline accuracy number.
3. Honest "unknown" handling. A validator that returns 5% to 10% "unknown" on a typical B2B list is being honest with you. One that returns 0% unknown is hiding catch-all and corporate-server uncertainty inside "valid."
4. What you do with the result. Even with a 95% accurate validator, what kills your reputation is what you send to the "risky" tier, not the unrecoverable typos. See how to measure list quality and validation vs verification vs cleaning for the segmentation work that has to follow validation.

For context on benchmark targets that actually matter (the ones your mailbox provider cares about), Google's Postmaster guidelines and the M3AAWG sender best practices are the documents to read. They focus on bounce rates, complaint rates, and engagement, which are downstream of validation accuracy but more directly tied to whether your mail hits the inbox.

Validation is one input. Reputation is the output. Treat the 90% to 98% number as a sanity check on your vendor, not as the goal.