How to verify a Gmail address

Gmail is the most common provider on almost any list, which makes it the one most worth getting right. The mistakes are specific to Gmail, though — they aren't the same issues you hit with Yahoo or Outlook — so this page is about how Gmail in particular behaves, and how to verify a Gmail address without sending anything.

Dots and +tags: the deduplication trap

This is the quirk that quietly inflates lists. On @gmail.com and @googlemail.com, Google ignores every dot in the name and everything after a +:

All four rows are the same mailbox. A list of 1,000 "different" Gmail addresses can hold hundreds that resolve to a few hundred real inboxes. That costs you three ways: you pay to verify each string, you mail the same person several times (a fast route to spam complaints), and your headline list size is bigger than the number of humans behind it.

charlymail canonicalizes each Gmail address — collapsing dots and stripping the +tag — into a normalized form, then catches the collisions a raw exact-match dedupe misses (ivan.petrov@ vs ivanpetrov@). When a list has a lot of these, the report flags it directly: a share of your addresses are aliases from Gmail plus/dot tricks, meaning there are fewer real people than rows.

One boundary worth stating: this dot-and-tag behavior is a @gmail.com / @googlemail.com thing. A business on Google Workspace — Gmail running on their own custom domain — can have different rules, because the domain administrator sets them. Don't assume every Google-hosted domain ignores dots; only consumer Gmail reliably does.

Gmail's format rules are stricter than the email standard

The general email spec is permissive, but Gmail enforces a narrower shape on its own addresses. In practice a valid consumer Gmail name is:

• lowercase letters, digits and dots only;
• 6 to 30 characters, not counting @gmail.com;
• no leading or trailing dot, and no double dots.

The practical upshot: an address like ab@gmail.com (too short) or one with a _ or a leading dot looks like a plausible email but Gmail will never accept it — it's a guaranteed bounce. A good verifier rejects those on the cheap syntax pass, before spending an SMTP request on something that can't exist. That's a small saving per address that adds up across a list.

Why Gmail addresses come back as "risky"

When you verify a Gmail address over SMTP, Google's server tends to accept mail at the RCPT TO stage for almost anything and works out delivery afterward. That's good for its own deliverability and inconvenient for verification: a raw check can read as a yes even for an address that will later bounce.

So when there's no dependable answer — an ambiguous response, a Workspace domain configured as catch-all, or a timeout — the honest move is to mark the address risky, not "valid." charlymail treats a catch_all or unknown SMTP result as risky rather than passing it off as confirmed. There's no secret Gmail-specific SMTP trick doing this — Gmail goes through the same verification path as every provider; what differs is how honestly the ambiguous result is labeled.

It helps to know what "risky" is not: it isn't a soft way of saying "probably dead." On Gmail a risky verdict usually means the server wouldn't commit either way — most often a Workspace domain that accepts everything. Those addresses can be perfectly live; you just can't prove it without sending. The practical call is to keep risky Gmail addresses out of your first, most important send and re-check them later, rather than either trusting them blindly or discarding real contacts.

How to verify a Gmail address without sending an email

For one address you can do it manually: check the domain's MX records (they'll point to *.google.com / aspmx.l.google.com), open an SMTP session, and read the RCPT TO response — no message sent. For a list, do it in two passes so you don't pay the deep-check price on addresses that were never going to work:

1. Cheap first pass — Gmail syntax rules (above), MX lookup and provider detection, at $0.00049 per address. This alone rejects malformed names and identifies the Gmail addresses.
2. Deduplicate by canonical form — collapse dots and +tags before you pay to check, so you never SMTP-verify the same inbox twice.
3. Deep SMTP check — run mailbox-level verification only on the survivors, and only on the ones you actually intend to mail.

At no step do you send a message to the recipient — that's the whole point of verifying a Gmail address without sending an email: you learn whether the mailbox will accept mail without risking a bounce or hitting a spam trap.

The order of those steps matters for Gmail specifically. Because of the dot-and-tag aliasing, deduplicating before the deep check is where the real saving is — on other providers dedupe and verification are roughly independent, but on a Gmail-heavy list a canonical-form dedupe can cut the number of addresses you pay to SMTP-check noticeably, since so many rows collapse to the same inbox. Skip that step and you literally pay to verify the same mailbox two or three times.

Common questions