Every email in a LeadMerlin export comes with a status. It’s tempting to read it as “good” or “bad”. It’s more useful to read it as “how much do we actually know about this mailbox?” This post explains each status, how we get it, and what to do with it.
How an address gets checked
Each address found on a business’s website goes through up to three steps:
- Syntax. Is it shaped like an email address at all? Typos and scraped junk stop here.
- MX lookup. Does the domain publish mail servers? A domain with no MX records cannot receive email.
- Mailbox check (SMTP). We connect to the domain’s mail server and ask whether it would accept mail for that address, without sending anything. Then we ask the same about a random address that can’t exist on that domain, to spot servers that say yes to everything.
Step 3 only works when the mail server answers honestly. Many don’t: they time out, greylist unknown senders or refuse to say. When that happens the address keeps the status it earned in step 2.
The four statuses
| Status | What we know | What it doesn’t prove |
|---|---|---|
| verified | The server accepted this exact address and rejected a random one on the same domain. | That a human reads it, or that your email lands in the inbox. |
| catch-all | The server accepts mail for any address on the domain, so we can’t tell whether this one is real. | That it bounces. Many catch-all mailboxes are real and read. |
| unverified | The domain has working mail servers, but the mailbox check wasn’t possible or didn’t give a clear answer. | Anything about the mailbox itself. |
| invalid | The address is malformed, the domain has no mail servers, or the server rejected the address. | — |
Two extra flags sit next to the status:
- is_role_based: the local part is a shared inbox like
info@,office@orsales@. Fine for small local businesses, where the owner often readsinfo@personally. - is_free_provider: the address is on Gmail, Yahoo, Outlook and similar. Common for small trades, and often the owner’s own inbox.
Which address ends up in “best email”
When a site lists several addresses we pick one as the best email. Invalid addresses are never picked. An address on the business’s own domain wins over third-party addresses (booking widgets and site builders often leak their own support addresses). After that, verified beats catch-all, which beats unverified, and a personal address beats a role-based one.
Which to send to
A rule that holds up for most cold outreach to local businesses:
- verified: send.
- catch-all: send, but in smaller batches, and watch your bounce rate closely for the first few days.
- unverified: send only from a warmed-up domain, at low volume, or run them through a second verifier first.
- invalid: don’t send. Call instead if there’s a phone number.
If your bounce rate climbs above a couple of percent, pause and cut the list back to verified only. Your sending domain’s reputation is worth more than any single campaign.
What no status can tell you
A verified mailbox can still be ignored, filtered to spam or read by a receptionist. Verification protects your domain from bounces. Relevance, timing and a clear offer are what get replies. Our CAN-SPAM checklist for local outreach covers the legal side, and our email domain checker shows whether your own sending domain has SPF and DMARC set up.
Try it on your niche
Pick a niche and a city and check the statuses yourself. Your first 100 leads are free, no card needed.