New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
SMTP verification servers
Hi,
After more than a year using many ionos VPSs at $1/month/VPS to do SMTP verifications, without ever sending any email, I'm looking to scale a bit more by switchint to another provider.
Requirements are:
- Port 25 being open
- Initial reputation being fine: No email will be sent, I'm stopping at RCPT TO and never sending DATA. I do not expect to affect the reputation of the IPs but I need it to be clean otherwise verifications won't go through
- Many IPs over different subnets, not just packed as continuous IPs. Can be multiple VPSs, or a single VPS with many IPv4 attached to it
Thanks for your time
Comments
We can do server+/24 IPv4 for $200/mo
https://hostcram.com/ip-rental
We're open SMTP ports (25, 465, 587).
However, IP addresses depends on the pool availability. May I know how many IP Addr you needed?
Really? Can I send spam from your IP ranges then for 7$? Please announce them, so that we can successfully block your ASN. For spammers, I think AI bots will catch on this.
I'm not gonna block a provider because they allow mailing, that's just stupidity.
Are we saying that we allow spam and unsolicited emails for illegal activities?
Stupidity is on your side then. Bulk mailing? Seriously?
This is like a canon shooting spam, in 2026.
I don't expect mail traffic from such providers.
Unless I got something wrong, you pretty much stated that.
And I know how to read, also sarcasm, so whats the verdict?
Who said anything about bulk mailing? Why do you think mailing should be restricted to more expensive providers?
More expensive providers aren't immune to spammers. You should block 0.0.0.0/0.
And I know how to read, also sarcasm, so whats the verdict?
You're wrong, we're totaly against any spam and unsolicited email activity.
So why did you reply in "SMTP verification?" thread? Maybe you don't allow spam,
which is a good practice. My only question is, why do you say:
We're open SMTP ports (25, 465, 587).
which is a good practice. My only question is, why do you say:
I don't understand what you're thinking at all. I hope you don't think that allowing SMTP ports means spam is allowed.
Some of our IP space, which we rent from @IPXO , means we MUST be responsible for any activity that could impact IP usage, including email. Therefore, we are against any spam activity. From this point I think you understand what I mean.
If you're curious about our answer [We open SMTP ports (25, 465, 587)]
That's because we want to ensure 100% of SMTP ports are open, and the post "asks" that port 25 be open, so we want to ensure we open all SMTP ports.
And this will make it easier for our clients, not only SMTP 25, they can use 465, 587, 2525, we facilitate it as long as the activity is legal.
@orangevps
I'm currently using 25 $1/month IONOS servers (=> 25 IPs) for this, and was considering increasing that to 50.
FYI, after more than a year I've had no reputation issues with those IPs. No email is ever sent by the verification pipeline, it stops at RCPT TO and never sends DATA.
Considering the drama this thread somehow created: my internal admin panel can also send/receive email through those servers, separately from the verification pipeline. So if useful, I can send a test from these IPs and you can check its current reputation/deliverability yourself.
Hope that eases the tensions
i'm just curious what this actually means..
@zed
Here's a mocked SMTP trace of "[email protected]" sending an email to "[email protected]":
For many mail servers, the response to "RCPT TO" tells you whether the recipient exists: an invalid mailbox may get a "550" code for the rejection, while a valid one gets accepted. To go in further details, some don't bother respecting any code and return 2XX to all but use a text to differentiate success from failure, sometimes even in their local language, so you have the joy of needing to bring NLP into the mix.
Email verification, commonly used by B2B services, takes advantage of this by stopping after "RCPT TO" and never sending "DATA".
So the SMTP conversation happens, but no email body is ever submitted, which leads to the exchange being aborted and no email being sent.
Domains that accept arbitrary recipients at "RCPT TO" are generally treated as catch-all/accept-all, in which case SMTP verification can't reliably determine whether that specific mailbox exists.
ah thanks. so why do you need >25 ips to rotate thru?
@zed
Each anti-spam has it's own implementation, and some can block before the RCPT TO step, even if you're not spamming as no email is ever sent. That's the case of mainly ProofPoint and SpamHaus, which is an arbitrary decision as for example Gmail doesn't act as a Catch-all (=> Emails are verifiable) and never block at the RCPT TO.
You therefore need to pass the most limiting threshold, which means you need to worry about basic security things (Allow TLS when receiving emails, pass DKIM, DMARC & SPF), warm up appropriately, have a domain per IP and many other things to scale horizontally.
That way, you get X times the lowest threshold. You also need them on different subnets rather than being consecutive, because the reputation is calculated at the domain, IP and subnets levels
Because people probably tend to block those IPS when discovered. As those are methods used by those "no more bounces" services.
yes yes but i wanted him to say it
For this I'd probably recommend a large provider similar to Hetzner because I think the majority of providers here won't have lots of subnets or are unwilling to put the effort into doing that specifically for you.
I wouldn't really say "block when discovered", as many reputable companies like ZoomInfo do it as part of their business. But there's a fine line between verification and enumeration, which is why it needs a barrier of entry where everyone has to play nice, not put pressure in the servers infrastructure, not spam, not enumerate etc. If there was absolutely no protection, anyone with a port 25 open could enumerate tens of thousands of domains in parallel. Major anti-spams providers can absolutely know easily which IPs are used by ZoomInfo to probe domains, just spin up your own domain and use their service to probe yourself and you'll quicky get a map of their IPs. They don't because they play nice, and so am I.
And they rarely rotate their IPs if ever as again, they're not "hiding" it as hiding it isn't really possible at scale.
Forcing horizontal scaling means increasing the infrastructure costs and complexity, putting it out of reach to most script kiddies but keeping companies in. That being said, LLMs might close the gap now.
Yeah, that's why I'm currently with IONOS but I saw this forum and wondered if anyone had something to offer that would allow me to scale a bit more, for more money obviously
Against people like you.
I didn't expect such a drama to unfold, but I guess it's worth stating: No anti-spam aside from ProofPoint & SpamHaus care about verification at most threshold, as no email is sent, and there's a ton of anti-spams, if email verification was something they considered really problematic, it would be the industry's standard.
What drama? if you try to deliver mail to my inbox, at least make an effort.
Low effort "RCPT TO" will go to spam, VRFY command wil let you in my firewall.
Try to deliver your spam to big corps, let's see. No wonder you are looking.
I forgot to mention rspamd against spammers. Pretty sure you will fall in that category.
@luckypenguin I think there's just a misunderstanding here, I really only do verifications, so no, I don't "try to deliver mail to [your] inbox". VRFY is poorly supported, so RCPT TO is the only real way to do it. I have no intent even in the long term to send any email through them. I understand you don't believe me, but as I cannot magically prove it to you in a way you'd trust, I don't think this discussion is worth continuing.
With many different IP addresses and ranges, we may not be able to provide this service. Good luck finding this provider!