Enabling SMTP Mailbox Verification Safely

SMTP mailbox verification is off by default for good reason: it’s the one feature that opens an outbound connection, and it behaves differently on every host. Turn it on deliberately and it becomes your strongest filter. Here’s the safe path.

Step 1 — Check outbound port 25 first

Mailbox verification needs outbound port 25, and many shared hosts block it. Spamify runs a one-off connectivity probe: it opens a TCP connection to a well-known public mail server (by default Google’s inbound MX) and closes it immediately without sending any data, keeping only a yes/no "is port 25 open" result cached for up to a week. Check Tools → Site Health or the Advanced settings tab to see the result before you rely on the feature.

If port 25 is blocked, verification will mark most addresses unverifiable — so decide how those are handled (below) before enabling.

Step 2 — Set a sane timeout

The smtp_timeout setting caps how long Spamify waits for each mail server to answer. Too low and slow-but-valid servers get abandoned; too high and a sluggish server delays your form. Start around the default and only raise it if you see legitimate domains timing out in the logs.

Step 3 — Decide what "unverifiable" means to you

The smtp_unverifiable_action setting controls what happens when the mailbox genuinely can’t be confirmed (greylisting, catch-all, blocked port). The safe default is flag for review, not block — so you never turn away a real customer because their provider was cautious. Only switch this to block if you’ve confirmed your host allows clean verification and you’d rather err strict.

Step 4 — Choose your hard-block rules

Two switches decide whether an address is rejected outright:

• hard_block_mx — block when the domain has no valid mail host at all (a strong, safe signal).
• hard_block_smtp — block when the mail server explicitly says the mailbox does not exist.

Both are high-confidence signals, which is why they can hard-block rather than just add to the score. Pair this with sensible flag and block thresholds and you’ll catch dead addresses while leaving the ambiguous ones for review.