Is this email address live? Ask the mail server, then fix it in Cloudflare

Today I wanted to know a simple thing: will mail to [email protected] actually reach me? My main address is [email protected], and people often guess the long form. I did not want to send test emails and wait. So I asked the mail server directly. (All addresses in this post are examples on example.com.)

The setup

My domain uses Cloudflare Email Routing. There is no mailbox. Cloudflare receives the mail and forwards it to my Gmail, one rule per address. To reply from an address on my domain, Gmail uses "Send mail as" with its own SMTP server.

DNS looked fine: MX records point at route1/2/3.mx.cloudflare.net, SPF includes both Cloudflare and Google, and DMARC is set. But DNS only says the domain takes mail. It says nothing about a single address.

One SMTP command tells you the truth

A mail server says if it will accept an address before you send any message. You open a connection, say who you are, and ask with RCPT TO. A 250 reply means yes. A 550 reply means the address does not exist. Cloudflare wants TLS first, so plain RCPT TO gave me 500 command unrecognised until I added STARTTLS.

import smtplib

for rcpt in ["[email protected]", "[email protected]", "[email protected]"]:
    s = smtplib.SMTP("route2.mx.cloudflare.net", 25, timeout=15)
    s.ehlo("mail.example.org")
    s.starttls()
    s.ehlo("mail.example.org")
    s.mail("[email protected]")
    print(rcpt, s.rcpt(rcpt))
    s.quit()

[email protected]      (250, '2.1.0 Ok')
[email protected]  (550, '5.1.1 Address does not exist.')
[email protected]    (550, '5.1.1 Address does not exist.')

So the answer was no. Anyone who wrote to the long form got a bounce. The random address also failed, which told me the catch-all is off. That is what I want, but it means every alias needs its own rule.

Adding the rule

In the Cloudflare dashboard this now lives under Email Service, then Email Routing, then Routing rules. Create routing rule: pattern jane.doe at example.com, action "Send to an email", destination my Gmail. Save. Later I added [email protected] the same way, so there are now seven rules.

Right after saving, the probe still said 550. The rule was not live yet. I ran the probe in a loop every 15 seconds, and it switched to 250 within about a minute, both times. So if you test right after you save and it fails, wait a minute before you start debugging.

The overview page also showed something I did not expect: 149 messages received in the last 7 days, and 132 of them failed. Most of that is probably spam sent to guessed addresses. But some of it could be real people writing to an alias that did not exist yet, like the long form. That number alone was worth the look.

Gmail Send mail as: two errors that look the same

To reply from the new address, I added it in Gmail under "Send mail as" with smtp.gmail.com, port 587, TLS. It failed twice with the same message: "Authentication error. Check your username and password."

The first time the username was right, my real Gmail address. The problem was the password. With 2-Step Verification on, Google does not accept the normal account password over SMTP. It needs an App Password, a 16-character code from myaccount.google.com/apppasswords.

The second time, Gmail had filled the username with the alias itself, [email protected]. That address has no login anywhere. Cloudflare only forwards mail to it. The username must stay the Gmail account that does the sending.

After that, Gmail sent its confirmation code to the new alias. The code went through Cloudflare to my inbox, and the alias was verified.

What it took

About fifteen minutes for two aliases, and most of that was the Gmail login. Next time I will run the RCPT TO probe first for any address I put on a business card or a website, and I will check the failed delivery count in Email Routing every few months. It is the cheapest way to find the alias people expect and you never made.