Skip to content

Glossary

What is RCPT TO in SMTP?

Quick answer

RCPT TO is the SMTP command where the sending server names a recipient, one address per command, after MAIL FROM and before DATA. The receiving server's reply is the first moment it says whether it will take mail for that mailbox. Email verification reads exactly that reply, then ends the session before any message content is sent.

Definition

RCPT TO: The SMTP command that names one recipient of a message (RFC 5321). The server reply is what mailbox verification reads: 250 accepts the address, 550 with 5.1.1 rejects it as unknown, and a 4xx defers the decision.

How to read RCPT TO replies

A 250 reply, usually with 2.1.5, means the server accepts the recipient. A 4xx reply means not now: greylisting, a rate limit, a full mailbox or too many recipients in one session.

A 5xx reply is a permanent no, and the enhanced code says why. 5.1.1 means the mailbox does not exist, 5.2.1 a disabled mailbox, and 5.7.1 a refusal on policy grounds.

Why a 250 reply is not always proof

Catch-all servers return 250 for every address, real or invented. Security gateways often do the same at the edge and check mailboxes only after the message arrives.

The way to tell is to ask for a random address in the same session. If the server accepts that too, the first 250 carried no information about the mailbox.

Why a 550 reply is not always a missing mailbox

550 is also used for rejections that have nothing to do with the recipient: the sending IP is on a blocklist, the sender failed authentication or the server simply does not like the connection.

The enhanced code and the reply text separate the two. Treating a policy block as an invalid address deletes good contacts from your list.

C: MAIL FROM:<probe@verify.example.net>
S: 250 2.1.0 Sender OK
C: RCPT TO:<ana@example.com>
S: 250 2.1.5 Recipient OK
C: RCPT TO:<nobody.here@example.com>
S: 550 5.1.1 User unknown
C: RCPT TO:<ben@example.com>
S: 550 5.7.1 Client host 203.0.113.7 rejected by local policy
Three recipients in one session: accepted, unknown user, and a policy refusal that says nothing about the mailbox.

How RocketVerifier handles it

Our engine sends RCPT TO from a dedicated verification domain and disconnects before DATA. When the real address gets a 250, it asks for 3 random addresses at the same domain in the same session, and if 2 of 3 are accepted the domain is treated as catch-all instead of the address being marked deliverable. A rejection about the sender, such as 550 5.7.1, is reported as blocked (unknown), and a bare 550 without a clear user-unknown meaning is treated as ambiguous rather than undeliverable.

Go further

Sources

  1. RFC 5321: Simple Mail Transfer Protocol
  2. RFC 3463: Enhanced Mail System Status Codes

FAQ

RCPT TO: common questions

Is RCPT TO the same as the To header?

No. RCPT TO is part of the envelope and decides where the message goes. The To header is part of the message and is only for display. Bcc recipients appear in RCPT TO but in no header at all.

How many RCPT TO commands can one session have?

RFC 5321 requires servers to accept at least 100 recipients per message. Many providers set lower limits per session or per connection and answer extra recipients with a 452 reply.

What does a 503 reply to RCPT TO mean?

Bad sequence of commands. The client sent RCPT TO before a successful MAIL FROM, or before EHLO. It is a client bug and says nothing about the address.

Turn definitions into a cleaner list

Verify your first emails in minutes. Credits never expire, and unknown results are always free.

100 free credits · No card required · Credits never expire