Websites don’t have an actual check for a legit email.
Some do. You can connect to an SMTP server and pretend to send an email (send the EHLO
, MAIL FROM
, and RCPT TO
commands, but don’t actually send any content). A lot of servers will immediately reject as soon as you provide an invalid recipient email address.
Of course, that doesn’t work for any domains with a catchall address (where every address at a domain goes to one mailbox), and some SMTP servers don’t reject the email until later (or even just silently ignore emails to invalid addresses) in order to avoid enumeration attacks.
I still call it Twitter because their emails are still branded as Twitter. I don’t actually use it any more but I do get so much spam through DMs that I’m considering deleting my account. I’m mostly holding it just so nobody squats on my username.