Haraka Relay as an Outbound Email Verifier with Rate Limiting

Why Outbound Email Verification Needs Rate-Limited Relays

You’ve got a clean email list. You’re ready to send. But before you hit send, you send 10,000 verification checks in 10 minutes. Then you get blocked. Your IP is flagged. Your domain is on a blacklist. This isn’t hypothetical—this is how high-volume verification fails at scale.

Verification services like MailTester use real SMTP checks to confirm email validity. But when those checks fire at full throttle, they mimic spam behavior: sudden bursts, unknown sources, no cooling period. Anti-abuse systems see that pattern and respond by rejecting or blacklisting the sender. The fix isn’t to skip verification—it’s to send checks at a rate that looks normal, not suspicious.

Haraka Relay, as an open-source SMTP server, can be configured as a controlled outbound verifier. It’s not just a delivery engine—it’s a throttle. With proper rate limiting, it sends checks in bursts that mimic human pacing. That means fewer bounces from abuse filters, less risk to your sender reputation, and higher inbox placement on real email systems.

Key takeaways

• Unlimited burst verification triggers anti-abuse systems and blacklists, even if the emails are valid.
• Haraka Relay can be configured with rate limiting to send email checks at a human-like pace, avoiding detection as spam.
• Properly rate-limited verification preserves sender reputation while maintaining accuracy in large-scale list cleaning.

How Haraka Relay Works as an Email Verification Relay

You can use Haraka Relay as a lightweight SMTP server to forward email verification requests to domain-level checks, performing real-time MX lookups, SMTP handshakes, and address validation. It logs each connection, including response codes and timing, giving you full visibility into verification attempts. This setup is ideal for high-volume, automated verification at scale.

Real-Time Domain-Level Validation

When you send a list of email addresses to Haraka Relay, it doesn’t just check syntax — it probes the domain’s mail server in real time. First, it resolves the domain’s MX records via DNS, then attempts a direct SMTP connection to verify if the address is accepted at the server level. This mimics how actual email delivery works, making it a strong proxy for inbox placement accuracy.

Every SMTP handshake follows the standard protocol defined in RFC 5321. Haraka simulates a legitimate sender, sending HELO, MAIL FROM, and RCPT TO commands. If the server responds with a 250 code, the address is valid. A 550 or 551 response usually means the address is invalid, while a 4xx response can signal temporary issues like greylisting. These behaviors are documented by the IETF and observed by email operators worldwide.

Logging and Trackability for High-Volume Workflows

Each verification attempt is logged with timestamp, IP address, response code, and connection duration. This audit trail helps you detect patterns — like sudden blocks or slow responses from certain domains — and adjust your sending strategy accordingly. You can use this data to tune rate limits, optimize timing, or identify problematic domains.

Rate limiting is built into Haraka’s architecture, allowing you to control how many connections per second your server attempts. This prevents overwhelming remote mail servers and reduces the risk of being blocked by Spamhaus or other blocklists. For large lists, this balance between speed and compliance is essential.

If you're looking for a similar workflow with built-in accuracy and reporting, consider using MailTester’s real-time verification API. It performs the same SMTP-level checks across thousands of domains daily with 98.9% accuracy, and includes detailed verdicts like “valid,” “catch-all,” or “risky.” You can start with 100 free verifications at MailTester’s API to test the workflow without committing to a plan.

The Core Role of Rate Limiting in Email Verification

Rate limiting is the backbone of responsible email verification. Without it, tools like Haraka Relay can flood mail servers with too many connection attempts in seconds, triggering spam filters and getting your IP blocked. Properly tuned, rate limiting ensures your verification traffic stays under the radar—mimicking real human behavior instead of automated scanning.

Why Too Many Connections Break Deliverability

Receiving mail servers expect a reasonable volume of inbound connections. Sending 100 requests per second? That screams bot activity. Most mail providers, including Google and Microsoft, will flag or throttle IP addresses that exceed typical connection rates. A common threshold is 10 to 30 connections per second—staying below this range keeps your queries from raising red flags.

When your system fails to throttle, you risk hitting sender reputation walls. Even if the email addresses are valid, your IP can get blacklisted by systems like Spamhaus or MxToolbox. This isn’t about validity; it’s about pattern. You’re not checking email addresses—you’re being seen as an attacker.

How Haraka Relay Maintains a Safe Flow

Haraka Relay uses configurable rate limits to pace its connection attempts. You set a target—say, 20 connections per second—and it respects that cap, avoiding bursts. This steady flow keeps your verification process invisible to spam defenses, which look for sudden spikes, not consistent patterns.

Think of it like walking through a library: walking too fast draws attention. But if you move at a normal pace, nobody cares. The same principle applies to SMTP verification. Haraka Relay’s design prioritizes stealth and reliability, especially when validating large lists at scale.

For teams using Haraka Relay in production, proper rate limiting isn’t optional. It’s the difference between clean verification and blocked infrastructure.

Want to test how well your verification setup handles real-world traffic? Use MailTester’s inbox placement tool to see how your messages land—before you send them to real users: check inbox placement with MailTester.

How MailTester Fits Into This Workflow

You don’t need to run your own Haraka relay or manage rate limiting when you can use MailTester’s real-time API as a verified, accurate, and scalable outbound verification endpoint. Instead of setting up and maintaining an SMTP relay, you send email addresses to MailTester’s API, which checks them against live mail servers using the same protocols—SMTP, MX, and DNS—then returns precise results. This reduces your infrastructure burden while increasing accuracy and inbox placement.

Swap Your Relay for a Verified API Endpoint

Running a Haraka relay means you’re responsible for uptime, connection limits, IP reputation, and bounce handling. MailTester removes that complexity. You query our API directly—no need to maintain an SMTP server, configure DNS records, or worry about getting blacklisted.

Our service performs real-time verification by connecting to the actual mail servers involved in delivery, checking for syntax, domain validity, MX records, and whether the mailbox exists. We also identify catch-all domains, disposable email addresses, and role-based accounts—common red flags for deliverability issues.

Rate Limiting Is Handled, Not Your Problem

Haraka relays often hit rate limits enforced by destination servers—especially during bulk checks. Exceeding these limits leads to temporary blocks, IP reputation damage, and wasted effort. MailTester handles this internally with smart connection pacing and retry logic that adapts to remote server feedback.

You send as many requests as needed, and we manage timing, retries, and throttling in real time. This means you can process thousands of addresses without risking your sender reputation. For context, industry standards like RFC 5321 (SMTP) and RFC 7988 (Spam reporting) require strict adherence to rate limits—something MailTester ensures automatically.

Use our real-time verification API to get results in under 2 seconds per address, with 98.9% accuracy on valid/invalid verdicts. Whether you’re cleaning a list before sending, testing inbox placement, or automating verification in a workflow, you’re not just replacing Haraka—you’re upgrading the reliability of the entire process.

With MailTester, you’re not just sending faster—you’re sending smarter, with verified data that respects SMTP limits and keeps your sender reputation intact.

Haraka Relay vs. MailTester: When to Use Each

You should use Haraka Relay when you need full control over your verification pipeline—especially in air-gapped or private environments where external APIs aren’t feasible. For everyone else, MailTester delivers higher accuracy (98.9%) with zero operational overhead. It’s not just faster; it’s smarter than basic MX and SMTP checks, using real-time behavioral analysis and reputation intelligence from verified delivery paths.

Control vs. Convenience: The Core Trade-off

Haraka Relay gives you complete ownership of the process. You can configure it to run on private servers, integrate with internal systems, and implement custom logic—ideal if you’re running in a regulated or isolated network. But managing timeouts, greylist delays, and catch-all handling means deep technical expertise and ongoing maintenance. Even then, accuracy remains dependent on your implementation.

MailTester, by contrast, abstracts away the complexity. It runs its checks on a distributed, reputation-aware infrastructure that learns from real-world delivery outcomes. This results in higher accuracy than in-house methods, especially on edge cases like role accounts, disposable domains, or temporary holds.

Feature Comparison: Real Tools, Real Trade-offs

Real tools like ZeroBounce, NeverBounce, and Kickbox rely on public databases and SMTP probing, which can lead to false positives or outdated results. While they support bulk checks and APIs, their accuracy is not transparent—no public benchmarking, no audit trail. These services also often lack advanced inbox-placement testing or integration with marketing platforms like Mailchimp or Klaviyo.

MailTester operates differently. It doesn’t just check syntax or connectivity—it simulates real sends to assess deliverability. It uses live, real-time infrastructure to validate domains, detect catch-all addresses, and verify inbox placement across different providers. Its 98.9% accuracy rate reflects this comprehensive approach. For teams that want fast, reliable verification without running their own servers, it’s the practical choice.

For detailed verification, see how MailTester handles real-world validation: verify your entire list in seconds. For real-time validation in code, use the verification API. For instant feedback before sending, try the email checker tool.

Ultimately, the choice isn’t about which is “better”—it’s about fit. Haraka Relay is for operators who need full control. MailTester is for teams who want accuracy, speed, and reliability without the cost of engineering. As the SMTP standard shows, sending email is complex. Let a proven system handle the complexity—so you can focus on what matters: delivering to real inboxes.

Setting Up Haraka Relay with Rate-Limited Verification

You can set up Haraka as an outbound email verifier by installing it with Node.js, enabling the outbound plugin for SMTP routing, applying a 15-connections-per-second rate limit to avoid blacklisting, forwarding each check to a backend service like the MailTester API, and logging results to filter out invalid, catch-all, or risky addresses before sending campaigns. This ensures your outbound traffic stays within acceptable limits and maintains sender reputation.

Step-by-step configuration

1. Install Haraka using Node.js and NPM: run npm install -g haraka to get the latest version. This gives you a lightweight, extensible SMTP server built for high-throughput email handling.
2. Enable the outbound plugin to allow Haraka to act as a relay for outgoing verification requests. Without this, Haraka won’t accept SMTP connections for sending, which is required for connecting to email verification backends.
3. Install and configure the ratelimit plugin to cap connections at 15 per second. This prevents triggering rate-based defenses from email providers and avoids being flagged by blacklists. For context, the RFC 5321 SMTP specification governs connection rates, and exceeding 10–20 connections per second can raise red flags with major providers.
4. Set up a backend service to validate each address. Forward incoming verification requests via HTTP to a service like the MailTester API, or route them through a message queue. This decouples your SMTP relay from the verification logic, improving scalability and reliability.
5. Log responses using Haraka’s built-in logging or external tools. Capture verdicts such as invalid, catch-all, or risky to build a clean send list. These indicators correlate to known deliverability risks: catch-all domains accept all addresses, invalids are non-existent, and risky flags indicate potential spam traps or outdated addresses.

Integrating with email verification services

Haraka’s flexibility lets you plug in real-world verification engines. For example, you can forward checks to MailTester’s real-time verification API to validate addresses with 98.9% accuracy. The service returns structured responses that you can parse and act on—filtering out bad addresses before campaigns go live. This reduces bounces, protects sender reputation, and improves inbox placement. You can also use the bulk verification tool to pre-clean large lists before integration. Keep logs of all checks to audit trends and refine your filtering logic over time.

Rate limiting is not a suggestion—it's a baseline requirement for legitimate outbound email infrastructure.

How to Interpret Verification Verdicts in Practice

When you run an email through a verifier like MailTester, the result isn’t just “valid” or “invalid”—it’s a diagnostic snapshot of deliverability risk. A valid address passes DNS and SMTP checks and likely reaches the inbox. An invalid one fails permanently—don’t send. A catch-all server accepts all addresses, making it a dead end for outreach. A risky flag warns of typos, role accounts, or disposable domains—high bounce or spam potential. These verdicts aren’t guesses; they’re based on real SMTP behavior and observed patterns.

What Each Verdict Really Means

• Valid: The mailbox exists and accepts inbound mail. This is your target. You can send with confidence, but still monitor engagement and bounce rates.
• Invalid: The server returned a permanent error—typically a 5xx code (e.g., 550). The address doesn’t exist, or the domain is misconfigured. Stop sending to these; they harm sender reputation.
• Catch-all: The server accepts all addresses, even invalid ones. This means the email isn’t uniquely tied to a user. High-risk for outreach—likely a shared or disposable inbox. You’ll rarely reach a real person.
• Risky: Red flags like [email protected], [email protected], or common typo-squatting patterns. These often bounce or get flagged. Use sparingly, if at all.

Apply the Verdicts to Your Workflow

Let’s say you’re using Haraka as an outbound relay. You’ve enabled rate limiting to avoid triggering spam filters. But you’re still seeing high bounces. Now you run your list through a real-time email checker. The results show 12% invalid, 8% catch-all, and 15% risky. That’s your problem: garbage in, garbage out. You don’t need to verify every address manually. A robust bulk verification tool scans thousands in minutes.

Use bulk email verification to identify dead or risky addresses before sending. If you’re building a list programmatically, integrate the real-time verification API to validate each entry as it comes in. For one-off checks, the email checker gives instant feedback—great for sales teams before outreach.

According to RFC 5321, SMTP servers must respond with specific error codes. Tools like MailTester interpret those codes accurately—no guesswork. A 550 error is not a soft bounce; it means the address is gone. Let the server speak first.

Why Real-Time API Verification Beats Bulk Processing

Real-time APIs like MailTester’s verify email addresses in 200–400ms per check—fast enough to clean your list before it’s even sent. Bulk processing, by contrast, can stall for minutes or hours due to greylisting, temporary failures, or rate throttling from destination servers. When you wait hours for a batch to complete, your data can already be outdated, invalid, or bounce-prone.

Batch Delays Are Not Just Inconvenient—They're Risky

When you run bulk verification, you’re exposing your list to the unpredictability of third-party SMTP servers. Greylisting can delay a single check for 10–30 minutes; temporary DNS issues or server overloads may cause outright failures. These aren’t rare exceptions—they’re common in large-scale list processing.

By the time your 10,000-email batch finishes, some addresses might have changed status: a user could’ve deleted their inbox, or another might have switched domains. You’re not cleaning a list—you’re cleaning yesterday’s version of it, which increases the chance of bounces, spam traps, and sender reputation damage.

Real-Time Checks Keep Your Data Fresh and Actionable

A real-time API doesn’t wait. It queries each address as it’s needed, and returns results in under half a second. This means you can verify addresses instantly—right before sending, or during list building—without queuing or stalling.

Think of it like a security scan: you don’t wait for a full system check to finish before entering a building. You check each person at the door. That’s exactly how real-time verification works. Tools like MailTester’s verification API are built for this—no batch delays, no stale data, just immediate feedback.

For developers and senders using transactional or marketing systems, this speed is essential. It lets you catch typos, role accounts, and disposable domains before you send. The RFC 6075 describes how SMTP servers handle temporary failures intentionally—this isn’t a bug, it’s a design feature. Real-time systems account for it, while bulk processes get caught in its trap.

Ultimately, real-time verification isn’t just faster—it’s more accurate, more reliable, and aligned with how email actually works in production. You’re not just checking addresses; you’re maintaining sender reputation, inbox placement, and deliverability from the first moment you test.

Monitoring and Auditing Your Verification Pipeline

You must log every verification attempt—timestamp, email address, and response code—to detect issues early. Track 4xx and 5xx SMTP errors to spot server-side failures. Use a dashboard to flag anomalies like sudden spikes in catch-all responses, which often mean your list has low-quality or fake addresses. A well-monitored pipeline reduces bounces, protects sender reputation, and improves inbox placement.

Log Every Attempt with Context

Every time you verify an address, record the full context: the exact email, the time, and the response code. This allows you to trace problems later. For example, a 550 error means the address is invalid, while a 554 might mean the server blocked the request due to rate limiting. Without logs, you’re flying blind when debugging delivery issues.

Consider using a real-time verification API like MailTester’s API to automate this process across your outbound email operations. It returns structured responses with clear codes and actionable feedback, including whether an address is valid, risky, or catch-all. You can store this data directly in your system or log it for audit trails.

Detect Anomalies Before They Break Your Deliverability

Sudden increases in catch-all responses—especially more than 10% of a batch—often signal list contamination. These false positives aren’t just inaccurate; they hurt deliverability by suggesting you’re sending to low-quality or synthetic data. RFC 5321 defines how mail servers respond, and catch-all setups often return 250 OK even for non-existent users. That behavior, while technically compliant, can degrade sender reputation if overused.

Monitor bounce patterns too. A spike in 5xx errors (server failures) may point to transient issues with the receiving server, but if they persist, it could mean your IP or domain is blocked. Some systems, like Spamhaus, track and report IP-based abuse. Catching these signs early lets you adjust rate limits, clean lists, or pause sends before reputation damage occurs.

Let’s be clear: rate limiting isn’t just a technical detail. It’s part of inbox placement. If your Haraka relay sends too fast without proper throttling, it can trigger defensive responses from destination servers. Use the logs and dashboards to correlate send volume with delivery success. The goal isn’t just to reduce invalid addresses—it’s to maintain a clean, trusted flow. You can test this in practice with real inbox placement testing to see how your verified list performs across major providers.

Scaling Email Verification Without Hitting Blacklists

You can’t scale email verification without rate limiting—sending too fast from a single IP, even at modest volumes, triggers blacklists and blocks. Even a few dozen checks per minute from one source can raise red flags with spam filters. The solution is infrastructure that avoids detection: IP rotation or a managed service with proven deliverability, like MailTester.

Why Speed Breeds Blacklisting

SMTP servers watch for spikes in connection rate, especially from shared or newly registered IPs. A single IP sending hundreds of verification queries in a minute looks suspicious—even if the requests are legitimate. This is why rate limiting isn’t optional; it’s a necessity for reputation safety.

Spamhaus, a widely respected blacklist operator, tracks patterns of automated abuse. A sudden burst of connections from a known IP can land it on a temporary block list, affecting all outbound mail—not just verification traffic. This isn’t theory; it’s how systems like Spamhaus work in practice.

Managed Services Solve It at Scale

Instead of juggling multiple IPs or building a custom relay, use a service designed for this: MailTester. It runs on a distributed infrastructure with dedicated verification IPs and automated rate throttling. This means you can verify 10,000 addresses without triggering blocks, because the load is spread across hundreds of endpoints with clean reputations.

MailTester’s system avoids common pitfalls like static IP exposure or high-frequency patterns. It simulates real human behavior with natural delays between checks, reducing the risk of being flagged as a bot. This level of control is hard to build in-house—especially when you’re not a messaging infrastructure specialist.

If you’re verifying lists at scale, you need infrastructure that knows how to stay invisible. MailTester handles the burden of reputation management, so you don’t have to. You send requests, we manage the delivery, and deliverability stays high. See how it works: verify large lists at speed without risk.

Conclusion: Verified Deliverability Starts With Real-Time Checks

Haraka Relay can validate email addresses in real time with built-in rate limiting, but it requires ongoing maintenance, monitoring, and infrastructure management. It’s effective for controlled testing, but scaling it in production demands operational overhead.

MailTester delivers the same real-time verification without the complexity. It offers 98.9% accuracy, zero infrastructure, and no rate-limiting constraints — letting you verify large lists quickly and consistently.

The optimal workflow is simple: use controlled systems like Haraka Relay for internal testing, and rely on a trusted SaaS like MailTester for verified deliverability in live campaigns.

Sources

• Roughly one in six legitimate commercial emails (16.5%) never reaches the inbox globally — 6.7% is filtered to spam and 9.8% disappears without a bounce. — Validity 2025 Email Deliverability Benchmark Report (2025)
• Benchmark testing of 15 major email service providers found about 10.5% of legitimate emails land in the spam folder and a further 6.4% go undelivered. — EmailTooltester deliverability benchmark (via WarmForge) (2026)

Keep reading

• Anti-spam laws and compliance: CAN-SPAM, GDPR, CASL (complete guide)
• Common DKIM H-Tag Mistakes with Non-Signing Fields in 2026
• Email Security Scan Highlighting Missing Tracking Pixel Dimensions
• Automated Email Domain Risk Assessment with End-to-End Delivery Testing
• How to Configure DMARC rua Tag with Correct Mailto URI Format

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can Haraka Relay be used for bulk email verification?

Yes, but only with strict rate limiting and proper IP management. Without it, you risk blacklisting.

How does rate limiting prevent email verification from being blocked?

It mimics normal user behavior—avoiding sudden spikes in SMTP connections that trigger anti-abuse systems.

What’s the accuracy of MailTester’s email verification?

98.9% accuracy, based on real-world validation across domains, catch-all patterns, and role accounts.

Does MailTester handle catch-all addresses?

Yes—it detects them and labels them as 'catch-all' or 'risky' to prevent wasted sends.

Do I need to manage my own SMTP server to verify emails?

No. Tools like MailTester handle the SMTP checks, rate limiting, and infrastructure for you.

How much does MailTester cost for list verification?

Start with 100 free verifications. Purchased credits never expire and scale with your needs.

Can I integrate MailTester with SendGrid or Mailchimp?

Yes. MailTester integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid to clean lists before sending.

What’s the difference between a catch-all and a role account?

Catch-all accepts all emails on a domain. Role accounts (e.g., admin@, sales@) are legitimate but risky to email.

Why is inbox placement testing important after verification?

Verification confirms syntax and server acceptance, but inbox placement testing reveals deliverability success in real mail clients.

How does MailTester detect disposable email domains?

It maintains a real-time list of known disposable domains and blocks them during verification.

Can I verify 100,000 emails at once with MailTester?

Yes. The API supports bulk verification with rate limits built into the service, so you don’t need to manage timing yourself.

What’s the benefit of using an in-app AI assistant with MailTester?

It helps diagnose failed verifications, suggests list cleanup actions, and explains why an address was flagged.