We Analyzed 300,000 B2B Email Validations. Here's What's Really in Your List.
Everyone has a rule of thumb for what's hiding in a B2B email list - catch-all domains, role accounts, dead addresses. We decided to measure it. We aggregated 302,192 email validations across 97,744 unique domains processed in the last period, and the numbers tell a clearer story than the rules of thumb.
The verdict: half of B2B emails are clean-ish
Across every validation in the dataset, the headline split was:
- 51.4% valid - confirmed deliverable
- 27.3% risky - mostly catch-all domains where the mailbox can't be confirmed by SMTP alone
- 20.1% invalid - dead addresses that would bounce
The takeaway: roughly 1 in 5 addresses in a typical B2B list will hard-bounce if you send to it unverified - enough to put a sending domain's reputation at risk in a single campaign. But the more interesting number is the 27% in the middle.
1 in 5 B2B domains is catch-all
20.1% of the domains we analyzed (and 22% of all emails) were catch-all - servers configured to accept mail for every address, whether the mailbox exists or not. This is the single biggest blind spot in email verification, and it's why most tools return "risky" or "unknown" and move on.
Why catch-all matters
If a fifth of your list sits on catch-all domains and your verifier discards all of them, you're throwing away a fifth of your reachable audience - including plenty of real, deliverable contacts.
Instead of giving up, HeroBounce scores each catch-all address with a confidence value. Across the catch-all emails in this dataset:
- 39.4% scored as likely deliverable (confidence ≥ 0.70)
- 25.4% scored as likely dead (confidence < 0.50)
- That's a usable signal on roughly 65% of catch-all addresses - instead of one undifferentiated "unknown" bucket.
The 30% that other tools quietly discard
Some mail servers respond to verification with a temporary rejection (SMTP 450, "greylisting") - a deliberate anti-spam delay. Most verifiers treat that as a dead end and return "unknown." When we automatically re-tried greylisted addresses after a delay, about 30% resolved to a definitive valid-or-invalid answer. Those are real contacts that would otherwise be silently dropped from a list.
The DMARC gap is still wide open
Authentication adoption among the B2B domains we checked:
SPF is nearly universal, but more than 1 in 4 B2B domains still has no DMARC policy - even after Gmail, Yahoo, and Microsoft began enforcing it for bulk senders. If you're sending B2B, a meaningful share of the domains you interact with are still under-protected against spoofing.
B2B runs on Microsoft, not Google
Among the addresses where we could identify the mail provider, Microsoft (Office 365 / Outlook) outnumbered Google by roughly 1.7 to 1 - the inverse of consumer email, where Gmail dominates. Security gateways like Mimecast, Proofpoint, and Barracuda also showed up frequently, and those are exactly the providers most likely to present as catch-all. It's a useful reminder that B2B deliverability is a Microsoft-first game.
What this means for your list
- Expect ~20% of an unverified B2B list to be undeliverable - verify before you send.
- Don't discard catch-all domains wholesale; ~65% can be scored into a usable decision.
- "Unknown" results are often recoverable - greylisting alone hides ~30% of resolvable addresses.
- Treat B2B sending as Microsoft-first, and watch for security-gateway domains.
See what's hiding in your own list
HeroBounce resolves catch-all domains and recovers greylisted addresses other verifiers give up on. Start free - 100 validations a month, no card required.
Methodology
Based on 302,192 email validations across 97,744 unique domains processed by HeroBounce in the last period of 2026. The dataset is predominantly B2B (87% from bulk list uploads). All figures are aggregated and anonymized; no individual email addresses or customer data are exposed. Provider identification reflects addresses where the mail provider could be determined from MX records. "Likely deliverable" and "likely dead" refer to HeroBounce confidence scores of ≥ 0.70 and < 0.50 respectively.