VRFY

What it means

VRFY was meant for debugging: give it a name or address and the server confirms the mailbox. Because that also tells anyone whether an address exists, it became a tool for harvesting addresses. RFC 5321 lets sites disable it, but says a server that does so must answer 252, meaning it cannot verify the user but will accept a message and try to deliver it, rather than a reply that looks like a real answer.

For senders this means VRFY cannot validate a list. Probing addresses another way, by opening transactions and reading RCPT TO replies without sending, is treated as abuse by some receivers: Outlook.com calls it namespace mining and blocks IPs that do it.