Engineers: How do email verification services work?

In particular, I am trying to detect catch-alls, but theory and practice don't seem to align:

• In theory, you send the SMTP server:
  • MAIL FROM:<[email protected]>\r\n
  • RCPT TO:<[email protected]>\r\n
  • Then check to see if you get a 250 message (because a 550 error would tell you the email address you are testing doesn't exist)
• Trying it out In practice with Google Workspace emails however:
  • To even talk to the SMTP server you need to authenticate
  • After authentication and performing the MAIL FROM and RCPT TO commands, the server blanket sends 250 (of course, a smart idea to prevent people from knowing who exists and who doesn't)

So for those of you out there who have built your own email verification service, how do you actually do catch-all identification?

To detect catch-all emails combine pattern analysis of SMTP responses, MX record checks, and use of historical data since servers like Google Workspace return a 250 status for all emails. This multi-faceted approach helps identify catch-all domains effectively