Skip to main content

Proxy 25

How to Switch Proxies During Bulk Verification So Your Traffic Looks Human — Proxy25
Proxy Rotation · Bulk Verification · Pacing · 2026

How to Switch Proxies During Bulk Verification So Your Traffic Looks Human

Meera's pipeline ran like a clock — perfectly balanced, perfectly timed. Her unknown rate climbed from 9% to 21% in five weeks. She replaced all 50 proxy IPs. The rate moved one point. The IPs were not the problem.

J
Jon
Proxy25
11 min read
2026

Perfect math. Perfect balance. The wrong result.

Meera runs data operations at a sales-tool startup. Her team verifies about 500,000 email addresses every day for customers. She had 50 proxy IPs and a script she was proud of.

The script was simple. Each IP made one check every 8.64 seconds. That number is not random — 86,400 seconds in a day, 10,000 checks per IP (500,000 ÷ 50), so 86,400 ÷ 10,000 = 8.64 seconds. Every IP stayed busy all day, none was overloaded, and the day's target was met exactly. Her dashboard showed flat, clean lines.

Unknown rate on Microsoft-hosted addresses — week by week
Week 1
9%
Week 2
12%
Week 3
15%
Week 4
18%
Week 5
21%

Replacing the whole pool changed one point. That told her the problem was not which IPs she used. It was how her traffic behaved. She found four things wrong, one at a time. This post follows the same order.

My view before we start: swapping IPs is the most overused fix in bulk verification. It is expensive, and most of the time it treats a symptom. Fix the behaviour first, and change IPs only when the IP itself is the problem.


Mail servers see connections — not people

Nobody types email addresses into an SMTP server by hand. So "mimic human behavior" cannot mean copying a person. Mail servers do not see people. They see connections: how often, how many checks per connection, how regular the gaps are, and how much arrives from many IPs at the same time.

Real mail traffic has a shape. Gaps are uneven. A connection carries a few recipients, then closes. Traffic to one destination is spread across the day, not stacked in a block. That shape is what you are copying.

!

One honest note: mail providers do not publish how they judge verification traffic. Every number below is a starting value, not a known limit. Watch your own unknown rate and adjust.


01
Problem One
The gaps were too perfect

Eight point six four seconds, every time, on every IP. Real traffic never looks like that. A perfectly even gap is itself a pattern. The obvious fix is "add random delay" — but where most teams stop is not enough.

✕
Uniform random (e.g. 4–13 seconds) — every gap equally likely. Real traffic does not do this. Real gaps cluster around a common value then have a long tail of slow ones.
✕
Normal (bell curve) around 8.64s — better, but a bell curve is symmetric. With a spread of 4 seconds, ~1.5% of gaps come out negative, which is impossible. Real gaps are lopsided, not symmetric.
✓
Log-normal distribution — no negative values, long tail on the slow side. Fits how real traffic actually distributes. The correct shape for inter-request gaps.
Log-normal gap setup — keeping daily throughput the same
Target average gap: 8.64 sec ← day still adds up to 10,000 checks per IP
Sigma (spread): 0.6
e^(sigma²/2): e^0.18 ≈ 1.197
Median gap: 8.64 ÷ 1.197 = 7.2 sec
Result 90% of gaps: ~2.7 to 19.4 seconds
Average: still 8.64 sec ← same throughput, no metronome

Meera also added intentional long pauses — 2% of her gaps became ~90-second pauses. But pauses cost time. Every bit of variance you add must fit inside your time budget.

Paying for pauses from normal gaps
Naive (wrong): 0.98 × 8.64 + 0.02 × 90 = 10.27 sec avg ← 16% short on daily volume
Fixed budget: (8.64 − 1.8) ÷ 0.98 = 6.98 sec ← 98% of gaps now average here
New median: ~5.8 sec ← same sigma, same daily total
The rule: every bit of variance you add must fit inside your time budget. If it does not, you will miss your volume target and blame the wrong thing.

02
Problem Two
She rotated IPs, but never rotated sessions

An IP is where traffic comes from. A session is one connection to the mail server — from opening to closing. They are two different things, and Meera only ever changed one. Her script opened a connection on each IP and kept it open for hours, running thousands of checks down the same connection. A connection that runs for hours does not look like mail. When she replaced the IPs, each new IP did the same long-running thing.

Retire the session when
Session problem → new session
It has done 5 to 10 checks
It has been open for a few minutes
It gets any temporary error (4xx reply)
It drops unexpectedly
Rotate the IP when
IP problem → new IP
4xx replies keep coming even on fresh sessions from that IP
IP has used up its daily check budget
IP shows up on a blocklist

A session problem is fixed by a new session. An IP problem is fixed by a new IP. Meera had used the expensive fix — 50 new IPs — for the cheap problem: long sessions.


03
Problem Three
Every IP was polite — together they were a wall

Each IP made only one check every 8.64 seconds, which looks polite. But her list was sorted by domain — so she processed all Microsoft-hosted addresses together in one block. From the mail server's perspective, 50 IPs were all hitting the same destination with the same rhythm, simultaneously, for 7.2 hours.

Global vs per-domain pacing — the math from the server's side
5.79/sec
Checks hitting Microsoft servers simultaneously (before)
1.74/sec
What 150K checks spread across a full day actually is
3.3×
Lighter on target servers after list shuffle + 2/sec cap

One practical detail: pace by where the mail is hosted, not by the domain name. Thousands of different company domains route through the same Microsoft servers. Group domains by their MX host and set the cap on the group. Meera shuffled her list so hosting groups mixed through the day, and set a cap of 2 checks per second on the Microsoft-hosted group.

!

Per-domain caps have a floor your list decides. At a cap of 1.5 per second, the most you can do in 24 hours is 129,600 checks. Adding more IPs does not fix this — the cap is on the whole group, not each IP. Your only options are to accept carry-over to the next day, give the run more hours, or raise the cap.


Meera's setup after four weeks of fixes

Log-normal
Gap distribution with sigma 0.6 — same average, no metronome
2% pauses
~90-second pauses built into the budget, not on top of it
5–10 checks
Session length before retire — IPs only rotate for real IP problems
2/sec cap
Per-hosting-group cap, list shuffled so groups mix across the day

Her unknown rate on Microsoft-hosted addresses went from 21% to 12% over two weeks. It did not go back to 9%. Some servers never give a clear answer however you behave, and it is better to say that plainly than to promise a number you cannot hit.

If you verify a few thousand addresses a day across many different domains, you do not need all of this. Basic random gaps and closing sessions regularly is enough. The list-shuffling and group caps matter when volume is high and a large share of your list sits on the same few mail hosts.


Frequently Asked Questions
How do you rotate proxies during bulk email verification? +
The key is distinguishing between session rotation and IP rotation — they solve different problems. Retire a session (close the connection, wait a random gap, open a new one) after 5 to 10 checks, after a few minutes of uptime, or after any 4xx response. Only rotate to a new IP when 4xx responses persist across fresh sessions from the same IP, when the IP has reached its daily check budget, or when the IP appears on a blocklist. Most teams over-rotate IPs because they are applying the expensive fix to what is actually a session problem.
How often should you switch proxies for email verification? +
IP switches should be infrequent and event-driven, not scheduled. Switch when: 4xx responses persist on fresh sessions from that IP, the IP has used up its daily allocation, or the IP appears on a blocklist. Session switches (which are distinct from IP switches) should happen every 5 to 10 checks — this is what makes each connection look like mail traffic rather than a probe. The mistake most teams make is switching IPs on a schedule or after a fixed number of requests, rather than switching sessions frequently and IPs only when genuinely needed.
Does proxy rotation reduce unknown email verification results? +
Sometimes — but only when the IP itself is the problem. Meera replaced all 50 of her proxies and her unknown rate moved from 21% to 20%. One point. The IPs were not the primary variable. Unknown rate is more often driven by traffic pattern than by which IPs are used. Fix gap distribution (log-normal, not uniform random), rotate sessions after 5–10 checks, and cap per-hosting-group connection rate. These changes produced a 9-point improvement where replacing all 50 IPs produced one.
How should SMTP sessions be managed during bulk verification? +
Real mail traffic carries a small number of recipients per connection and then closes. A verification session that stays open for hours running thousands of checks does not look like mail — it looks like systematic probing. Close sessions after 5 to 10 RCPT TO checks, wait a gap drawn from a realistic distribution before opening the next one, and open new sessions on the same IP unless the IP is showing persistent failures. Session management is the single most impactful change most pipelines can make without touching their IP pool at all.
What is the difference between IP rotation and session rotation? +
An IP is the network origin of a connection — where the traffic comes from. A session is one TCP connection to a mail server, from open to close, which may carry multiple RCPT TO queries before ending. IP rotation means using a different address for the next connection. Session rotation means closing the current connection and opening a new one, which can be from the same IP. The common mistake: treating IP rotation and session rotation as the same thing, and applying IP rotation (expensive) to solve what is actually a session problem (free to fix). Session rotation should happen frequently; IP rotation should happen only when the IP itself is the problem.
How do you pace SMTP email verification traffic? +
Pacing operates at two levels. Per-IP pacing controls how fast each individual IP sends queries — use a log-normal gap distribution (sigma around 0.6) with a small percentage of long pauses, keeping the average gap at your target rate. Per-hosting-group pacing controls how fast your entire pool talks to one mail host simultaneously — this is what most teams miss. Group domains by MX host, set a cap on checks per second across the entire pool for each group, and shuffle your list so domain groups mix through the day rather than being processed in blocks. Both levels of pacing are required; global per-IP pacing alone does not prevent a 50-IP pool from hitting one mail host with a combined 5+ checks per second.
Why does adding more proxies not always improve email verification? +
Because most unknown results are caused by traffic behavior, not by which IPs are used. Adding more IPs to a pipeline with regular gaps, long-running sessions, and a list sorted by domain adds more sources of the same suspicious pattern. Each new IP arrives with no sending history, immediately starts exhibiting the same clockwork behavior, and generates the same cautious responses. In Meera's case, replacing all 50 IPs moved her unknown rate by one percentage point. Fixing her gap distribution, session length, and per-hosting-group pacing moved it by nine points. More proxies are useful when a specific IP has accumulated negative history with a target host. They are counterproductive when used as the primary fix for behavioral detection.
What is a log-normal gap distribution and why use it for verification pacing? +
A log-normal distribution produces values that are always positive (no negative gaps), cluster around a median value, and have a long tail on the high side — meaning most gaps are moderate, but some are significantly longer. This shape matches how real email traffic actually distributes: most sends happen at a typical pace, but some connections are slower because of reading time, navigation, or system pauses. Uniform random distributions produce every gap value with equal probability, which is not what real traffic looks like. Normal (bell curve) distributions produce negative values at their tails, which you have to clip. Log-normal avoids both problems. To set it up: decide your target average gap, set sigma (0.6 is a reasonable starting point), and derive the median as average ÷ e^(sigma²/2). The resulting gaps will average to your target while appearing naturally varied.

Residential proxies with session and pacing controls built in

Proxy25 provides residential proxy infrastructure for email verification, with session and pacing controls built in so you do not have to build this logic yourself.

Start with 500 free credits → No credit card required