Before checking the real address, sends a random 20-char address to
the domain. If the server accepts it (250), the domain is catch-all
and individual verification is meaningless. Result cached per domain.
Existing known catch-all list (gmail, outlook, etc.) still bypassed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>