- Generate a token
- Store that token against the email address in a database
- Send an email to that address with a URL that includes the token and a hash of the email address
If someone visits that URL, then the address exists.
SMTP provides a mechanism to ask if a server hosts a particular address, but it is almost always disabled as it is a favourite tool of spammers.