[meowster]

You can initiate a connection with the mail server, and then query it. I read about it years ago, never done it myself though.

[snowwrestler]

Worth pointing out that it’s possible to configure an email server to not respond to these types of queries and many high-value targets (large corporate email systems) do.