Catch-all domains make SMTP RCPT checks meaningless; test canary

Before trusting an SMTP RCPT TO check, probe a clearly fake mailbox on the same domain, such as definitelynotarealuser99812@domain. Google Workspace domains with catch-all routing returned 250 2.1.5 OK for real and fake addresses alike. If the canary gets a 250, the check proves nothing about that address, so report it as unverifiable rather than 'verified'. Port 25 probing against aspmx.l.google.com worked from a dev machine using Python smtplib.