What actually matters here
Email verification can't tell you whether someone is a real recruiter or a real candidate - it only tells you whether the address can receive mail. That's still useful: a scam message sent from an address that bounces, or a domain with no mail servers at all, isn't worth another minute of your time. A real, deliverable address doesn't clear anyone - it just means the next check is on you, not the tool.
Check it before you reply
Run the address through the verifier. If it doesn't exist or the domain has no mail servers, you have your answer immediately. If it's real, move to the checks that actually speak to identity: does the domain match the company's real one (not a close lookalike), does the person's history line up, and can you reach the company independently through a number or site you found yourself, not one in the email.
Watch for the domain, not just the address
A common pattern is a domain that's one character off from the real company's - an extra letter, a swapped ".com" for ".co", a hyphen added. The address itself might even verify as real, because the scammer owns that lookalike domain outright. That's a separate check from whether the mailbox exists.