How email verification services like zerobounce, neverbounce, emailable internally work?

Good question, MX/SMTP checks are really just the first layer, and they're also the least reliable part on their own. Here's roughly how the more accurate tools go beyond that:

1. SMTP handshake, done carefully
   Basic tools do a simple "does this mailbox exist" ping. Better ones simulate an actual delivery attempt (connect, HELO, MAIL FROM, RCPT TO) without sending the message, and read the server's response code rather than just checking if the connection succeeds. A lot of naive implementations get this wrong and misread a temporary greylist response as a hard failure.
2. Catch-all detection
   This is the part your MX/SMTP check alone can't solve. Some mail servers are configured to accept any address at that domain, so a "does this exist" check comes back positive even for made-up addresses. You detect this by testing a random, clearly-nonexistent address at the same domain (e.g. zzzrandomstring@theirdomain.com). If that also comes back "accepted," the domain is catch-all, and you can't fully trust individual address results from it without additional signals (pattern matching against known naming conventions, domain reputation, etc.).
3. Disposable/temp-mail detection
   This is basically a maintained blocklist of known disposable domains (Mailinator, Guerrilla Mail, etc. and the constant stream of new ones), refreshed regularly since new disposable services pop up often. There's no clever SMTP trick for this part — it's list maintenance, and staleness is the main way tools fail here.
4. Role-account / spam-trap detection
   Filtering out addresses like info@, admin@, noreply@ (role accounts, less useful for outreach) and flagging known spam-trap patterns, which requires its own maintained dataset.
5. Scoring instead of binary pass/fail
   Given all of the above is probabilistic, not certain, most serious tools output a risk score rather than a hard valid/invalid , you set your own threshold depending on whether you're doing transactional email (stricter) or cold outreach (more risk-tolerant).
   I've actually built one of these (an email validation API), and catch-all handling was by far the hardest part to get right in practice, happy to go deeper on any of these if useful for your project.

It might be helpful to understand why you want to block or filter these. For example, do you want to block at a submission point or scrub them from your current list.

You should also carefully consider the side affects of each. For example, I might sign up for your service with a disposable email address, but that doesn’t mean I won’t continue to engage with the product. There might still be an opportunity to sell to me when I visit again. On the flip side, you might not want this address in your mailing list costing money for sends and bringing down read rates. Your mailing list is probably already taking some action, like automatically removing undeliverable email.

Anywayz, just a couple things to consider.

You should use some package like this that filters out the disposal email servers. There are many Github repos that help with this. Check those.