Built my own cold email + verification setup. Sitting at ~17% hard bounce. What else should I be doing?

I've been building my own outbound email setup instead of paying for a tool, and I've hit a wall on bounce rate. Hoping some of you have solved this.

The setup

• Amazon SES for sending, inbound replies land in S3 and get parsed
• Leads come from public business listing data (millions of small local businesses with a published email)
• Sending 20/day, one at a time, 2–3 minute gaps, single domain
• Replies are matched back to the original thread and I answer manually

What I already do to stop bounces

• Syntax + MX check before anything else
• SMTP probe: connect to their mail server, MAIL FROM / RCPT TO, read the response, never send DATA
• Catch-all detection by probing a random address at the same domain first
• Skip role mailboxes (postmaster@, noreply@, etc.) and disposable domains
• Hard bounce → suppressed permanently, never contacted again
• Soft bounce → left alone
• Anything I can't verify is skipped rather than gambled on

The numbers

Out of ~50 sent, 9 hard bounced (17.6%). Breaking down a sample of 30 addresses through the probe:

• 13% confirmed valid
• 23% confirmed dead (these I now skip before sending)
• 63% unknown — catch-all domains or free providers that return 250 for every address

That 63% is the problem. The listing data is old, so a good chunk of those "unknowns" are dead mailboxes I can't detect.

What's helped so far

Crawling the company's own website for a current address instead of trusting the listing. Those bounce far less — obviously, since the business published it recently. But it only works for companies that have a site and put an address on it (about 18% of the ones I've tried).

The question

For the addresses sitting behind a catch-all or on Gmail/Yahoo — is there anything left that actually works? Or is the honest answer "you can't know, so either don't send or accept the bounces"?

Specifically:

1. Is there any signal I'm missing that correlates with a live mailbox?
2. Does anyone bother with a low-volume seed send to test a domain before committing to it?
3. Am I wrong to treat catch-all as unverifiable, or is there a technique that gets further?

Not looking for tool recommendations unless it's something self-hostable — the whole point was not paying per-verification. if im in a wrong subreddit sorry my first time in reddit