Is it possible to validate an email address without the user actually revealing the email address?
Your idea is exactly what is achieved in a recent paper:


  Blind Certificate Authorities.  Liang Wang, Gilad Asharov, Rafael Pass, Thomas Ristenpart, abhi shelat. At IEEE S&amp;P 2018.


The server and client use secure multiparty computation to jointly make an SMTP+TLS connection to a mailserver, generating the appropriate encrypted packets to send an email to username@domain.com, so that the server doesn't learn username and the client doesn't learn the random challenge in the body of the email.