Local-first email verification for Windows
Nine verification stages, a 20-signal spamtrap engine and six blocklists run on your own PC, up to 1,000,000 rows per run. Nothing is uploaded, and no message is ever sent.
The pipeline
The first three stop an address as soon as they match. The rest collect evidence, and the verdict ladder weighs it at the end. Pick a stage to see what it checks.
Stage 1 of 9 Stops the address on a match
Syntax & parsing
Is this a well-formed address at all?
Name <addr> forms and quoted local partsalice+news@).test .local .invalid .onion .internal .corp example.comReason codes
syntax_invalid reserved_tld plus_addressed idn_domain
Example
sam..lee@mail.test
syntax_invalid Invalid
Stage 2 of 9 Stops the address on a match
Duplicates
Seen this one already?
Reason codes
duplicate_email
Example
Ana.Silva@Company.com
duplicate_email Duplicate
Stage 3 of 9 Stops the address on a match
Your rules
Addresses you have decided never to mail.
@ blocks one addressReason codes
blocked_domain_or_address domain_zone_blocked free_provider_excluded
Example
buyer@shop.xyz
domain_zone_blocked Filtered
Stage 4 of 9 Collects evidence for the verdict
Heuristics
Warnings, never a hard verdict on their own.
gnail.com → gmail.com)none@, unknown@ and test@test.comReason codes
disposable_provider role_address domain_typo_possible placeholder_address suspicious_keyword
Example
maria@gnail.com
domain_typo_possible Risky
Stage 5 of 9 Collects evidence for the verdict
DNS mail routing
Can this domain receive mail? Real lookups from your own computer.
Reason codes
domain_not_found null_mx_domain no_mail_records mx_records_unresolvable dns_lookup_failed
Example
jo@no-such-domain-4821.com
domain_not_found Invalid
Stage 6 of 9 Collects evidence for the verdict
Domain authentication
How seriously does the domain run its mail?
+all that authorises anyoneReason codes
no_spf_policy no_dmarc_policy spf_all_permissive dmarc_reject_policy
Example
team@sample-startup.io
dmarc_reject_policy Passed
Stage 7 of 9 Collects evidence for the verdict
Mail-server blocklists
Is the domain’s mail server known for spam?
Reason codes
dnsbl_listed_mx_ip dnsbl_clean dnsbl_not_checked
Example
promo@sample-bulkmailer.net
dnsbl_listed_mx_ip Risky
Stage 8 of 9 20 signals, one score
Spamtrap engine
Would mailing this get your sending domain blocklisted?
Reason codes
known_honeypot_address honeypot_local_pattern user_honeypot_domain honeypot_quarantined
Example
spamtrap@lists.example-isp.net
honeypot_local_pattern Honeypot
Stage 9 of 9 Optional · off by default
SMTP mailbox probing
Does this exact mailbox exist?
RCPT TO) and hangs up before any message could be sentReason codes
smtp_rcpt_accepted smtp_rcpt_rejected catch_all_domain smtp_probe_inconclusive
Example
old.account@sample-corp.com
smtp_rcpt_rejected Invalid
Spamtrap radar
Mailing one spamtrap can get your sending domain blocklisted. Each signal that fires adds its points: 4 is medium and 8 is high, and both are quarantined out of your send list automatically. Hover a dot, or select a few to build a score.
The radar view needs JavaScript. Every signal and its points are listed alongside.
Known traps and operators
The exact address is on the bundled list of 989 known traps (or your own list). These are traps that look like ordinary people.
The domain is on the trap-domain list: 327 bundled trap networks, blocklist zones, sinks and reserved names, plus any you add.
The domain belongs to an organisation that publicly runs spamtraps or honeytokens.
One of 432 blocklist operators, CERTs and mail-security vendors. Recorded as evidence only, because these domains also have ordinary staff mailboxes.
What operators call their traps
The part before the @ is a trap name (spamtrap, honeypot, sinkhole, seed list…) from 250 names and 16 naming patterns, tuned so real surnames like Trapp or Honeycutt pass.
The domain contains a trap word as a whole label or hyphenated part, e.g. spamtrap.example.net or mail-sinkhole.org.
The leftmost label of a subdomain is a collector name (trap, sinkhole, canary). Only the first label counts, because that is where operators put it.
A role mailbox that is also a classic recycled-trap target (abuse@, postmaster@). Deliberately weak: these exist on legitimate domains too.
Random tokens and bot patterns
The part before the @ is a bare UUID, a common per-trap identifier.
A long hexadecimal string: an MD5, SHA-1 or similar digest used as a per-recipient token.
A disposable-mailbox domain that has already scored on another signal. A disposable domain alone never triggers this.
A long local part with high randomness and no vowel pair: the shape of a machine-generated address.
Contains qwerty, asdfgh, 123456 or an implausible run of consonants, typical of bot-generated sign-ups.
Where the domain’s mail actually goes
An MX host names a trap operator or points at a sinkhole such as localhost, 127.0.0.1 or a bare dot (60 known hostname markers).
A null MX (“this domain accepts no mail”) published next to real mail servers: usually a collector, not a mail system.
Mail falls back to the domain’s own address because no MX exists. Common on small real domains, so it is worth a single point.
How the whole domain is set up
A DNS text record literally says spam trap, honeypot, sinkhole or do-not-send (55 phrases, matched as whole words).
The domain’s nameservers belong to a trap or blocklist operator, so the whole zone is under their control.
The domain receives mail but has no website at all. Fires only when both lookups gave a definite answer.
The domain accepts mail, yet its SPF record is exactly v=spf1 -all: it says it never sends anything, a posture typical of a collector.
Try it
Type any address and watch it move stage by stage to a verdict, with the reason codes the app would write.
Runs in your browser with a sample of the rules; the app also checks DNS, blocklists and SMTP.
Enter an address or pick a sample to watch it move through the stages.
Seven verdicts
Every address lands in exactly one of passed risky invalid unknown filtered duplicate honeypot. Each comes with a score from 0 to 100, a reason code and a plain-English explanation.
When checks disagree, the stronger verdict wins
Duplicate and Filtered are settled first, before any network check runs.
Evidence lab
Switch findings on for one address and watch which verdict the ladder settles on.
An inconclusive check never becomes a verdict: a timeout, blocked port or greylist is always unknown, never invalid and never passed.
Local vs pay-per-credit
Cloud verifiers charge for every address you check: roughly $37 to $80 for 10,000 and $550 to $3,000 for a million, and your list has to be uploaded to their servers. Dpunk runs the checks on your own computer for one flat monthly price, with as many runs as you like: up to 100,000 addresses per run on Essential and up to 1,000,000 on Pro and Enterprise.
| Addresses per month | Cloud (typical) | Cloud per email | Dpunk |
|---|---|---|---|
| 10,000 | $37 to $80 | $0.0037 to $0.008 | $19 a month |
| 100,000 | $150 to $650 | $0.0015 to $0.0065 | $19 a month |
| 1,000,000 | $550 to $3,000 | $0.00055 to $0.003 | $19 a month |
Rounded from public list prices of popular cloud verifiers in 2026 for one-off credit packs. One credit checks one email. Prices vary by provider, plan and volume.
Everything else
Load messy files and export clean send lists. The evidence for every decision is one click away.
Name <addr> lists--check addresses and print JSON--file list.csv for headless batch runs--no-window, --port, --verbosePricing
All nine verification stages in every plan. Pro adds SMTP probing and million-row runs; Enterprise adds automation and more speed. No per-address fees.
For one person cleaning their own lists on one PC.
Most popular
For marketers who need SMTP probing and big lists on up to three PCs.
For teams and agencies automating verification on up to ten PCs.
Pay with crypto via Cryptomus: USDT, BTC, ETH, LTC, TRX and more. Your license key is issued automatically the moment the payment confirms.
Every plan runs all nine verification stages, the spamtrap engine and the six blocklists. Higher plans add SMTP probing, bigger runs, more export formats and automation. Prices in USD.
Not sure yet? Try Pro free for 3 days on one PC. No payment needed.
Questions
Every address runs through nine stages on your own PC: syntax & parsing, duplicates, your own rules, heuristics (disposable, role, free-provider, typo and placeholder detection), DNS mail routing, domain authentication (SPF, DMARC, MTA-STS, BIMI), six mail-server blocklists, a 20-signal spamtrap engine and, if you switch it on, SMTP mailbox probing.
Each address ends in exactly one of seven verdicts (passed, risky, invalid, unknown, filtered, duplicate or honeypot) with a score from 0 to 100, a reason code and a plain-English explanation. See every method.
No. The app verifies everything on your own computer. The only traffic it creates is the DNS lookups the checks need (and, if you enable probing, the SMTP conversations with mail servers). Your list, your results and your exports stay on your PC.
Never. The SMTP prober asks the mail server about a recipient and hangs up before a message could start; it has no code path for sending mail at all.
Because a check could not finish: a DNS timeout, greylisting, a blocked port 25 or a temporary failure. The rule is simple: an inconclusive check never becomes a verdict. A false “invalid” would make you delete a real customer, so these addresses are marked unknown. Re-check them later; do not delete them.
Verification is the same in every plan: all nine stages, the 20-signal spamtrap engine, the 989 known trap addresses and the six blocklists. The plans differ in what you can do around it:
The plan is written into your license key, so the app turns on the right features offline. Compare the plans side by side.
Pay with crypto via Cryptomus: USDT, BTC, ETH, LTC, TRX and more. Your license key is issued automatically the moment the payment confirms. No waiting for a person to read an email.
3 days with the Pro features on one PC, no payment needed: SMTP probing, up to 1,000,000 rows per run, JSON and ZIP exports, snapshots and editable lists. Create an account, verify your email, then open the app and choose Start 3-day free trial on its License screen. It signs in and activates by itself. One trial per email address and one per PC.
Download the app, paste your Machine ID and start verifying in minutes. Nothing to install, nothing uploaded.
Verify. Protect. Grow.