Bulk email verifier for Windows, local-first
Nine verification stages, a 24-signal spamtrap engine and six blocklists run on your own PC, up to 1,000,000 rows per run. Nothing is uploaded, and no message is ever sent.
The pipeline
The first three stop an address as soon as they match. The rest collect evidence, and the verdict ladder weighs it at the end. Pick a stage to see what it checks.
Stage 1 of 9 Stops the address on a match
Syntax & parsing
Is this a well-formed address at all?
Name <addr> forms and quoted local partsalice+news@).test .local .invalid .onion .internal .corp example.comReason codes
syntax_invalid reserved_tld plus_addressed idn_domain
Example
sam..lee@mail.test
syntax_invalid Invalid
Stage 2 of 9 Stops the address on a match
Duplicates
Seen this one already?
+tags can count as the same address, so j.smith+news@gmail.com matches jsmith@gmail.com (off by default)Reason codes
duplicate_email
Example
Ana.Silva@Company.com
duplicate_email Duplicate
Stage 3 of 9 Stops the address on a match
Your rules
Addresses you have decided never to mail.
@ blocks one addressReason codes
blocked_domain_or_address domain_zone_blocked free_provider_excluded evidence_hard_bounce
Example
buyer@shop.xyz
domain_zone_blocked Filtered
Stage 4 of 9 Collects evidence for the verdict
Heuristics
Warnings, never a hard verdict on their own.
billing2 and noreply-alertsinfo@, sales@ and support@, and forms like sales-de) pass and only get a “Team inbox” tagраypal.com)gnail.com → gmail.com)none@, unknown@ and test@test.comReason codes
disposable_provider role_address role_contact domain_typo_possible homoglyph_lookalike_domain placeholder_address
Example
maria@gnail.com
domain_typo_possible Risky
Stage 5 of 9 Collects evidence for the verdict
DNS mail routing
Can this domain receive mail? Real lookups from your own computer.
Reason codes
domain_not_found null_mx_domain no_mail_records mx_records_unresolvable mx_nonpublic_address dns_lookup_failed
Example
jo@no-such-domain-4821.com
domain_not_found Invalid
Stage 6 of 9 Collects evidence for the verdict
Domain authentication
How seriously does the domain run its mail?
+all that authorises anyoneReason codes
no_spf_policy no_dmarc_policy spf_all_permissive dmarc_reject_policy
Example
team@sample-startup.io
dmarc_reject_policy Passed
Stage 7 of 9 Collects evidence for the verdict
Mail-server blocklists
Is the domain’s mail server known for spam?
Reason codes
dnsbl_listed_mx_ip dnsbl_clean dnsbl_not_checked
Example
promo@sample-bulkmailer.net
dnsbl_listed_mx_ip Risky
Stage 8 of 9 24 signals, one score
Spamtrap engine
Would mailing this get your sending domain blocklisted?
Reason codes
known_honeypot_address honeypot_local_pattern obfuscated_trap_local user_honeypot_domain honeypot_quarantined
Example
spamtrap@lists.example-isp.net
honeypot_local_pattern Honeypot
Stage 9 of 9 Optional · off by default
SMTP mailbox probing
Does this exact mailbox exist?
RCPT TO) and hangs up before any message could be sentReason codes
smtp_rcpt_accepted smtp_rcpt_rejected catch_all_domain smtp_probe_inconclusive
Example
old.account@sample-corp.com
smtp_rcpt_rejected Invalid
Spamtrap radar
Mailing one spamtrap can get your sending domain blocklisted. Each signal that fires adds its points: 4 is medium and 8 is high, and both are quarantined out of your send list automatically. Hover a dot, or select a few to build a score.
The radar view needs JavaScript. Every signal and its points are listed alongside.
Known traps, operators and your own file
The exact address is on the bundled list of 989 known traps (or your own list). These are traps that look like ordinary people.
The domain is on the trap-domain list: 339 bundled trap networks, blocklist zones, sinks and reserved names, plus any you add.
The domain belongs to an organisation that publicly runs spamtraps or honeytokens.
One of 432 blocklist operators, CERTs and mail-security vendors. Recorded as evidence only, because these domains also have ordinary staff mailboxes.
Your own file marks the address as a spamtrap (a spamtrap or mailbox status column). Read only when the file has such a column.
What operators call their traps
The part before the @ is a trap name (spamtrap, honeypot, sinkhole, seed list…) from 250 names and 16 naming patterns, tuned so real surnames like Trapp or Honeycutt pass. Separator forms such as honey.pot and sink.hole count too.
The part before the @ is a trap word written with digits in place of letters, such as sp4mtr4p or h0neyp0t.
The domain contains a trap word as a whole label or hyphenated part, e.g. spamtrap.example.net or mail-sinkhole.org.
A label of the domain is a trap word written with digits in place of letters, such as h0neyp0t or s1nkh0le.
The leftmost label of a subdomain is a collector name (trap, sinkhole, canary). Only the first label counts, because that is where operators put it.
A role mailbox that is also a classic recycled-trap target (abuse@, postmaster@). Deliberately weak: these exist on legitimate domains too.
Random tokens and bot patterns
The part before the @ is a bare UUID, a common per-trap identifier.
A long hexadecimal string: an MD5, SHA-1 or similar digest used as a per-recipient token.
A disposable-mailbox domain that has already scored on another signal. A disposable domain alone never triggers this.
A long local part with high randomness and no vowel pair: the shape of a machine-generated address.
Contains qwerty, asdfgh, 123456 or an implausible run of consonants, typical of bot-generated sign-ups.
Where the domain’s mail actually goes
An MX host names a trap operator or points at a sinkhole such as localhost, 127.0.0.1 or a bare dot (60 known hostname markers).
A null MX (“this domain accepts no mail”) published next to real mail servers: usually a collector, not a mail system.
The domain is parked with a domain-parking company (its nameservers or mail servers belong to one), yet it accepts mail. Parked domains are where recycled and typo traps live.
Mail falls back to the domain’s own address because no MX exists. Common on small real domains, so it is worth a single point.
How the whole domain is set up
A DNS text record literally says spam trap, honeypot, sinkhole or do-not-send (55 phrases, matched as whole words).
The domain’s nameservers belong to a trap or blocklist operator, so the whole zone is under their control.
The domain receives mail but has no website at all. Fires only when both lookups gave a definite answer.
The domain accepts mail, yet its SPF record is exactly v=spf1 -all: it says it never sends anything, a posture typical of a collector.
Try it
Type any address and watch it move stage by stage to a verdict, with the reason codes the app would write.
Runs in your browser with a sample of the rules; the app also checks DNS, blocklists and SMTP.
Enter an address or pick a sample to watch it move through the stages.
Seven verdicts
Every address lands in exactly one of passed risky invalid unknown filtered duplicate honeypot. Each comes with a score from 0 to 100, a reason code and a plain-English explanation.
When checks disagree, the stronger verdict wins
Duplicate and Filtered are settled first, before any network check runs.
Evidence lab
Switch findings on for one address and watch which verdict the ladder settles on.
An inconclusive check never becomes a verdict: a timeout, blocked port or greylist is always unknown, never invalid and never passed.
Local vs pay-per-credit
Cloud verifiers charge for every address you check: roughly $37 to $80 for 10,000 and $550 to $3,000 for a million, and your list has to be uploaded to their servers. Dpunk runs the checks on your own computer for one flat monthly price, with as many runs as you like: up to 100,000 addresses per run on Essential and up to 1,000,000 on Pro and Enterprise.
| Addresses per month | Cloud (typical) | Cloud per email | Dpunk |
|---|---|---|---|
| 10,000 | $37 to $80 | $0.0037 to $0.008 | $19 a month |
| 100,000 | $150 to $650 | $0.0015 to $0.0065 | $19 a month |
| 1,000,000 | $550 to $3,000 | $0.00055 to $0.003 | $19 a month |
Rounded from public list prices of popular cloud verifiers in 2026 for one-off credit packs. One credit checks one email. Prices vary by provider, plan and volume.
Everything else
Load messy files and export clean send lists. The evidence for every decision is one click away.
Name <addr> listshard_bounce, complaint, unsubscribed, spamtrap, consent, last_opened or list_source are read when your CSV has them--check addresses and print JSON--file list.csv for headless batch runs--no-window, --port, --verbosePricing
All nine verification stages in every plan. Pro adds SMTP probing and million-row runs; Enterprise adds automation and more speed. No per-address fees.
For one person cleaning their own lists on one PC.
Most popular
For marketers who need SMTP probing and big lists on up to three PCs.
For teams and agencies automating verification on up to ten PCs.
Pay with crypto via Cryptomus: USDT, BTC, ETH, LTC, TRX and more. Your license key is issued automatically the moment the payment confirms.
Every plan runs all nine verification stages, the spamtrap engine and the six blocklists. Higher plans add SMTP probing, bigger runs, more export formats and automation. Prices in USD.
Not sure yet? Try Pro free for 3 days on one PC. No payment needed.
Email verification software
Load a CSV, TXT or TSV list, verify it on Windows and export a clean email list that is ready for your email marketing tool.
Verify email addresses in bulk: up to 1,000,000 rows per run on Pro and Enterprise and 100,000 on Essential, from pasted text or a file.
Remove invalid, duplicate and disposable addresses, flag no-reply, billing and other risky role accounts, catch typos such as gnail.com with a suggested fix, and export only the addresses worth mailing. Team inboxes such as info@ and sales@ stay in.
A 24-signal spam trap checker quarantines likely honeypots and known trap addresses before they can get your sending domain blocklisted.
MX and DNS lookups, SPF, DMARC and MTA-STS, plus six mail server blocklists including Spamhaus and SpamCop, help you lower bounces and protect your sender reputation.
On Pro and Enterprise, check whether a mailbox exists without sending an email, with catch-all detection for servers that accept every address.
Your email lists stay on your computer. One flat subscription with no per-address credits, and a free trial to start.
Questions
Every address runs through nine stages on your own PC: syntax & parsing, duplicates, your own rules, heuristics (disposable, risky-role, free-provider, typo, lookalike and placeholder detection), DNS mail routing, domain authentication (SPF, DMARC, MTA-STS, BIMI), six mail-server blocklists, a 24-signal spamtrap engine and, if you switch it on, SMTP mailbox probing.
Each address ends in exactly one of seven verdicts (passed, risky, invalid, unknown, filtered, duplicate or honeypot) with a score from 0 to 100, a reason code and a plain-English explanation. See every method.
No. The app verifies everything on your own computer. The only traffic it creates is the DNS lookups the checks need (and, if you enable probing, the SMTP conversations with mail servers). Your list, your results and your exports stay on your PC.
The one exception is a mailbox check you choose to run on the Dpunk probe server: only the addresses being checked are sent there, over an encrypted connection, and they are deleted within an hour.
Never. The SMTP prober asks the mail server about a recipient and hangs up before a message could start; it has no code path for sending mail at all.
Because a check could not finish: a DNS timeout, greylisting, a blocked port 25 or a temporary failure. The rule is simple: an inconclusive check never becomes a verdict. A false “invalid” would make you delete a real customer, so these addresses are marked unknown. Re-check them later; do not delete them.
Verification is the same in every plan: all nine stages, the 24-signal spamtrap engine, the 989 known trap addresses and the six blocklists. The plans differ in what you can do around it:
The plan is written into your license key, so the app turns on the right features offline. Compare the plans side by side.
Pay with crypto via Cryptomus: USDT, BTC, ETH, LTC, TRX and more. Your license key is issued automatically the moment the payment confirms. No waiting for a person to read an email.
3 days with the Pro features on one PC, no payment needed: SMTP probing, up to 1,000,000 rows per run, JSON and ZIP exports, snapshots and editable lists. Create an account, verify your email, then open the app and choose Start 3-day free trial on its License screen. It signs in and activates by itself. One trial per email address and one per PC.
Download the app, paste your Machine ID and start verifying in minutes. Nothing to install, nothing uploaded.
Verify. Protect. Grow.