Dpunk Email Verifier user guide

1 First run

Double-click DpunkEmailVerifier.exe. A window opens with a short welcome tour, then the License screen. There is nothing to install. Apart from the DNS lookups the checks need, the app only talks to this website to sign in and for its once-a-day license check-in.

2 Activating your license

The first time you open the app it lands on the License screen. New here? The Getting started page shows every step with pictures.

The easy way: sign in

1. Choose Sign in to activate and enter the email and password of your account on this website.
2. That is it. The app registers this PC on your account and sets up its key. No plan yet? Choose Start 3-day free trial on the same screen.

The other way: paste a key

1. Copy the Machine ID shown on the License screen (for example A1B2-C3D4-E5F6-7890). The ID is only a fingerprint, and nothing about your computer leaves it.
2. On this website, open Devices & keys in your account and add the Machine ID. Keys are issued straight away while your plan is active.
3. Copy the key: one long line starting with DPUNK1. (it may arrive wrapped over several lines in email; that is fine).
4. Choose I have a licence key, paste it and press Activate. Activation is instant and works offline.

The top bar then shows your plan and the days remaining. Once a day, while it is online, the app checks in with this website: it sends only the license ID, the Machine ID and the app version, and picks up renewals by itself. Your email lists never leave your PC. Until a valid key is active, everything except starting a verification still works. Expired keys get a 3-day grace period.

Moving to a new PC? If the old PC still works, open the License screen there and click Deactivate this PC, then sign in on the new PC. If the old PC is formatted, sold or broken, use Move to another PC in Devices & keys.

3 Verifying a list

1. Load addresses. Paste into the big text box, click Open file, or drag a .txt / .csv / .tsv onto the box. Plain text can be messy: the parser scrapes every address-shaped run of characters, so logs, JSON dumps and Name <addr> lists all work.
2. CSV / TSV files. The app sniffs the delimiter, detects the header row and picks the email column automatically. Check the Import mapping card if it guessed wrong.
3. Choose checks. The defaults are right for almost everyone. Turn off DNS & mail routing only for an offline syntax-only pass.
   • Mail-server blocklists (DNSBL): looks up each domain’s mail-server IP addresses on 6 public blocklists (Spamhaus, SpamCop, PSBL, DroneBL, SpamEatingMonkey, Mailspike), once per domain per run. A listed server marks the address Risky (tag dnsbl_listed_mx_ip), never Invalid; the detail panel shows which list. When no list could answer, the address gets dnsbl_not_checked, which is not a verdict. Needs DNS & mail routing. Spamhaus’ free public mirrors are for low-volume, non-commercial use: if you verify at high volume or commercially, switch this toggle off or use a Spamhaus DQS subscription.
4. Click Verify list (or press Ctrl + Enter). The run streams live; you can Pause, Resume or Stop at any time and keep what has been checked so far.

4 Reading the results

The Results tab opens automatically when the run finishes.

• The score (0 to 100) is a convenience for sorting and for “export everything over 80”. The status and tags are the real answer.
• Click any row for the full evidence: MX records, SPF/DMARC posture, every trap signal that fired with its points, and the SMTP conversation if probing was on.
• Click a stat tile to filter by that status. Use the filters row for TLD, free-text search and minimum score.

5 Exporting

The Export scope selector applies to every button: everything, the clean send list, passed only, spamtraps only, or a single status. Files land in Downloads\DpunkEmailVerifier\.

6 Lists & policy

• Blocked domains and addresses: a bare word (xyz) matches a whole TLD; example.com also covers its subdomains; anything with an @ blocks one exact address.
• Domain-zone mode: allow only certain TLDs, or block certain TLDs.
• Intel lists: the bundled disposable / free / role / trap lists are editable text. Restore bundled lists brings the defaults back.
• Known spamtrap addresses: exact addresses known to be traps that look like ordinary people. 989 are bundled, including the abuse and phishing-report desks of major providers. Mailing those gets a sender reported, so they are quarantined too. A match is quarantined as Honeypot even with the heuristic engine switched off. Add your own in the box, or paste full addresses into the trap-domains box. Both work.

7 SMTP probing (optional)

It is off by default. Turn on Enable SMTP probing on the SMTP tab, then choose under How should mailboxes be checked?:

• Dpunk probe server (recommended): our server asks each mail server for you, so it works even when your network blocks port 25. Nothing to set up. See below.
• Directly from this PC: the app talks to each domain’s mail server on port 25. Most home connections block that port, and then you see Unknown, which is the honest answer.
• My own mail server (relay): your mail provider is asked instead. Accurate for the domains it hosts.
• This computer’s mail server (Enterprise): the mail server installed on the PC or RDP server the app runs on.

The tab shows only the fields the chosen way uses. Whichever way you pick, catch-all domains prove nothing, and you should keep the domain allow-list on unless you own or are engaged by every domain in your list. While the restriction is on, the allow-list of domains you may probe must not be empty; addresses outside it are not probed and show skipped in the SMTP column with the reason. The three ways that probe from your side also need MAIL FROM (the sender address the probe announces, e.g. verify@yourdomain.com).

The Dpunk probe server

The app first runs every other check on your PC. Then it sends only the addresses that still need a mailbox check to our probe server, over an encrypted connection, and fills in each answer as it arrives. The server asks each mail server exactly the way the app does and hangs up before any message could start. Addresses are deleted within an hour of the check, and your list, your other results and your exports never leave your PC.

Pro and Enterprise include a monthly allowance of mailbox checks, shared by all your PCs, and the free trial includes some too. The SMTP tab shows how many are left and when they reset. Only real answers from a mail server count; a server that never answers costs nothing. When the allowance runs out, the remaining mailbox checks show Unknown with that reason, and every other check still runs. Pausing or stopping a run releases the checks it has not used.

Is it working? Press “Run test”

Enter one address (one of your own is best) at the top of the SMTP tab. The app connects to that domain’s real mail server with your settings and shows every line of the conversation (greeting, EHLO, STARTTLS, MAIL FROM, the catch-all check, RCPT TO), followed by a plain verdict: working, port 25 blocked on this network, configuration problem, or inconclusive. Nothing is sent. The Diagnostics page also shows whether outbound port 25 is open from this PC. With the Dpunk probe server chosen, the test asks the server to check that one address and uses one check from your allowance.

Using your own mail server (relay)

If you are cleaning addresses that your own mail system hosts, or your network blocks port 25, choose My own mail server (relay) and pick your Provider (Gmail / Google Workspace, Microsoft 365, Yahoo, Zoho, iCloud, SendGrid, Mailgun, Amazon SES, Brevo or Postmark), or leave it on Custom and type the host yourself. A preset fills the host, port and encryption and shows that provider’s login note; then enter your Username and Password.

With Port and Encryption on auto (the default) the app works them out for you: press Detect port & encryption and it tries 587, 465, 2525 and 25 with STARTTLS and SSL/TLS, shows a table of what each combination answered (connect, TLS, login) and keeps the first one that works. The login is only ever sent over TLS, and the probe then asks your server instead of the domain’s mail server.

Passwords for relays

Gmail, Yahoo and iCloud (and Zoho with two-factor on) refuse your normal password, so create an app password in the account’s security settings and use that. Microsoft 365 needs Authenticated SMTP enabled for the mailbox (and an app password if MFA is on). SendGrid’s username is literally apikey; Postmark uses the Server API token as both username and password. The password stays in memory only. It is never written to disk, so re-enter it after restarting.

A relay is authoritative for the domains it hosts; for other domains most relays accept everything and bounce later, so those results stay Unknown. If the relay cannot be reached on any port, every address in the run is Unknown with the reason relay unreachable. A refused password shows the relay rejected the login, and a relay that offers no TLS shows the relay offers no TLS, so the login was never sent. SMTP login and the sender address are ASCII-only (use punycode xn-- for an internationalised domain).

Running on a server with its own mail service

If the app runs on a PC or RDP server that already has a mail server installed (hMailServer, Postfix, Exim, IIS SMTP, PowerMTA, MailEnable, Sendmail), choose This computer’s mail server (Enterprise). Probes then go through that server on 127.0.0.1 and the port and encryption are found automatically. Press Detect local mail server to see which of 25, 587, 2525 and 465 answered.

Username and Password are optional here: most local servers accept connections from their own machine without a login. MAIL FROM is still required: use an address at the domain that server sends for. That server’s own IP reputation and port-25 access are what make probing accurate. If nothing is listening, Run test says No mail server is listening on this computer. Only the loopback address is allowed this way: typing 127.0.0.1 or localhost as an ordinary relay host is refused.

8 Snapshots

Save current run stores the full result set under your profile so you can reload it later without re-checking. Snapshots never leave the machine.

9 Diagnostics

Before a very large run, open Diagnostics → Run checks. It performs live lookups, shows which resolvers are healthy and how fast, reports the DNS cache state, and asks each of the 6 blocklists for its test entry (working, refused, no answer or error). If a home router resolver is slow it is benched automatically and public resolvers are used instead.

10 Keyboard

11 Command line

The same EXE runs headless from a terminal:

# verify addresses, print JSON
DpunkEmailVerifier.exe --check a@b.com c@d.org

# batch mode; writes list-verified.csv next to the input
DpunkEmailVerifier.exe --file list.csv

# run the engine and print the URL (use any browser)
DpunkEmailVerifier.exe --no-window

# bind a fixed port instead of a random one
DpunkEmailVerifier.exe --port 8787

# DEBUG logging to the log file
DpunkEmailVerifier.exe --verbose

12 Where your files go

13 Troubleshooting

The window did not open

The app uses Microsoft Edge or Chrome in app mode. If neither is installed, it falls back to your default browser. Run DpunkEmailVerifier.exe --no-window from a terminal to get the URL directly.

Lots of Unknown

Your resolver is dropping queries. Lower Parallel checks on the Verify tab, or run Diagnostics.

Blocklists say “refused” / addresses show dnsbl_not_checked

Spamhaus refuses queries that arrive through big public resolvers. Use your ISP’s resolver or your own, or accept that Spamhaus is skipped; the other five lists still count. A refused list is never read as clean or as listed.

“This key was issued for another PC”

Add the Machine ID shown on the License screen in Devices & keys and paste the key issued for it.

Logs

%LOCALAPPDATA%\DpunkEmailVerifier\logs\dpunk.log

Still stuck? Send us a message with what you tried and the relevant lines from the log.