Verification methods · version 1.0.19

Every check between a raw list and a safe send.

Each address runs through nine stages on your own computer and lands in exactly one of seven verdicts, with a confidence score from 0 to 100, a reason code and a plain-English explanation. Nothing is uploaded, and no message is ever sent.

  • 9stages
  • 24spamtrap signals
  • 6blocklists
  • 3SMTP routes
  • 7verdicts

Seven verdicts

Exactly one status for every address

An inconclusive check never becomes a verdict. A timeout, a blocked port or greylisting always means “unknown”. A false “invalid” would delete a real customer, and a false “passed” on a spamtrap would get your domain blocklisted.

When checks disagree, the stronger verdict wins

  1. Invalid cannot receive mail
  2. Honeypot spamtrap, quarantined
  3. Unknown a check could not finish
  4. Risky deliverable, but flagged
  5. Passed safe to send

Duplicate and Filtered are settled first, before any network check runs.

StatusWhat it meansSend to it?
Passed Valid syntax, the domain accepts mail, and no risk rule fired. Yes
Risky Deliverable but flagged: a no-reply, billing or other risky role mailbox, disposable provider, possible typo, lookalike domain, catch-all server, placeholder, blocklisted mail server, odd shape. Your call
Invalid Cannot receive mail: bad syntax, the domain does not exist, null MX, no mail records, a reserved name, or the server said the mailbox does not exist. No
Unknown A check could not finish: DNS or SMTP timeout, greylisting, blocked port 25, temporary failure. Re-check later
Filtered Excluded by your own rules or your own file: blocked list, domain-zone policy, free-provider exclusion, or a hard bounce, complaint, unsubscribe or withdrawn consent that your file reports. No
Duplicate The same address appeared earlier in the list; the first copy carries the verdict. Already covered
Honeypot The spamtrap engine scored the address medium or high, so it is removed from your send list automatically. Never

The pipeline

Nine stages, in the order they run

The first three stop an address as soon as they match, before a single network lookup is spent on it. The rest collect evidence, and the verdict ladder weighs it at the end.

  1. 01 Syntax & parsing

    Stage 1 of 9 Stops the address on a match

    Syntax & parsing

    Is this a well-formed address at all?

    • Full address grammar and length limits; Name <addr> forms and quoted local parts
    • International domains converted to punycode; non-ASCII local parts marked unknown, never invalid
    • Plus-addressing detected (alice+news@)
    • Reserved and special-use names rejected: .test .local .invalid .onion .internal .corp example.com

    Reason codes

    syntax_invalid reserved_tld plus_addressed idn_domain

    Example

    sam..lee@mail.test syntax_invalid Invalid

  2. 02 Duplicates

    Stage 2 of 9 Stops the address on a match

    Duplicates

    Seen this one already?

    • Case-insensitive; the first occurrence keeps the verdict and later copies point back to it
    • Settled before any network check runs, so a repeated address never costs a lookup
    • Optional: Gmail dots and +tags can count as the same address, so j.smith+news@gmail.com matches jsmith@gmail.com (off by default)

    Reason codes

    duplicate_email

    Example

    Ana.Silva@Company.com duplicate_email Duplicate

  3. 03 Your rules

    Stage 3 of 9 Stops the address on a match

    Your rules

    Addresses you have decided never to mail.

    • Blocked list: a bare word blocks a whole TLD, a domain also covers its subdomains, an entry with @ blocks one address
    • Domain-zone mode: allow only certain TLDs, or block certain TLDs
    • Optional exclusion of free consumer providers
    • Evidence columns in your own file: a hard bounce, complaint, unsubscribe or withdrawn consent files the address under filtered before any lookup

    Reason codes

    blocked_domain_or_address domain_zone_blocked free_provider_excluded evidence_hard_bounce

    Example

    buyer@shop.xyz domain_zone_blocked Filtered

  4. 04 Heuristics

    Stage 4 of 9 Collects evidence for the verdict

    Heuristics

    Warnings, never a hard verdict on their own.

    • Disposable providers (1,037 domains) and free providers (373)
    • Risky role mailboxes: 327 names in 7 kinds (no-reply, system, abuse and security, legal and privacy, billing, team-wide lists, list and unsubscribe addresses), plus numbered and compound forms such as billing2 and noreply-alerts
    • Business inboxes people read (351 names in many languages, such as info@, sales@ and support@, and forms like sales-de) pass and only get a “Team inbox” tag
    • Lookalike domains that use Cyrillic or Greek letters to imitate a brand (раypal.com)
    • Typo detection: 567 known typo domains plus edit-distance matching against 86 major providers, with a suggested fix (gnail.com → gmail.com)
    • Placeholders such as none@, unknown@ and test@test.com
    • Domain shape: uncommon TLD, one-character or 30+ character name, all digits, many hyphens, no vowels
    • Local-part shape: very long, long digit runs, repeated characters, all digits, many separators, throwaway keywords, very short

    Reason codes

    disposable_provider role_address role_contact domain_typo_possible homoglyph_lookalike_domain placeholder_address

    Example

    maria@gnail.com domain_typo_possible Risky

  5. 05 DNS mail routing

    Stage 5 of 9 Collects evidence for the verdict

    DNS mail routing

    Can this domain receive mail? Real lookups from your own computer.

    • MX records, RFC 7505 null MX, fallback to the domain’s own address when there is no MX, non-existent domains
    • Checks that the published mail servers actually resolve; servers that point at private or loopback addresses mark the address risky
    • A “domain does not exist” answer is checked with a second public DNS resolver before the address is called invalid; if the two disagree, it is unknown
    • Shows the mail provider behind each domain, such as Google Workspace, Microsoft 365 or Proofpoint
    • Built-in DNS client: UDP and TCP, your Windows resolvers, slow resolvers set aside automatically, DNS-over-HTTPS fallback, shared cache
    • A failed lookup is “unknown”, never “invalid”

    Reason codes

    domain_not_found null_mx_domain no_mail_records mx_records_unresolvable mx_nonpublic_address dns_lookup_failed

    Example

    jo@no-such-domain-4821.com domain_not_found Invalid

  6. 06 Domain authentication

    Stage 6 of 9 Collects evidence for the verdict

    Domain authentication

    How seriously does the domain run its mail?

    • SPF, including a permissive +all that authorises anyone
    • DMARC policy (none, quarantine, reject)
    • MTA-STS enforcement and BIMI

    Reason codes

    no_spf_policy no_dmarc_policy spf_all_permissive dmarc_reject_policy

    Example

    team@sample-startup.io dmarc_reject_policy Passed

  7. 07 Mail-server blocklists

    Stage 7 of 9 Collects evidence for the verdict

    Mail-server blocklists

    Is the domain’s mail server known for spam?

    • Each domain’s mail-server IPs checked against 6 public blocklists: Spamhaus, SpamCop, PSBL, DroneBL, SpamEatingMonkey, Mailspike
    • Looked up once per server and shared across the whole run, so a million addresses on one provider cost one lookup
    • A listed server marks the address risky; a blocklist that refuses to answer is recorded as “not checked”, never as clean

    Reason codes

    dnsbl_listed_mx_ip dnsbl_clean dnsbl_not_checked

    Example

    promo@sample-bulkmailer.net dnsbl_listed_mx_ip Risky

  8. 08 Spamtrap engine

    Stage 8 of 9 24 signals, one score

    Spamtrap engine

    Would mailing this get your sending domain blocklisted?

    • 24 independent signals, each worth 0 to 10 points, added into one score
    • A score of 4 or more is medium and 8 or more is high; both are quarantined as honeypot. Low scores are shown as warnings only
    • Known trap addresses are quarantined even when the rest of the engine is switched off
    • List-wide checks: addresses next to planted trap names on the same domain, and domains whose addresses are almost all machine-made, are marked risky (never removed on that alone)

    Reason codes

    known_honeypot_address honeypot_local_pattern obfuscated_trap_local user_honeypot_domain honeypot_quarantined

    Example

    spamtrap@lists.example-isp.net honeypot_local_pattern Honeypot
    All 24 signals and their points

  9. 09 SMTP mailbox probing

    Stage 9 of 9 Optional · off by default

    SMTP mailbox probing

    Does this exact mailbox exist?

    • Asks the mail server about the recipient (RCPT TO) and hangs up before any message could be sent
    • Tests a random address first to spot catch-all servers that accept everyone
    • Greylisting retried, a delay between probes to the same domain, and an allow-list of domains you may probe
    • Three routes: direct to the domain’s MX, your own relay (10 provider presets, port and encryption auto-detected), or this computer’s mail server

    Reason codes

    smtp_rcpt_accepted smtp_rcpt_rejected catch_all_domain smtp_probe_inconclusive

    Example

    old.account@sample-corp.com smtp_rcpt_rejected Invalid
    Three ways to connect

Spamtrap engine

24 signals added into one score

Each signal that fires adds its points. A score of 1 to 3 is low and only a warning. A score of 4 or more is medium, 8 or more is high, and both are quarantined as honeypot. Known trap addresses are quarantined even when the rest of the engine is switched off. Two list-wide checks add to this: an address next to planted trap names on the same domain, or on a domain whose addresses are almost all machine-made, is marked risky, never removed on that alone.

The radar view needs JavaScript. Every signal and its points are listed alongside.

Every signal adds its points to one score. The rings on the radar mark the two thresholds.

  • 1 to 3 points · lowWarning only; the address stays in your send list.
  • 4 to 7 · mediumQuarantined as honeypot.
  • 8+ · highQuarantined. Any single signal worth 8 to 10 points gets here alone.

Hover a dot for details, or open any signal below. Pick a few to see how they add up.

Intelligence lists 5

Known traps, operators and your own file

  • Known trap address 10 pts

    The exact address is on the bundled list of 989 known traps (or your own list). These are traps that look like ordinary people.

    known_honeypot_address
  • Trap or blocklist domain 10 pts

    The domain is on the trap-domain list: 339 bundled trap networks, blocklist zones, sinks and reserved names, plus any you add.

    user_honeypot_domain
  • Trap-operator domain 10 pts

    The domain belongs to an organisation that publicly runs spamtraps or honeytokens.

    known_honeypot_domain
  • Anti-abuse organisation 0 pts

    One of 432 blocklist operators, CERTs and mail-security vendors. Recorded as evidence only, because these domains also have ordinary staff mailboxes.

    reputation_service_domain
  • Spamtrap in your file 10 pts

    Your own file marks the address as a spamtrap (a spamtrap or mailbox status column). Read only when the file has such a column.

    evidence_spamtrap

Naming 6

What operators call their traps

  • Trap local part 8 pts

    The part before the @ is a trap name (spamtrap, honeypot, sinkhole, seed list…) from 250 names and 16 naming patterns, tuned so real surnames like Trapp or Honeycutt pass. Separator forms such as honey.pot and sink.hole count too.

    honeypot_local_pattern
  • Trap word spelt with digits 4 pts

    The part before the @ is a trap word written with digits in place of letters, such as sp4mtr4p or h0neyp0t.

    obfuscated_trap_local
  • Trap word in the domain 6 pts

    The domain contains a trap word as a whole label or hyphenated part, e.g. spamtrap.example.net or mail-sinkhole.org.

    honeypot_domain_pattern
  • Digit-spelt trap word in the domain 2 pts

    A label of the domain is a trap word written with digits in place of letters, such as h0neyp0t or s1nkh0le.

    obfuscated_trap_domain
  • Trap subdomain label 5 pts

    The leftmost label of a subdomain is a collector name (trap, sinkhole, canary). Only the first label counts, because that is where operators put it.

    honeypot_subdomain_label
  • Role & recycled-trap target 2 pts

    A role mailbox that is also a classic recycled-trap target (abuse@, postmaster@). Deliberately weak: these exist on legitimate domains too.

    role_trap_hybrid

Machine-made 5

Random tokens and bot patterns

  • UUID local part 4 pts

    The part before the @ is a bare UUID, a common per-trap identifier.

    uuid_local
  • Hash local part 3 pts

    A long hexadecimal string: an MD5, SHA-1 or similar digest used as a per-recipient token.

    hex_hash_local
  • Disposable + another signal 3 pts

    A disposable-mailbox domain that has already scored on another signal. A disposable domain alone never triggers this.

    disposable_trap_combo
  • High-entropy local part 2 pts

    A long local part with high randomness and no vowel pair: the shape of a machine-generated address.

    high_entropy_local
  • Keyboard walk or bot shape 2 pts

    Contains qwerty, asdfgh, 123456 or an implausible run of consonants, typical of bot-generated sign-ups.

    bot_keyboard_local

DNS routing 4 needs DNS

Where the domain’s mail actually goes

  • Trap or sinkhole mail server 6 pts

    An MX host names a trap operator or points at a sinkhole such as localhost, 127.0.0.1 or a bare dot (60 known hostname markers).

    honeypot_mx_pattern
  • Contradictory null MX 2 pts

    A null MX (“this domain accepts no mail”) published next to real mail servers: usually a collector, not a mail system.

    malformed_null_mx
  • Parked domain that takes mail 3 pts

    The domain is parked with a domain-parking company (its nameservers or mail servers belong to one), yet it accepts mail. Parked domains are where recycled and typo traps live.

    parked_domain_mail
  • No MX record 1 pt

    Mail falls back to the domain’s own address because no MX exists. Common on small real domains, so it is worth a single point.

    implicit_mx_anomaly

Zone fingerprint 4 needs DNS

How the whole domain is set up

  • Trap marker in TXT or SPF 8 pts

    A DNS text record literally says spam trap, honeypot, sinkhole or do-not-send (55 phrases, matched as whole words).

    txt_honeypot_marker
  • Trap-operator nameservers 6 pts

    The domain’s nameservers belong to a trap or blocklist operator, so the whole zone is under their control.

    ns_sinkhole
  • Mail-only domain 3 pts

    The domain receives mail but has no website at all. Fires only when both lookups gave a definite answer.

    mail_only_domain
  • Receive-only SPF 2 pts

    The domain accepts mail, yet its SPF record is exactly v=spf1 -all: it says it never sends anything, a posture typical of a collector.

    spf_all_fail_with_mx

SMTP mailbox probing

Four ways to ask a mail server

Probing comes with Pro and Enterprise, and it stays off until you turn it on. Every conversation ends before a message could be sent; the app has no code path for sending mail.

Dpunk probe server

From our server, nothing to set up

The app sends only the addresses being checked to our probe server, which has port 25 open and asks each mail server for you. A bulk list shows its normal results at once, and each mailbox answer updates its row as it arrives.

  • Works when your network blocks port 25
  • 200,000 a month on Pro, 500,000 a month on Enterprise; only real answers use a check
  • A mailbox with no answer is asked again, then shown as not confirmed, never as passed
  • Addresses are deleted within an hour of the check

Direct

To the domain’s own mail server

Connects to the recipient domain’s MX on port 25. This gives the most authoritative answer there is.

  • Needs outbound port 25, which most home and office networks block
  • The Diagnostics page tells you whether port 25 is open
  • An allow-list of domains you may probe is on by default

Relay

Through your own mail server

Logs in to your provider and asks it instead. Port and encryption are detected automatically: 587, 465, 2525 and 25, with STARTTLS or SSL/TLS. The login is only ever sent over TLS.

10 provider presets

  • Gmail / Workspace
  • Microsoft 365
  • Yahoo
  • Zoho
  • iCloud
  • SendGrid
  • Mailgun
  • Amazon SES
  • Brevo
  • Postmark

This computer

Through a local mail server

Uses the mail server installed on the PC or RDP server (hMailServer, Postfix, Exim, IIS SMTP, PowerMTA, MailEnable, Sendmail) at 127.0.0.1, with ports detected automatically.

  • Included with Enterprise
  • Login is optional on this machine
  • That server’s own IP reputation and port-25 access decide accuracy
How server replies become verdicts
What the server answersResultVerdict
250 / 251 for the address, and a random address was refusedMailbox acceptedPassed
550 5.1.1 “no such user”Mailbox not foundInvalid
Accepts the random address tooCatch-all server; acceptance proves nothingRisky
4xx greylisting or temporary failure, 5.7.x policy block, 252 “cannot verify”, a bare 550, blocked port, relay unreachableInconclusiveUnknown

Run test

Probes one address with your settings and shows the whole conversation: greeting, EHLO, STARTTLS, login, the catch-all check and the recipient check. It ends with a plain verdict: working, port 25 blocked on this network, configuration problem, or inconclusive.

Detect port & encryption

Tries every port and encryption combination and shows connect, TLS and login results for each. It keeps the working combination and explains login errors in plain terms, for example when Gmail needs an app password or Microsoft 365 needs authenticated SMTP turned on.

Bundled intelligence

What the engine knows before it looks anything up

Every list is plain text. Pro and Enterprise let you edit them in the app, and one click restores the bundled defaults.

  • 989known trap addresses, including abuse and phishing-report desks
  • 339trap networks, blocklist zones, sinks and reserved names
  • 432anti-abuse organisations, CERTs and mail-security vendors
  • 250trap local-part names, plus 16 naming patterns
  • 1,037disposable and temporary mailbox domains
  • 373free consumer mailbox providers
  • 327risky role names in 7 kinds (noreply@, billing@…), plus 351 business inbox names that pass
  • 567known typo domains across 86 major providers
  • 60sinkhole and trap-operator hostname markers
  • 55trap phrases recognised in DNS text records
  • 77placeholder names and addresses (none@, test@test.com…)
  • 6public blocklists checked for mail-server IPs

Blocklists checked: Spamhaus SpamCop PSBL DroneBL SpamEatingMonkey Mailspike

Everything else

Built for real lists, from import to export

Import anything

  • Paste text or drop a .txt, .csv or .tsv file: 100,000 rows per run on Essential, 1,000,000 on Pro and Enterprise
  • Addresses are picked out of messy text, logs and Name <addr> lists
  • Delimiter, header row and email column detected automatically
  • Evidence columns such as hard_bounce, complaint, unsubscribed, spamtrap, consent, last_opened or list_source are read when your CSV has them

Live run control

  • Results stream in live as each address settles
  • Pause, resume or stop and keep what has been checked so far
  • Adjustable DNS timeout and parallel checks (up to 24, or 128 on Enterprise)

Evidence for every row

  • Clickable status tiles filter the table
  • Filter by TLD, text, tag and minimum score
  • Click any row: MX records, SPF/DMARC, every trap signal with its points, blocklist hits, the SMTP conversation

Exports with scopes

  • CSV (Excel-ready, protected against formula injection) and TXT on every plan
  • JSON, plus ZIP organised by status, TLD, tag and original order with honeypots/ and clean/ folders, on Pro and Enterprise
  • Scopes: everything, clean send list, passed only, spamtraps only, or any single status

Editable lists

  • Edit the trap, disposable, free-provider, risky-role and business-inbox lists on Pro and Enterprise
  • Add your own trap domains and addresses on top of the bundled lists, or replace them
  • Your own blocked list and domain-zone policy on every plan
  • Restore the bundled lists with one click

Diagnostics

  • Live resolver health and speed, DNS cache state
  • Whether outbound port 25 is open from this PC
  • Which of the 6 blocklists answer from your network
  • A lookup for one domain on its own

Snapshots

  • Save a whole run and reload it later without re‑checking
  • Saving comes with Pro and Enterprise; snapshots stay on your computer

Command line

  • --check addresses and print JSON
  • --file list.csv for headless batch runs
  • --no-window, --port, --verbose
  • Included with Enterprise

Offline licensing

  • Keys are verified offline and bound to your Machine ID
  • Expiry with a 3-day grace period
  • Only starting a run needs a license: results, snapshots and exports stay available

Safety by design

Your list stays on your computer

For list hygiene on lists you have permission to mail. Verifying a scraped list does not make sending to it legitimate.

  • Local only

    The engine listens only on your own computer, requires a fresh session token every launch, and rejects requests from any other page.

  • Nothing is ever sent

    The prober has no code path for sending mail; every conversation ends before a message could start.

  • Passwords stay in memory

    A relay password is never written to disk, and logins travel only over TLS (except to a mail server on this same computer).

  • No internal targets

    Private, loopback and link-local addresses are refused as probe targets unless you choose this computer’s own mail server.

  • Isolated window

    The app runs in its own browser profile and never touches your browsing session.

  • Honest about doubt

    Timeouts, refusals and blocked ports are reported as unknown or not checked, never passed off as a verdict.

More on security

See the evidence for every address you send to.

Download the app, paste your Machine ID and start verifying in minutes. Nothing to install, nothing uploaded.

Verify. Protect. Grow.

Start 3-day free trial Download for Windows