Verification methods · version 2.0.0
Each address runs through nine stages on your own computer and lands in exactly one of seven verdicts, with a confidence score from 0 to 100, a reason code and a plain-English explanation. Nothing is uploaded, and no message is ever sent.
Seven verdicts
An inconclusive check never becomes a verdict. A timeout, a blocked port or greylisting always means “unknown”. A false “invalid” would delete a real customer, and a false “passed” on a spamtrap would get your domain blocklisted.
When checks disagree, the stronger verdict wins
Duplicate and Filtered are settled first, before any network check runs.
Evidence lab
Switch findings on for one address and watch which verdict the ladder settles on.
An inconclusive check never becomes a verdict: a timeout, blocked port or greylist is always unknown, never invalid and never passed.
| Status | What it means | Send to it? |
|---|---|---|
| Passed | Valid syntax, the domain accepts mail, and no risk rule fired. | Yes |
| Risky | Deliverable but flagged: role mailbox, disposable provider, possible typo, catch-all server, placeholder, blocklisted mail server, odd shape. | Your call |
| Invalid | Cannot receive mail: bad syntax, the domain does not exist, null MX, no mail records, a reserved name, or the server said the mailbox does not exist. | No |
| Unknown | A check could not finish: DNS or SMTP timeout, greylisting, blocked port 25, temporary failure. | Re-check later |
| Filtered | Excluded by your own rules: blocked list, domain-zone policy, free-provider exclusion. | No |
| Duplicate | The same address appeared earlier in the list; the first copy carries the verdict. | Already covered |
| Honeypot | The spamtrap engine scored the address medium or high, so it is removed from your send list automatically. | Never |
The pipeline
The first three stop an address as soon as they match, before a single network lookup is spent on it. The rest collect evidence, and the verdict ladder weighs it at the end.
Stage 1 of 9 Stops the address on a match
Syntax & parsing
Is this a well-formed address at all?
Name <addr> forms and quoted local partsalice+news@).test .local .invalid .onion .internal .corp example.comReason codes
syntax_invalid reserved_tld plus_addressed idn_domain
Example
sam..lee@mail.test
syntax_invalid Invalid
Stage 2 of 9 Stops the address on a match
Duplicates
Seen this one already?
Reason codes
duplicate_email
Example
Ana.Silva@Company.com
duplicate_email Duplicate
Stage 3 of 9 Stops the address on a match
Your rules
Addresses you have decided never to mail.
@ blocks one addressReason codes
blocked_domain_or_address domain_zone_blocked free_provider_excluded
Example
buyer@shop.xyz
domain_zone_blocked Filtered
Stage 4 of 9 Collects evidence for the verdict
Heuristics
Warnings, never a hard verdict on their own.
gnail.com → gmail.com)none@, unknown@ and test@test.comReason codes
disposable_provider role_address domain_typo_possible placeholder_address suspicious_keyword
Example
maria@gnail.com
domain_typo_possible Risky
Stage 5 of 9 Collects evidence for the verdict
DNS mail routing
Can this domain receive mail? Real lookups from your own computer.
Reason codes
domain_not_found null_mx_domain no_mail_records mx_records_unresolvable dns_lookup_failed
Example
jo@no-such-domain-4821.com
domain_not_found Invalid
Stage 6 of 9 Collects evidence for the verdict
Domain authentication
How seriously does the domain run its mail?
+all that authorises anyoneReason codes
no_spf_policy no_dmarc_policy spf_all_permissive dmarc_reject_policy
Example
team@sample-startup.io
dmarc_reject_policy Passed
Stage 7 of 9 Collects evidence for the verdict
Mail-server blocklists
Is the domain’s mail server known for spam?
Reason codes
dnsbl_listed_mx_ip dnsbl_clean dnsbl_not_checked
Example
promo@sample-bulkmailer.net
dnsbl_listed_mx_ip Risky
Stage 8 of 9 20 signals, one score
Spamtrap engine
Would mailing this get your sending domain blocklisted?
Reason codes
known_honeypot_address honeypot_local_pattern user_honeypot_domain honeypot_quarantined
Example
spamtrap@lists.example-isp.net
honeypot_local_pattern Honeypot
Stage 9 of 9 Optional · off by default
SMTP mailbox probing
Does this exact mailbox exist?
RCPT TO) and hangs up before any message could be sentReason codes
smtp_rcpt_accepted smtp_rcpt_rejected catch_all_domain smtp_probe_inconclusive
Example
old.account@sample-corp.com
smtp_rcpt_rejected Invalid
Spamtrap engine
Each signal that fires adds its points. A score of 1 to 3 is low and only a warning. A score of 4 or more is medium, 8 or more is high, and both are quarantined as honeypot. Known trap addresses are quarantined even when the rest of the engine is switched off.
The radar view needs JavaScript. Every signal and its points are listed alongside.
Every signal adds its points to one score. The rings on the radar mark the two thresholds.
Hover a dot for details, or open any signal below. Pick a few to see how they add up.
Known traps and operators
The exact address is on the bundled list of 989 known traps (or your own list). These are traps that look like ordinary people.
The domain is on the trap-domain list: 327 bundled trap networks, blocklist zones, sinks and reserved names, plus any you add.
The domain belongs to an organisation that publicly runs spamtraps or honeytokens.
One of 432 blocklist operators, CERTs and mail-security vendors. Recorded as evidence only, because these domains also have ordinary staff mailboxes.
What operators call their traps
The part before the @ is a trap name (spamtrap, honeypot, sinkhole, seed list…) from 250 names and 16 naming patterns, tuned so real surnames like Trapp or Honeycutt pass.
The domain contains a trap word as a whole label or hyphenated part, e.g. spamtrap.example.net or mail-sinkhole.org.
The leftmost label of a subdomain is a collector name (trap, sinkhole, canary). Only the first label counts, because that is where operators put it.
A role mailbox that is also a classic recycled-trap target (abuse@, postmaster@). Deliberately weak: these exist on legitimate domains too.
Random tokens and bot patterns
The part before the @ is a bare UUID, a common per-trap identifier.
A long hexadecimal string: an MD5, SHA-1 or similar digest used as a per-recipient token.
A disposable-mailbox domain that has already scored on another signal. A disposable domain alone never triggers this.
A long local part with high randomness and no vowel pair: the shape of a machine-generated address.
Contains qwerty, asdfgh, 123456 or an implausible run of consonants, typical of bot-generated sign-ups.
Where the domain’s mail actually goes
An MX host names a trap operator or points at a sinkhole such as localhost, 127.0.0.1 or a bare dot (60 known hostname markers).
A null MX (“this domain accepts no mail”) published next to real mail servers: usually a collector, not a mail system.
Mail falls back to the domain’s own address because no MX exists. Common on small real domains, so it is worth a single point.
How the whole domain is set up
A DNS text record literally says spam trap, honeypot, sinkhole or do-not-send (55 phrases, matched as whole words).
The domain’s nameservers belong to a trap or blocklist operator, so the whole zone is under their control.
The domain receives mail but has no website at all. Fires only when both lookups gave a definite answer.
The domain accepts mail, yet its SPF record is exactly v=spf1 -all: it says it never sends anything, a posture typical of a collector.
SMTP mailbox probing
Probing comes with Pro and Enterprise, and it stays off until you turn it on. Every conversation ends before a message could be sent; the app has no code path for sending mail.
Dpunk probe server
The app sends only the addresses being checked to our probe server, which has port 25 open and asks each mail server for you. The answers come back into your results.
Direct
Connects to the recipient domain’s MX on port 25. This gives the most authoritative answer there is.
Relay
Logs in to your provider and asks it instead. Port and encryption are detected automatically: 587, 465, 2525 and 25, with STARTTLS or SSL/TLS. The login is only ever sent over TLS.
10 provider presets
This computer
Uses the mail server installed on the PC or RDP server (hMailServer, Postfix, Exim, IIS SMTP, PowerMTA, MailEnable, Sendmail) at 127.0.0.1, with ports detected automatically.
Probes one address with your settings and shows the whole conversation: greeting, EHLO, STARTTLS, login, the catch-all check and the recipient check. It ends with a plain verdict: working, port 25 blocked on this network, configuration problem, or inconclusive.
Tries every port and encryption combination and shows connect, TLS and login results for each. It keeps the working combination and explains login errors in plain terms, for example when Gmail needs an app password or Microsoft 365 needs authenticated SMTP turned on.
Bundled intelligence
Every list is plain text. Pro and Enterprise let you edit them in the app, and one click restores the bundled defaults.
Blocklists checked: Spamhaus SpamCop PSBL DroneBL SpamEatingMonkey Mailspike
Everything else
Name <addr> lists--check addresses and print JSON--file list.csv for headless batch runs--no-window, --port, --verboseSafety by design
For list hygiene on lists you have permission to mail. Verifying a scraped list does not make sending to it legitimate.
The engine listens only on your own computer, requires a fresh session token every launch, and rejects requests from any other page.
The prober has no code path for sending mail; every conversation ends before a message could start.
A relay password is never written to disk, and logins travel only over TLS (except to a mail server on this same computer).
Private, loopback and link-local addresses are refused as probe targets unless you choose this computer’s own mail server.
The app runs in its own browser profile and never touches your browsing session.
Timeouts, refusals and blocked ports are reported as unknown or not checked, never passed off as a verdict.
Download the app, paste your Machine ID and start verifying in minutes. Nothing to install, nothing uploaded.
Verify. Protect. Grow.