Email risk classification

Risk classification tells you how much confidence an address deserves before you send. Start with the address and domain, then check mailbox behavior, address type, and message identity before deciding what to do. A clean delivery signal does not prove that the mailbox is real: an accept-all server accepts messages for real and nonexistent addresses, so no verifier can fully confirm the mailbox.¹ Relying on one or even several quantitative metrics can miss some spam and falsely classify some accounts, so combine signals and keep an explicit hold state.²

Run the classification

Use the same pass for every record so the final decision reflects the address, mailbox behavior, and surrounding message. Move a record forward only when the current check leaves no unresolved reason to pause.

Stage	What you are trying to learn	Example question
Address	whether the format gives you a reason to pause	Does the address have a valid structure?
Domain	whether the domain fits the identity it claims	Does the domain fit the organisation?
Mailbox behavior	whether the server response gives enough confidence	Does this server accept any address?
Address type	whether the classification changes how you handle the record	Is this a catch-all, disposable, role-based, or spam-trap address?
Message identity	whether the sender and content look consistent	Does the display name match the address?
Decision	whether the record should be sent, held, or suppressed	What unresolved risk remains?

Check the address and domain

Start with structure, then compare the domain with the identity the address claims. A structurally valid address can still warrant a hold when its domain or source looks suspicious.

Email verification can identify specific address types, including role-based and catch-all addresses.³ It also identifies prospects likely to bounce when emailed.⁴ An email verification tool should distinguish invalid addresses, including syntax errors, typos, and spam traps.⁵

Use the domain check to catch identity problems early. Ask: "Is it from a public domain (for example, @gmail.com) but pretending to be from a company?"⁶ Ask: "Is the domain slightly misspelled (for example, amaz0n.com)?"⁷ If either answer is yes, hold the record for review. A yes answer to any of these checklist questions can mean the email may be fraudulent.⁸

Classify mailbox risk

Keep the address type separate from whether mail can reach the domain. The same delivery result can require different handling depending on the kind of address that produced it.

A useful result separates addresses into risky, undeliverable, and deliverable categories.⁹ Put a catch-all result on hold until another signal resolves the uncertainty. Disposable addresses are fake or temporary addresses that should be deleted from the list.¹⁰

Role-based addresses are often gathered through web scraping and sent to multiple recipients, which makes them among those most likely to produce spam complaints.¹¹ Review them before sending, especially when the outreach depends on one individual reading it.

A spamtrap is an address intentionally used to identify spammers.¹² Regular delivery to spam traps and honeypot addresses is likely to put the sender's IP and domain on blocklists.¹³ Suppress a suspected trap and preserve the reason for that decision. If a system returns a classification you cannot map confidently, keep it under Other instead of forcing it into a safer category.¹⁴

Inspect the message identity

Check the message itself for signs that it is asking the recipient to trust the wrong sender.

Hover over the "from" display name to see which address is associated with it.¹⁵ Attackers commonly spoof display names so a message appears to come from a legitimate person, and hovering over the display name often reveals a different sender.¹⁶

For someone you regularly communicate with, compare the new message with older ones. Ask: "Does it differ from how that organisation normally emails you?"¹⁷ Ask: "Does the display name look the same for all emails? Is the email signature the same?"¹⁸

Treat pressure and mismatched content as reasons to pause. Ask: "Does it urge immediate action, such as "Act now" or "Your account will be closed"?"¹⁹ Ask: "Does the link URL differ from the anchor text?"²⁰ Ask: "Is there an unexpected attachment?"²¹ Phishing emails are designed to manipulate people into disclosing sensitive information, clicking malicious links, or downloading dangerous attachments.²²

If the message remains suspicious, verify it through a channel you already trust. Call the purported sender using a phone number from your address book, not a number in the suspicious email.²³

Make the send decision

Use the classification to control the queue. A hold keeps uncertain addresses out of the send path until someone resolves the reason.

Too many bounces and spam complaints can hurt sender reputation and delivery to valid addresses.²⁴ Sending to invalid or risky addresses could jeopardize your ability to send emails.²⁵ A high bounce rate also makes campaign metrics harder to interpret.²⁶

Use three outcomes:

• Send when the address has no unresolved risk flag and the message identity check passes.
• Hold when the result is catch-all, role-based, unclear, or connected to a suspicious message.
• Suppress when the address is undeliverable, disposable, or a spamtrap, or when fraud remains unresolved.

Record the reason beside the outcome. That lets the next person review a hold without repeating every check.

What not to do

A weak signal is not permission to send. Keep these rules with the workflow.

• Do not send to test mailboxes or temporary or disposable domains, since anyone can access them and sending to them can harm sending reputation.²⁷
• Do not assume the detection advice catches every generated email: even after you follow it, an email program may slip through, and a system that sends whenever it receives email can create infinite email loops.²⁸
• Do not wait for repeated bounces, spam complaints, or unsubscribes to change your process, since an email service provider may suspend the account after too many of these events.²⁹