Treat each address as a decision record. First check whether it can receive mail, classify any remaining risk, then choose whether to send, hold, suppress, or verify. Delivery and risk answer different questions. Email verification can identify role-based and catch-all addresses alongside delivery checks.1 An address can be deliverable and still need a different handling rule, so keep the delivery result beside the risk label.
Run the first pass
Check the mechanics before judging the address's business or security risk. That gives you a delivery result to interpret with the risk flags.
Email verification identifies prospects likely to bounce when emailed.2 During verification, a process can check syntax, verify the email domain through the MX record, and confirm that the address exists on the server.3
Treat an address with a typo or improper syntax as invalid.4 Some invalid addresses were once valid and became unusable through normal list churn and attrition.5 Sending to invalid addresses creates hard bounces that harm sender reputation.6
Store the delivery result and the reason for risk as separate fields.
Apply the address classes
Assign each address one of three outcomes, deliverable, risky, or undeliverable, then add any risk flags that affect how you handle it.7
A catch-all result means the address may be mailable, so proceed with caution.8 Keep it out of automatic sending until another signal supports the record.
A disposable address is fake or temporary and should be deleted from the list.9 Delete it before it enters a sequence or campaign.
Role-based addresses often come from web scraping and reach multiple recipients, which makes them among the addresses most likely to submit spam complaints.10 Route these records to review before sending.
Spam traps and honeypot addresses are a separate risk class. Regular delivery to them can put the sender's IP and domain on blocklists.11 Suppress matching records and inspect how they entered the list before continuing.
Check messages that carry identity risk
Address classification handles the record in your database. A suspicious message needs a separate check because phishing emails can acquire credentials, open a path into networks, deliver malware, take control of networks, or steal valuable information.12 Phishing attacks also manipulate people into sharing sensitive information, clicking malicious links, or downloading dangerous attachments.13
Start with the visible sender. Hover over the display name to see the email address attached to it.14 Attackers commonly spoof display names, and the address revealed on hover may belong to someone else.15
Compare a message from a familiar contact with older messages. Check both the display name and the signature:
- "Does the display name look the same for all emails? Is the email signature the same?".16
Read the exact address character by character. Attackers may switch, add, or replace characters through substitution and transposition.17 Common changes include replacing "m" with "rn," replacing a lowercase "l" with "1," or changing ".com" to ".co".18
Use a short checklist:
- "Is the domain slightly misspelled (e.g. amaz0n.com)?".19
- "Does it differ from how that organisation normally emails you?".20
- "Does it urge immediate action?".21
Answering yes to any checklist question indicates that the email may be fraudulent.22 Check the internet header information to see where the message is going.23 Search the email domain when the sender is new or unfamiliar.24 If the request still matters after those checks, call the purported sender using a phone number from your address book, never one supplied in the suspicious email.25
Make the send decision
Before an address reaches an outbound send, keep any unresolved handling rule in place. Hold an address attached to a suspicious sender message until the identity check is complete.
Too many bounces and spam complaints can hurt sender reputation and reduce deliverability to valid addresses.26 A high bounce rate also makes campaign metrics harder to interpret.27 Too many bounces, spam complaints, or unsubscribes may lead an email service provider to suspend the account.28 Sending to valid emails will not harm sender reputation.29
Move an address into the send pool when its delivery outcome is clear, its risk flags have a defined treatment, and any identity concern has an independent verification result.
What not to do
Keep the checks separate, and stop the send when a warning remains unresolved.
- Do not wave through a sender that raises this question: "Is it from a public domain but pretending to be from a company?".30
- Do not click a link when its URL differs from the anchor text.31
- Do not open an unexpected attachment.32
- Do not accept a vague call-to-action such as a generic request to click or log in.33