Check an email address
Check whether an email address can actually receive mail, who handles its mail, how old its domain is, whether it has a history in data breaches, and whether it hides behind a disposable, anonymising or lookalike domain.
Try
- MX, SPF & DMARC validation and mail provider
- Disposable, anonymiser & lookalike-domain detection
- Data-breach history
- Domain age, Gravatar & social profiles
What the report tells you
An email report starts with whether the address can receive mail at all, by checking its syntax and the MX records of its domain, and names the provider that handles it: Google Workspace, Microsoft 365, a small host or a self-run server. It then asks who is behind that domain: how long it has existed, who registered it, and whether it belongs to a disposable inbox service, a relay that hides the real address, or a lookalike of a big provider such as gmial.com. Breach records, Gravatar, social profiles and blocklist checks fill in whether the address has any history.
Breach history as proof of age
Almost every address that has been used for a few years turns up in at least one data breach. That makes the breach record an unusual but useful signal: an address found in breaches going back to 2016 has existed and been used since then, while a throwaway address created for one transaction has no history at all. The report lists each breach with its year and what was exposed, from the public XposedOrNot index.
Disposable is the signal to watch
A throwaway address costs nothing and disappears the moment it becomes inconvenient, which is exactly why it appears in marketplace fraud. It is not proof of bad intent, plenty of people use aliases for privacy, but combined with a domain registered last month and no trace anywhere else, it describes a counterparty with nothing to lose.
How throwaway addresses are caught
The domain is checked against a community-maintained list of close to 9,000 disposable email services, including their subdomains. Because these services keep registering fresh domains to stay off blocklists, the report also looks at where the domain's mail is delivered: a brand-new domain whose mail servers belong to a known throwaway service is flagged even if the domain itself is on no list yet. Domains that imitate a big provider, such as gmial.com or hotmai1.com, are flagged as lookalikes.
When to run one
Before shipping goods to a new buyer, when an invoice arrives from an address that is almost but not quite a supplier's usual one, or when vetting a signup that looks automated.