> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authflame.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How AuthFlame evaluates an email address

> Walk through the AuthFlame decision pipeline, from syntax parsing to canonical normalization, entropy scoring, and DNS-backed domain checks.

AuthFlame turns a raw email address into a decision by running it through a short pipeline of independent checks, then combining the signals into a single risk score and action.

## The pipeline

<Steps>
  <Step title="Parse and validate syntax">
    The address is parsed into its local part and domain. Malformed addresses fail fast with `syntax.valid_format: false`.
  </Step>

  <Step title="Normalize to a canonical form">
    Sub-address tags (like `+promo`) and provider-specific dot variants are stripped to produce `normalized.canonical`. Use this value to detect duplicate signups across the same underlying inbox.
  </Step>

  <Step title="Score the local part">
    Shannon entropy is calculated over the local part. High entropy suggests an auto-generated address; the `entropy.suspicious` flag summarizes the result.
  </Step>

  <Step title="Inspect the domain">
    AuthFlame checks the domain against disposable and free-provider lists, resolves MX records live, and evaluates catch-all, role-account, and TLD risk.
  </Step>

  <Step title="Summarize into a decision">
    Signals are combined into `summary.risk_score` (0–100), `summary.risk_level`, and `summary.action` (`ALLOW` or `BLOCK`).
  </Step>
</Steps>

## Where to call AuthFlame

Call the API server-side, at the moment of account creation, before you persist the user. This gives you:

* A synchronous decision you can enforce on the signup form.
* A canonical address to store next to the raw one for duplicate detection.

<Info>
  AuthFlame is designed for latency-sensitive paths. Median global latency is under 25 ms, so you can block on the response in a signup handler without noticeable friction.
</Info>

## What to do with the result

| `summary.action` | Suggested behavior                              |
| ---------------- | ----------------------------------------------- |
| `ALLOW`          | Create the account normally.                    |
| `BLOCK`          | Reject the signup with a generic error message. |

For deeper control, branch on `summary.risk_score` directly and pick your own thresholds.