Signals: syntax, entropy, and domain checks

​

Syntax

"syntax": {
  "valid_format": true
}

• valid_format: true if the address parses cleanly (correct structure, valid characters, single @).

​

Entropy

"entropy": {
  "score": 1.5,
  "suspicious": false
}

• score: Shannon entropy of the local part. Higher values mean more random-looking characters.
• suspicious: true when the score crosses AuthFlame’s threshold for auto-generated addresses.

​

Domain

"domain": {
  "is_known_disposable": false,
  "is_known_free_provider": false,
  "has_mx": true,
  "is_catch_all": false,
  "is_role_account": false,
  "tld_risk_level": "low"
}

• is_known_disposable: matches AuthFlame’s list of 15,000+ tracked disposable domains (10-minute inbox services, etc.).
• is_known_free_provider: matches a public free provider like Gmail or Outlook. Free providers are not inherently risky, but they weight other signals.
• has_mx: true if a live DNS lookup returned MX records. false means the domain cannot receive email.
• is_catch_all: true if the domain accepts mail for any local part. Catch-all domains reduce the value of address-level uniqueness.
• is_role_account: true if the local part looks like a shared inbox (info, support, admin, sales, etc.).
• tld_risk_level: low, medium, or high, based on abuse patterns for the top-level domain.

​

Normalization

"normalized": {
  "raw": "test+promo@example.com",
  "canonical": "test@example.com",
  "local_part": "test",
  "domain": "example.com",
  "subaddress": "promo",
  "has_dots_removed": false
}

• raw: the address as submitted.
• canonical: the deduplicated form after stripping sub-address tags and provider-specific dot rules. Store this to detect duplicate signups.
• local_part / domain: parsed components of the canonical address.
• subaddress: the +tag portion, if present.
• has_dots_removed: true if provider-specific dot normalization changed the local part (for example, Gmail).