Signals: syntax, entropy, and domain checks

​

Syntax

"syntax": {
  "valid_format": true
}

• valid_format: true if the address parses cleanly (correct structure, valid characters, single @).

​

Entropy

"entropy": {
  "score": 1.5
}

• score: Shannon entropy of the local part. Higher values mean more random-looking characters.

​

Domain

"domain": {
  "is_known_disposable": false,
  "is_known_free_provider": false,
  "has_mx": true,
  "is_role_account": false,
  "tld_risk_level": "low"
}

• is_known_disposable: matches AuthFlame’s regularly updated list of known disposable domains (10-minute inbox services, etc.).
• is_known_free_provider: matches a public free provider like Gmail or Outlook. Free providers are not inherently risky, but they weight other signals.
• has_mx: true if a live DNS lookup returned MX records. false means no MX records were found, so the domain most likely cannot receive email.
• is_role_account: true if the local part looks like a shared inbox (info, support, admin, sales, etc.).
• tld_risk_level: low or high, based on abuse patterns for the top-level domain.

​

Normalization

"normalized": {
  "raw": "test+promo@example.com",
  "canonical": "test@example.com",
  "local_part": "test",
  "domain": "example.com",
  "subaddress": "promo",
  "has_dots_removed": false
}

• raw: the address as submitted, with any surrounding whitespace removed.
• canonical: the deduplicated form after lowercasing, stripping sub-address tags, and applying provider-specific dot rules. Store this to detect duplicate signups.
• local_part: the local part with the +tag removed. Original casing and dots are kept, so use canonical for deduplication.
• domain: the domain, lowercased.
• subaddress: the +tag portion, if present.
• has_dots_removed: true if provider-specific dot normalization changed the local part (for example, Gmail).