email-validator-mx-disposable

# Email Validator for Agents (MX, Disposable, Typo, Risk Score v2)

**$0.79 per 1,000 emails ($0.00079 per email). Error rows are free.** Optional mailbox check with your own MillionVerifier key: **+$0.19 per 1,000 checked emails ($0.00019 each)**, charged only when MillionVerifier returns a real result. You pay MillionVerifier for its credits directly.

Example: 5,000 signup emails cost 5,000 × $0.00079 = **$3.95**, plus Apify's $0.00005 Actor-start fee.

This **Fairquery** Apify Actor validates email addresses **without sending any email and without SMTP probing**. It checks syntax, DNS/MX, null MX, disposable domains (9,800+ bundled), role accounts, free providers, typos ("gamil.com" → "gmail.com"), the mail provider and SPF/DMARC. Each address gets a **`valid` / `risky` / `invalid` / `unknown`** verdict with machine-readable reason codes, plus a **0–100 Risk Score v2**.

## What's new in v2 (Risk Score v2)

All v1 fields are unchanged. v2 only **adds** fields:

- **`risk_score`** (0–100, higher = riskier), `risk_level` (`low` / `medium` / `high`) and `risk_reasons`
- **`mx_provider_class`**: `consumer_webmail`, `business_suite`, `security_gateway`, `hosting_or_forwarding`, `disposable_service`, `self_hosted_or_unrecognised` or `none`. `mail_provider_id` gives the provider (`google`, `microsoft`, `yahoo`, `proofpoint`, …).
- **`catch_all_likelihood`**: `low` / `medium` / `high` / `unknown`. **This is an estimate from the mail provider type, not a measurement** (`catch_all_basis: "estimate_from_mx_provider"`). See the table below.
- **`domain_age_days`** and `domain_registered_at` from **RDAP**. Domains under 30 days old get `NEW_DOMAIN`. If the age is unknown, these fields are `null`.
- **`disposable_infrastructure`**: the domain's MX host is shared with known disposable-inbox services. This flags new throwaway domains that are not on the list yet.
- **`mailbox_verified`**: always `false` unless the optional BYOK MillionVerifier check ran with a live key and returned `ok` or `invalid`.

## When to use this Actor (LLM / tool selection)

Use it when an agent needs to:

- Pre-filter a lead / CRM / signup list before outreach, import or paid verification
- Decide whether an address *can* receive mail (domain exists, has MX, no null MX)
- Flag disposable inboxes (including new ones on disposable infrastructure), brand-new domains, role addresses and free webmail
- Suggest a fix for a mistyped domain
- See the mail provider, its type, and the DMARC policy

On its own it does **not** confirm that a specific mailbox exists. That needs an SMTP conversation, and this Actor does none (see the FAQ). If you need mailbox-level results, add your own MillionVerifier key (optional). `valid` means "well-formed, the domain can receive mail, no risk flags". It does not mean "mailbox confirmed".

## How it works

| Check | Source |
| --- | --- |
| Syntax | Pragmatic RFC 5321/5322 subset; IDN domains → punycode |
| MX / A / AAAA / TXT | DNS-over-HTTPS `https://cloudflare-dns.com/dns-query` (cached per domain, 10 domains in parallel) |
| Disposable domains | Bundled CC0 list from `disposable-email-domains` (9,800+ domains; subdomains matched) |
| Disposable infrastructure | 88 MX hosts that each served ≥5 listed disposable domains (resolved 2026-10-17), plus any MX host that is itself on the disposable list. Shared general-purpose infrastructure (Google, Microsoft, Cloudflare Email Routing, Mailgun, Amazon SES, registrar forwarding, hosting and parking MX) is excluded, so legitimate domains on those providers are never flagged. |
| Domain age | RDAP (RFC 9083). Servers come **only** from the [IANA RDAP bootstrap](https://data.iana.org/rdap/dns.json), with a bundled snapshot as fallback. 6 s timeout per request, at most 2 parallel requests per registry, one back-off on HTTP 429, a 120 s budget and 2,000 uncached lookups per run. Failures give `null`. Some ccTLDs (for example `.de`) have no RDAP service, so their age is `null`. |
| Role / free provider / typo | Built-in lists, plus edit distance against popular providers. The disposable list is checked first: a listed domain (for example `yopmail.com`, `mail.tm` or look-alikes such as `hotmial.com`) is always reported as disposable and never as a typo of a real provider. |

### Catch-all estimate (prior, not measured)

| MX provider | `catch_all_likelihood` | Basis |
| --- | --- | --- |
| Gmail / Google Workspace | `low` | Unknown recipients are rejected by default; catch-all routing must be switched on by an admin |
| Microsoft 365 / Outlook.com | `medium` | Published measurements show RCPT answers that vary from attempt to attempt, and many tenants accept mail and bounce it later |
| Yahoo / AOL (including custom domains on Yahoo MX) | `high` | They accept every recipient at RCPT time and bounce later |
| Proofpoint, Mimecast, Barracuda, Cisco and other security gateways | `medium` | They often accept for the whole domain; this depends on configuration |
| Disposable-inbox services | `high` | They accept any local part by design |
| Everything else (self-hosted, Zoho, iCloud, Proton, hosting, forwarding…) | `unknown` | No evidence either way |

### Risk score v2 (additive, capped 0–100)

| Signal | Points |
| --- | --- |
| `invalid` verdict (bad syntax, no domain, null MX, no mail server) | 100 (score fixed) |
| Disposable domain (`DISPOSABLE_DOMAIN`) | +70 |
| Disposable infrastructure, not listed (`DISPOSABLE_INFRASTRUCTURE`) | +60 |
| Possible typo (`POSSIBLE_TYPO`) | +45 |
| Domain under 30 days old (`NEW_DOMAIN`) / under 180 days (`YOUNG_DOMAIN`) | +35 / +10 |
| DNS not checked (`DNS_NOT_CHECKED`) | +25 |
| A record only, no MX (`IMPLICIT_MX_ONLY`) | +20 |
| Catch-all estimate `high` / `medium` / `unknown` | +15 / +8 / +5 |
| Role account (`ROLE_ACCOUNT`) | +10 |
| No SPF / no DMARC (custom domains only) | +5 / +3 |
| BYOK result `catch_all` / `disposable` / `deliverable` (live key only) | +10 / +60 / −15 |

`risk_level`: `low` < 25 ≤ `medium` < 60 ≤ `high`. Treat this score as a pre-send filter, not as proof of deliverability. The `verdict` and `reasons` fields work exactly as in v1. The new signals only change them when the BYOK check runs: an `invalid` result from MillionVerifier makes the verdict `invalid`, and `catch_all` or `disposable` make it `risky`.

## Input

| Field | Type | Default | Description |
| --- | --- | --- | --- |
| `emails` | `string[]` | – (required; sample addresses are only prefilled in the Console form) | Addresses. An entry may be a comma, semicolon or newline separated list, or `Name <addr>` |
| `checkDns` | `bool` | `true` | MX/A lookups (turn off for syntax-only checks) |
| `checkSpfDmarc` | `bool` | `true` | SPF/DMARC presence and DMARC policy |
| `allowRoleAccounts` | `bool` | `true` | If `false`, role addresses → `risky` |
| `allowDisposable` | `bool` | `false` | If `true`, disposable domains are not `risky` |
| `allowFreeProviders` | `bool` | `true` | If `false`, free webmail → `risky` (B2B lists) |
| `maxEmails` | `int` | `10000` | Safety cap per run (1–100,000) |
| `checkDomainAge` | `bool` | `true` | RDAP domain age (fails soft to `null`) |
| `cacheDomainAge` | `bool` | `true` | Keep RDAP registration dates for 30 days in a named key-value store, `fairquery-email-rdap-cache`, in your account. It holds domain names and dates only, never email addresses. Turn this off to keep nothing between runs. |
| `millionVerifierApiKey` | secret `string` | – | Optional. Your own MillionVerifier API key (BYOK). |
| `mailboxCheckMaxPerRun` | `int` | `1000` | Hard cap on MillionVerifier calls per run |

```json
{ "emails": ["jane@acme.com", "info@apify.com", "bob@gamil.com"], "allowFreeProviders": false }
```

## Output

Every row has `schema_version` (`1.1.0`; v1 rows were `1.0.0`, and v2 only adds fields), `type` (`email` | `error`), `source_url` (the DoH MX query URL) and `checked_at`.

Real row from beta run `TzHumKQWvIqfKfdRm` (2026-10-17):

```json
{
  "type": "email", "input": "someone@yahoo.com", "email": "someone@yahoo.com", "domain": "yahoo.com",
  "verdict": "valid", "reasons": ["FREE_PROVIDER"],
  "syntax_valid": true, "is_disposable": false, "is_role_account": false, "is_free_provider": true,
  "did_you_mean": null, "domain_exists": true, "has_mx": true, "null_mx": false, "implicit_mx": false,
  "mx_records": [{ "priority": 1, "exchange": "mta5.am0.yahoodns.net" }, …], "mail_provider": "Yahoo",
  "has_spf": true, "has_dmarc": true, "dmarc_policy": "reject",
  "risk_score": 15, "risk_level": "low", "risk_reasons": ["CATCH_ALL_LIKELY_ESTIMATE"], "risk_score_version": 2,
  "mail_provider_id": "yahoo", "mx_provider_class": "consumer_webmail",
  "catch_all_likelihood": "high", "catch_all_basis": "estimate_from_mx_provider",
  "domain_registered_at": "1995-01-18T05:00:00.000Z", "domain_age_days": 11595,
  "domain_age_source": "https://rdap.verisign.com/com/v1/domain/yahoo.com",
  "disposable_infrastructure": false, "disposable_infrastructure_mx": null,
  "mailbox_verified": false, "mailbox_check": "not_requested", "mailbox_status": null,
  "mailbox_provider": null, "mailbox_raw": null, "mailbox_error": null
}
```

v1 reason codes (`reasons`) are unchanged: `INVALID_SYNTAX`, `DOMAIN_NOT_FOUND`, `NULL_MX` and `NO_MAIL_SERVER` (→ `invalid`); `DISPOSABLE_DOMAIN`, `ROLE_ACCOUNT`, `FREE_PROVIDER`, `POSSIBLE_TYPO` and `IMPLICIT_MX_ONLY` (→ `risky`, depending on the allow* flags); `DNS_NOT_CHECKED` (→ `unknown`). With BYOK there are also `MAILBOX_UNDELIVERABLE`, `MAILBOX_CATCH_ALL` and `MAILBOX_DISPOSABLE`.

`mailbox_check` is one of `not_requested`, `checked`, `skipped_invalid`, `skipped_disposable`, `skipped_limit` or `error`. `mailbox_status` is one of `deliverable`, `undeliverable`, `catch_all`, `disposable` or `unknown`, mapped 1:1 from MillionVerifier's `result` field (`ok`, `invalid`, `catch_all`, `disposable`, `unknown`). `mailbox_raw` keeps `result`, `resultcode`, `subresult`, `quality` and `livemode`. It never contains your key.

### Error rows