> ## Documentation Index
> Fetch the complete documentation index at: https://docs.verisoul.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Email
> Understanding email intelligence in Verisoul
## Overview
Looking for the standalone Email Intelligence API? See [Email Intelligence API](/email-intelligence/overview) for integration, webhooks, batch support, and identity intelligence.
The `email_score` is computed by analyzing various characteristics of both the email address and its associated domain. We run comprehensive checks on the domain to understand its trustworthiness and combine that with detailed analysis of the email structure and history to create a single score.
The scoring process involves:
1. **Domain Intelligence** - Analyzing the domain's web presence, business metadata, and reputation
2. **Email Intelligence** - Examining email structure, deliverability, and breach history
3. **Signal Aggregation** - Combining all signals into a unified risk assessment
We return this as `email_score` in our API, where the score ranges from **-1 to 1**:
* **-1** represents the most trustworthy emails
* **1** represents the highest risk emails
### Score Examples
**[johndoe@gmail.com](mailto:johndoe@gmail.com)**
**Trust Signals**: email\_age\_greater\_than\_5\_years, email\_known\_online\_history
**[john@verisoul.ai](mailto:john@verisoul.ai)**
No particular risk or trust indicators detected, representing a neutral assessment.
**[confidentialbot+1232384uu8734587@tempmail.com](mailto:confidentialbot+1232384uu8734587@tempmail.com)**
**Risk Signals**: email\_alias, email\_likely\_generated, email\_high\_number\_count, domain\_disposable\_type
## Domain Intelligence
We evaluate how the domain appears in search engines and assess its overall online footprint and reputation.
Our systems analyze the domain's landing page content, design quality, and professional appearance indicators.
For business domains, we cross-reference public company data including employee count, registration details, and legitimacy markers.
We examine the domain's technical setup, including MX record configuration, DNS health, and email delivery infrastructure.
### Domain Account Velocity
The `num_account_from_domain` field helps you detect and block high-velocity domains that may be used for signup abuse or free trial fraud. This field counts how many accounts with the **same apex domain** as the current account have been seen in your project.
**Real-Time Calculation**: This count is calculated in real-time on every API call, so it always reflects the most up-to-date value.
**Key Details:**
* **Apex Domain Matching**: The count is performed at the apex domain level, meaning subdomains are included. For example, `user@mail.company.com` and `user@company.com` would both count toward the `company.com` apex domain.
* **Project Scoped**: The count only includes accounts within your specific project.
* **Capped at 1000**: If the returned value is 1000, you can assume there are *at least* 1000 accounts from that domain in your project. The count is capped for performance reasons.
* **Always Available**: This field is returned on every API call, even before the full email intelligence scoring is complete.
**Recommended Rule:**
Use `num_account_from_domain` in combination with `domain_type` to identify suspicious signup patterns:
* If `num_account_from_domain` > X **and** `domain_type` not in `{personal, relay}` → consider blocking or requiring additional verification
* Set X to a threshold reasonable for your user base (e.g., 5-10 for most B2B applications)
## Email Intelligence
Our comprehensive email analysis examines multiple dimensions of the email address to determine authenticity and risk:
**Username Pattern Recognition**: We analyze the composition of email usernames, including the frequency of periods, numbers, and numeric blocks that may indicate automated generation or suspicious patterns.
**Format Validation**: Our systems detect unusual character combinations, suspicious formatting patterns, and other indicators that suggest machine-generated or fraudulent email addresses.
**Data Breach Intelligence**: We maintain an extensive database of known data breaches and check whether the email address has appeared in previous security incidents.
**Risk Assessment**: Each breach is categorized by severity and type, allowing us to assess the overall risk profile associated with the email's exposure history.
**Real-time Validation**: We perform live checks to verify whether the email address can actually receive messages and is actively monitored.
**Mailbox Health**: Our system monitors for delivery issues, full mailboxes, and other factors that might affect email deliverability and user engagement.
## Timing
For the most accurate email score, the scoring runs asynchronously. For non-personal emails (business, education, relays, governments, etc.), if Verisoul has seen the domain before, you can expect `email_score` to be complete and included in the overall score on the first request.
For personal domains or any domains new to Verisoul, the `email_score` will be updated asynchronously and account(s) will be automatically repredicted for you.
You can determine the score is complete when `email_score` is non-null, which typically takes about 3–5 seconds after we first observe the email.
## Signals
Our email intelligence generates various trust and risk signals that contribute to the overall email score. These signals are categorized into risk indicators and trust indicators to provide a comprehensive assessment.
### Risk Signals
| Flag | Description |
| :-------------------------------------- | :-------------------------------------------------------------------------- |
| email\_invalid | email is not a valid email formatted string |
| email\_high\_number\_count | email has more than 5 numbers |
| email\_high\_period\_count | email has more than 2 periods |
| email\_high\_number\_numeric\_blocks | email has more than 1 distinct block of numbers |
| email\_with\_business\_with\_numbers | email is a business email with numbers in username |
| email\_suspicious\_keywords | email username contains suspicious words like "stealth" or "fraud" |
| email\_alias | email is an alias |
| email\_role\_keyword | email is an abstract role entity (hr, sales, etc.) |
| email\_no\_reply | email is a noreply username |
| email\_not\_deliverable | email can't receive emails |
| email\_likely\_generated | email appears to be illegible and randomly generated |
| email\_young\_age | email is less than 1 year old |
| email\_no\_online\_history | email has no breaches |
| email\_unknown\_age | email has no breaches |
| email\_too\_many\_breaches | email has been seen in over 50 breaches |
| email\_risky\_online\_history | email has been seen in a high risk breach |
| email\_mailbox\_full | email exists and is theoretically deliverable but mailbox is full currently |
| identity\_name\_mismatch | input name does not match name found in external data |
| identity\_phone\_mismatch | input phone does not match phone found in external data |
| identity\_username\_mismatch | input name does not match email username |
| identity\_country\_phone\_mismatch | phone country does not match expected country |
| identity\_too\_many\_connected\_numbers | velocity abuse indicator |
| domain\_country\_mismatch | domain TLD does not match expected country |
| domain\_relay\_type | domain is a known relay domain |
| domain\_disposable\_type | domain is a known disposable |
| domain\_low\_trust\_business | domain is a low trust business |
| domain\_no\_mx\_record | domain has no mx record |
| domain\_suspicious\_keywords | domain contains suspicious keywords like "temp" or "throwaway" |
| domain\_whois\_less\_than\_1\_year | domain was registered less than 1 year ago |
| domain\_risky\_personal | domain is known to be risky relative to gmail.com |
| domain\_does\_not\_resolve | domain does not resolve to an IP |
| domain\_impersonation\_type | domain is attempting to impersonate another domain |
| domain\_invalid | domain (fqdn) does not have a valid mx record |
### Trust Signals
| Flag | Description |
| :------------------------------------- | :------------------------------------------------------------ |
| email\_age\_greater\_than\_3\_years | email first seen more 3 years ago |
| email\_age\_greater\_than\_5\_years | email first seen more 5 years ago |
| email\_age\_greater\_than\_10\_years | email first seen more 10 years ago |
| email\_age\_greater\_than\_15\_years | email first seen more 15 years ago |
| email\_known\_online\_history | email has history in data breaches |
| email\_trusted\_online\_history | email has been seen in high trust breaches |
| email\_username\_match\_detected | username fuzzy matches name |
| online\_presence\_detected | social media accounts found |
| identity\_name\_match | input name matches external data |
| identity\_phone\_match | input phone matches external data |
| domain\_country\_match | domain TLD matches expected country |
| domain\_trusted\_type | domain is a government or education type |
| domain\_trusted\_personal | domain is known higher trust relative to gmail.com |
| domain\_high\_trust\_business | domain is a known business |
| domain\_high\_trust\_email\_provider | domain provider is a known enterprise provider |
| domain\_whois\_greater\_than\_5\_years | domain first registered over 5 years ago |
| domain\_trusted\_relay | domain is a Apple Private Relay, a trusted forwarding service |
## Domain Types
Our system categorizes email domains into various types based on their purpose and characteristics:
| Type | Description |
| :------------ | :---------------------------------------------------- |
| relay | a email forwarding service |
| personal | a public email service |
| disposable | a throwaway or temporary email provider |
| business | a business domain |
| government | a government entity domain |
| education | an educational entity domain |
| impersonation | a domain attempting to impersonate another domain |
| invalid | a domain that doesn't have a valid mx server attached |
| not\_active | a domain that appears to be inactive or not used |