Bulk Email Verification Documentation

Bulk Email Verification Documentation Release 1.0.4 emailverifyapi.com January 14, 2015

Contents 1 Product Overview 3 1.1 Product Overview............................................ 3 2 QuickStart 5 2.1 Quick Start................................................ 5 3 Features 7 3.1 Features.................................................. 7 4 FAQs 9 4.1 Frequently Asked Questions....................................... 9 5 Status Codes 15 5.1 Email Verification Response Codes For Bulk Verification........................ 15 6 Glossary 19 6.1 Glossary................................................. 19 i

ii

Our email validation service will help your business reduce costs by eliminating bad email addresses from your information systems. All you need to do is upload your email list and wait for the results to come in. Contents 1

2 Contents

CHAPTER 1 Product Overview 1.1 Product Overview 1.1.1 Why Email Address Verification? Sending emails to non-existent addresses is never a good idea for many reasons including: Damaging the reputation of your ESP infrastructure (IP addresses) Many ESPs will have maximum hard bounce thresholds. Exceed these and your account could be closed. Bad emails in a list negatively affects deliver-ability rates A Block List can keep track of failed deliveries (e.g. bad email address) at a particular domain. Too many failed deliveries can raise some flags thus raising the risk of your email campaign being flagged as spam. Processing hard bounces means wasted time An email sent to a bad or non-existent email address results in a bounce message coming back. Someone or something (e.g. automated software) is required to remove the bounces from a email list so as to avoid sending to bad addresses next time. Tip: Cleansing bad emails from a list using email verification technology before embarking on an emailing campaign significantly reduces the above challenges. 1.1.2 Product Description emailverifyapi.com offers data cleansing services specifically for email addresses. Offering a fully cloud based solution, emailverifyapi.com provides fast, reliable and accurate email verification. With unrivalled coverage in all areas (including traditionally hard to verify email addresses such as Hotmail and Yahoo), emailverifyapi.com is the natural choice for customers requiring good coverage in their applications for both B2B and B2C email addresses. 1.1.3 Reliable and Secure Security of your data is our primary concern. To ensure security, we implement: Robust data security implemented using Microsoft Trustworthy Computing guidelines. Logical security of your data by allocation of your own, dedicated database. Any data that you upload goes into your database and is not visible by anyone else. Physical security in secure US and UK data centers. 3

Once you delete a list from our system, it is wiped completely off our servers. Ultimately, no one gets access to your data except you. As well as the assurance of security, we appreciate that you want reliability. That s why, as a customer, you receive priority support by phone and email. In the unlikely event of a technical problem, our promise to you is to resolve your issue within 24 hours. Our systems include built in exception and error alerting. This means that, in the unlikely event that you need to call us, we ll already know about the problem and be well on the way to fixing it. 1.1.4 How To Get Started To get started create a new account and upload your list. 4 Chapter 1. Product Overview

CHAPTER 2 QuickStart 2.1 Quick Start This quick start guide is designed to get you up and running as fast as possible. Please follow the steps below in sequence: 2.1.1 1) Create an Account Create an account. 2.1.2 2) Upload File Navigate to the Upload a file tab. You can drag and drop or manually upload any.csv (Comman-Seperated Values) or.txt (Text File) file. This file can contain multiple data fields, not just email addresses. Our system will pick out the email address field automatically and preserve the rest of your data. 2.1.3 3) Choose your Payment Method You can either pay as you go or subscribe to the service for a set number of verifications per day. 2.1.4 4) Start Verification Please not that bulk lists can take up to 24 hours to verify. 2.1.5 5) View your Results! 5

6 Chapter 2. QuickStart

CHAPTER 3 Features 3.1 Features 3.1.1 Fanatical Service Quality Management (SQM) emailverifyapi.com operational staff obsessively monitor services to ensure the best possible uptime and coverage. Uptime and functional correctness is actively monitored on a minute by minute basis from multiple data centers dispersed across North America and Europe. 3.1.2 Multi Factor Verification Progressive verification using multiple verification processes including: Syntax checking DNS checking Mailbox checking 3.1.3 Unrivalled Coverage With more than 5 years experience and the benefit of owning our own software stack, emailverifyapi.com has refined its services over the years to provide good coverage not only of the easier B2B domains but also the more technically tricky B2C domains including: Hotmail Yahoo AOL Yandex 3.1.4 Spam Trap Detection After many years R&D, emailverifyapi.com has developed various secret sauces that can effectively detect and eliminate spam traps from several well known Block List. 7

3.1.5 Disposable Email Address Detection Detect and eliminate DEA. 3.1.6 What it does emailverifyapi.com is used to check email addresses in bulk. Not only are syntax and domain checked, but that the user mailbox is available too. This is the only way to know for sure if an email address is valid. Additionally identified as part of the email verification process is extra information including: DEA. Spam Trap. 3.1.7 How it works Email addresses are verified using various filters and processes. As a high level overview, an email address submitted for verification goes thorough the following filters: Syntax A basic inspection of the systax of the email address to see if it looks valid. Work is done only using server CPU (Central Processing Unit) based on simple pattern matching algorithms. DNS A Verifies a domain exists in DNS. Domains that do not exist in DNS cannot have mail servers or email boxes. DNS checks are performed over the network. DNS MX Verify MX records using DNS. Domains that do not have MX records, have no mail servers and therefore no valid email boxes. MX checks are performed over the network. MailBox Verify email boxes with SMTP checks. Connect to mail server and perform SMTP protocol to verify if mail box exists. This is the deepest level of verification. It is performed over the network. 8 Chapter 3. Features

CHAPTER 4 FAQs 4.1 Frequently Asked Questions 4.1.1 How fast is it? Please allow up to 24 hours for a list to process. 4.1.2 How do I get emails into the system? Upload any text (.txt) or CSV (.csv) file that contains email addresses. This includes Excel (export as.csv), Outlook (export as.csv) or any other application that can support exporting as text (almost all applications support this). Your files can contain extra data fields, we simply append our results to the end of your existing file. 4.1.3 How do I get results out of the system? You can export results in the same format that you imported them. 4.1.4 Are there any emails that can t be checked? For servers that we know give problems, such as those that give false positives (catch-all), we flag the email address appropriately. 4.1.5 How often should I check email addresses? For large lists (i.e. > 10,000), we suggest checking every 2 weeks. Smaller lists can be checked monthly Email addresses are always changing. People change email addresses as they (for example): Move Internet providers Move to a new employer Change name (e.g. after getting married) If your business relies on email lists for its marketing, it s important that you keep the lists current and clean to maximize your target potential and reduce the overheads associated with managing too many bounced emails. This is why we recommend frequent checking. 9

4.1.6 How do I sign up? To get started create a new account and upload your list. 4.1.7 How secure is my data? Very. We take your security and confidentiality seriously. We know that your email lists are confidential and we do everything we can to make sure that they stay that way! Your data is held securely in US and UK data centers. As well as physical security of locked server rooms, we use strong password security in our software services. This means that no-one other than you can see your data. Also, if you choose to cancel your plan at any time, we undertake to destroy / delete your data so that it cannot be retrieved or viewed by any other parties. 4.1.8 Do you share my email lists or use them in any other way? No. No-one other than you has access to your data / email lists. 4.1.9 What browsers do you support? Generally, anything that is younger (as of December 2014) than 7 years old. Including: Safari Internet Explorer (version 7+) Firefox (version 2+) Chrome Opera As this is an Internet based service, it means that it runs happily on any operating system including Mac, PC, Linux, Unix etc. 4.1.10 Can it do Hotmail? Yes. 4.1.11 Can it do Yahoo? Yes. Based on our own internal testing emailverifyapi.com is currently the only email verification service to offer effective and repeatable coverage for Yahoo addresses. 4.1.12 Can it do Yandex? Yes it can. 10 Chapter 4. FAQs

4.1.13 Can it find spam traps? Partially. A Spam Trap is a moving target. In theory (and indeed in practice) anyone can setup a Block List and start putting spam traps into the wild. emailverifyapi.com has Spam Trap detection capabilities that covers several of the well known block lists. Whilst it is not possible to deliver 100% coverage of all spam traps from all block lists, emailverifyapi.com provides the best Spam Trap detection capabilities available. 4.1.14 How does it work? At a basic conceptual level, the process of verifying email addresses is very simple. Google for Send email using telnet for a quick and general overview of how it s done. To verify an email address without sending an email, simply go as far as the RCPT TO stage and parse the response code. That s the easy bit and can be accomplished in just a couple of dozen lines of a PHP script! The hard bit is dealing with mail services that are intrinsically configured to work against the process of email verification or any similar SMTP based activity. The reason that any email / SMTP process is difficult from a client perspective is that mail services need to protect themselves from an ever increasing landscape of abuse including spam and DDoS attacks. emailverifyapi.com s strength in dealing with the hard bit of email verification comes from years of experience in doing email verification together with our complete ownership of our SMTP verification software stack together with an extensive cloud based infrastructure. That s why emailverifyapi.com can do the hard bits best and offer outstanding coverage on the more difficult domains such as Yahoo and Hotmail. 4.1.15 Can I get blacklisted using this service? No. It s emailverifyapi.com infrastructure that does the work. 4.1.16 Will anyone know that I am verifying their email address? No. It s emailverifyapi.com infrastructure that does the work. 4.1.17 Your service says an address is OK and I know it s Bad (or vice versa)? emailverifyapi.com queries mail servers in real time. Mail servers respond with one of 2 possible answers for a given email address: Yes, the email address exists - SMTP code 2xx No, the email address doe not exist - SMTP code 5xx emailverifyapi.com uses the above response codes to determine if an email address is valid or not and reports this back to you. This method of determining email address validity works in >99% cases. However, nothing is guaranteed. In a small number of cases it is possible for a mail server to report one thing on email verification and do something different on trying to deliver an email to the email address verified. For example, say we take an email address of this.seems.to.verify@hotmail.com to send to. We are sending from a fictitious email address my.sending.account@gmail.com. 4.1. Frequently Asked Questions 11

this.seems.to.verify@hotmail.com reports with status code of OK from the email verification service. However, when you send an email to this.seems.to.verify@hotmail.com, the email bounces. Further inspection of the bounced email NDR (Non Delivery Report) headers show something like the following: Delivered-To: my.sending.account@gmail.com Received: by 10.107.174.134 with SMTP id n6csp24867ioo; Sat, 6 Jun 2014 03:57:29-0800 (PST) X-Received: by 10.202.4.5 with SMTP id 5mr1335105oie.22.1417867048986; Sat, 06 Jun 2014 03:57:28-0800 (PST) Return-Path: <> Received: from SNT004-OMC2S34.hotmail.com (snt004-omc2s34.hotmail.com. [65.55.90.109]) by mx.google.com with ESMTPS id ws5si21632759obb.102.2014.12.06.03.57.28 for <my.sending.account@gmail.com> (version=tlsv1.2 cipher=ecdhe-rsa-aes128-sha bits=128/128); Fri, 6 Jun 2014 03:57:28-0800 (PST) Received-SPF: none (google.com: SNT004-OMC2S34.hotmail.com does not designate permitted sender hosts) Authentication-Results: mx.google.com; spf=none (google.com: SNT004-OMC2S34.hotmail.com does not designate permitted sender hosts Received: from SNT004-MC2F40.hotmail.com ([65.55.90.73]) by SNT004-OMC2S34.hotmail.com over TLS secur Fri, 6 Jun 2014 03:57:28-0800 From: postmaster@hotmail.com To: my.sending.account@gmail.com Date: Fri, 6 Jun 2014 03:57:28-0800 MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="9b095b5adsn=_01d010aabce2c5cc0008c930snt004?mc2f40.ho" X-DSNContext: 335a7efd - 4481-00000001 - 80040546 Message-ID: <mjz7zgtpi00029250@snt004-mc2f40.hotmail.com> Subject: Delivery Status Notification (Failure) Return-Path: <> X-OriginalArrivalTime: 06 Jun 2014 11:57:28.0142 (UTC) FILETIME=[CEAD2EE0:01D0114B] This is a MIME-formatted message. Portions of this message may be unreadable without a MIME-capable mail program. --9B095B5ADSN=_01D010AABCE2C5CC0008C930SNT004?MC2F40.ho Content-Type: text/plain; charset=unicode-1-1-utf-7 This is an automatically generated Delivery Status Notification. Delivery to the following recipients failed. this.seems.to.verify@hotmail.com The email header of the NDR shows that Hotmail thinks the email address is invalid as far as sending to this address is concerned. However, Hotmail reports that the same email address is valid as far as the email verification activity performed by emailverifyapi.com. The discrepancy in verification results versus mail send is with the Hotmail infrastructure reporting one thing but doing the exact opposite. This behaviour occasionally (particularly from Hotmail) is seen in a small amount of cases and is attributable to internal Hotmail (or other mail services) system anomalies. The majority (>99%) of email verification status versus mail send is consistent. However there are some edge cases caused by system faults in the mail service providers themselves. For these small number of cases, there is nothing that can be done at the email verification stage. 12 Chapter 4. FAQs

4.1.18 How do I cancel a subscription? For pay as you go accounts, the account is free and you just pay when you need it. For subscription plans, you simply need to contact us via the support button in your account dashboard, and your cancellation will take effect at the end of the month. Please note that subscription plans have a minimum 2 month period, after that you can cancel at any time. Our service is so good that we hope that you won t need to cancel! However, if you do, we are proud of our simple cancellation process. Unlike many other companies, there are no hassles with fine print and tricky notice periods. Once you ve cancelled your service, we ll disable your account and make sure that all your data is securely disposed of (deleted). 4.1.19 I have received x percentage of bounce backs using emails you verified If you experienced a large number of NDRS (Non Delivery Reports) using email addresses that were verified OK by our service there may have been an issue with your Email Service Provider (ESP) or the target mail server. Due to the nature of our verification process a mail box reported as OK can definitely accept incoming emails. This is due to a target mail server existing, the server not being a catch all and the mail box accepting incoming mail. If you experience a bounce back with your validated OK email addresses, there has likely been a fault with your ESP or on the target mail server. We are happy to work with customers and their ESPs in order to resolve such issues. 4.1. Frequently Asked Questions 13

14 Chapter 4. FAQs

CHAPTER 5 Status Codes 5.1 Email Verification Response Codes For Bulk Verification 5.1.1 Main Status Codes Ok Verification passes all checks including Syntax, DNS, MX, Mailbox, Deep Server Configuration, Grey Listing Bad Verification fails checks for definitive reasons (e.g. mail box does not exist) Unknown Conclusive verification result cannot be achieved due to mail server configuration or anti-spam measures. See table Additional Status Codes. 5.1.2 Additional Status Codes None No additional information is available. This status differs from other additional status codes as it should not be retried (the result will not change). AtSignNotFound The required @ sign is not found in email address. CatchAllConnectionFailure The secondary catch all verification failed upon connection. CatchAllValidationTimeout The secondary catch all validation timed out. DnsConnectionFailure The DNS connection failed. DnsQueryTimout The DNS service failed to respond (timeout). A typical example of this status code is when a DNS server on the target infrastructure is configured incorrectly. DomainIsInexistent The domain (i.e. the bit after the @ character) defined in the email address does not exist, according to DNS records. A domain that does not exist cannot have email boxes. A domain that does not exist cannot have email boxes. DomainIsWellKnownDea The domain is a well known Disposable Email Address DEA. There are many services available that permit users to use a one-time only email address. Typically, these email addresses are used by individuals wishing to gain access to content or services requiring registration of email addresses but same individuals not wishing to divulge their true identities (e.g. permanent email addresses). 15

DEA addresses should not be regarded as valid for email send purposes as it is unlikely that messages sent to DEA (Disposable Email Address) addresses will ever be read. DEA addresses should not be regarded as valid for email send purposes as it is unlikely that messages sent to DEA addresses will ever be read. DomainPartCompliancyFailure The domain part compliancy failed. DoubleDotSequence The email addresses domain contained double dots. IpBlockDetected An IP block has been detected. InvalidAddressLength The email address is an invalid length. InvalidCharacterInSequence The email address contains an invalid character. InvalidFoldingWhiteSpaceSequence The email address contains a folding white space. InvalidLocalPartLength The email address contains an invalid local part length. InvalidWordBoundaryStart http://tools.ietf.org/html/rfc3696#section-3 LocalSenderAddressRejected The local sender address was rejected. MailboxFull The mailbox is full. Mailboxes that are full are unable to receive any further email messages until such time as the user empties the mail box or the system administrator grants extra storage quota. Most full mailboxes usually indicate accounts that have been abandoned by users and will therefore never be looked at again. We do not recommend sending emails to email addresses identified as full. MailboxDoesNotExist The mailbox does not exist. 100% confidence that the mail box does not exist. MailboxTemporarilyUnavaible The mail server is operating Grey Listing. Whilst we endeavour to verify grey listed addresses, sometimes it is not possible whilst still offering timely verification results. NoMxServersFound There are no mail servers defined for this domain, according to DNS. Email addresses cannot be valid if there are no email servers defined in DNS for the domain. OperationCanceled The operation was cancelled. ProxyConnectionTimeout The proxy timed out. ServerDoesNotSupportInternationalMailboxes The server does not support international mailboxes. International email boxes are those that use international character sets such as Chinese / Kanji etc. International email boxes require systems in place for Punycode translation. Where these systems are not in place, email verification or delivery is not possible. For further information see Punycode. ServerIsCatchAll The server is configured for catch all and responds to all email verifications with a status of Ok. Mail servers can be configured with a policy known as Catch All. Catch all redirects any email address sent to a particular domain to a central email box for manual inspection. Catch all configured servers cannot respond to requests for email address verification. SmtpConnectionFailure The TCP connection to the target mail server failed. SmtpConnectionShutdown The target mail server prematurely terminated the connection. 16 Chapter 5. Status Codes

SmtpConnectionTimeout A timeout occurred whilst waiting for a connection to the target mail server. SmtpConnectionRefused The SMTP connection was refused by the remote server. This status code applies to all Office 365 mail server, stopping verification, as these mail servers all operate a catchall policy. Success Successful verification. 100% confidence that the mail box exists. TcpSocketUnavailable The TCP socket is unavailable for date exchange. TooManyAtSignsFound Too many @ signs found in email address. Only one @ character is allowed in email addresses. UnableToBindToLocalIpAddress Cannot bind local IP endpoint specified. UnexpectedQuotedPairSequence http://tools.ietf.org/html/rfc3696#section-3 UnhandledException Transient service fault. Unknown The reason for the verification result is unknown. PossibleSpamTrapDetected A possible spam trap email address or domain has been detected. Spam traps are email addresses or domains deliberately placed on-line in order to capture and flag potential spam based operations. Our advanced detection heuristics are capable of detecting likely spam trap addresses or domains known to be associated with spam trap techniques. We do not recommend sending emails to addresses identified as associated with known spam trap behaviour. Sending emails to known spam traps or domains will result in your ESP being subjected to email blocks from a DNS Block List.. An ESP cannot tolerate entries in a Block List (as it adversely affects email deliver-ability for all customers) and will actively refuse to send emails on behalf of customers with a history of generating entries in a Block List. 5.1. Email Verification Response Codes For Bulk Verification 17

18 Chapter 5. Status Codes

CHAPTER 6 Glossary 6.1 Glossary B2B Business To(2) Business Business email hosting services are generally private, enterprise grade hosting services typically hosted in either private data centers or in cloud based infrastructure such. Business to business refers to the activity of businesses sending email to clients using business email addresses. B2C Business To(2) Consumer Consumer email hosting providers are generally well known, mostly web based providers such as Hotmail, Yahoo, AOL, Gmail etc. Business to consumer refers to the activity of businesses sending email to clients using consumer email addresses. Verifying email addresses in consumer domains is generally more technically challenging than B2B Block List See DNSBL. DDoS Distributed Denial of Service See Wikipedia - Denial-of-service attack for more information. DEA Disposable Email Address There are many services available that permit users to use a one-time only email address. Typically, these email addresses are used by individuals wishing to gain access to content or services requiring registration of email addresses but same individuals not wishing to divulge their true identities (e.g. permanent email addresses). DEA addresses should not be regarded as valid for email send purposes as it is unlikely that messages sent to DEA addresses will ever be read. DEA addresses should not be regarded as valid for email send purposes as it is unlikely that messages sent to DEA addresses will ever be read. DNS Domain Name System At its simplest level, DNS converts text based queries (e.g. a domain name) into IP addresses. DNS is also responsible for providing the MX records needed to locate a domains mail servers. See Wikipedia - Domain Name System for more information. DNSBL DNS Block List 19

As an anti-spam measure, mail servers can use spam black lists to look up the reputation of IP addresses and domains sending email. If an IP or domain is on a block list, the mail server may reject the senders email message. See Wikipedia - DNSBL for more information. ESP Email Service Provider A service that sends emails on your behalf. See Wikipedia - Email service provider (marketing) for more information. Grey Listing A technique used in mail servers as an anti-spam technique. Sometimes also known as deferred, grey listing arbitrarily delays the delivery of emails with a try again later response to the client sending the email. MX See Wikipedia - Grey Listing for more information. Mail Exchanger The MX is a server responsible for email interchange with a client. Office 365 Office 365 mail servers (e.g. x-com.mail.protection.outlook.com) are always configured with the catch all policy, accepting all emails sent to the domain and redirecting them to a central email box for manual inspection. Catch all configured servers cannot respond to requests for email address verification. This does not affect our coverage of Hotmail, Live and Outlook mail boxes. Punycode Punycode is a way to represent Unicode with the limited character subset of ASCII supported by the Domain Name System. See Wikipedia - Punycode for more information. RESTful Representational state transfer SMTP See Wikipedia - RESTful for further information. Simple Mail Transport Protocol SMTP is a protocol. It is the sequence of commands and responses between a client (the software sending an email) and server (the software receiving an email) that facilitates the sending and receiving of email between computer based email messaging systems. Spam Trap Spam traps are email addresses used for the sole purpose of detecting spamming activities. Spam traps are used by many block lists (DNSBL) to detect spammers. For more information, see Wikipedia - Spam Traps. 20 Chapter 6. Glossary

Index B B2B, 19 B2C, 19 Block List, 19 D DDoS, 19 DEA, 19 DNS, 19 DNSBL, 19 E ESP, 20 G Grey Listing, 20 M MX, 20 O Office 365, 20 P Punycode, 20 R RESTful, 20 S SMTP, 20 Spam Trap, 20 21