Email Scoring

Scores an email address from 0 to 3 for how likely it is to be fake, disposable or abusive.

Overview#

scoring/email evaluates the address passed in email without sending anything to it. It returns a score, a plain-language reason, the booleans isValid, isDisposable, isFree, isRoleBased and isEducational, a blacklisted flag, and a domain block with the domain's age and its MX, SPF, DKIM, DMARC and BIMI status (the same data as Domain Lookup).

When to use it#

• Block throwaway addresses at signup, trial creation and promo redemption.
• Decide whether to require email confirmation or extra verification.
• Clean a mailing list before a campaign to protect your sender reputation.

Reading the result#

The score runs from 0 (clean) to 3 (almost certainly bad). A sensible policy:

• 0 to 1: accept normally.
• 2: accept but verify, for example by sending a confirmation link and limiting what the account can do until it is clicked.
• 3: reject, or send to manual review.

Read the flags to understand why. isDisposable is the strongest abuse indicator. isFree (webmail providers) is normal for consumers and says little by itself, while isRoleBased (info@, support@) means a shared mailbox rather than a person. isEducational marks school or university domains, useful if you offer student pricing. A domain that is new or has no MX record pushes the score up.

Extra signals#

• suggestion: when the domain looks like a typo of a major provider (gmial.com, hotmial.com, yaho.com, outlok.com, icloud.co, gmail.con), the corrected address, for example ahmed@gmail.com; otherwise null. Show it as "Did you mean...?". A typo domain with no MX scores 3 (Email domain looks like a typo of gmail.com.); one that does receive mail scores at least 2.
• isGibberish: true when the part before the @ looks randomly generated or keyboard-mashed (xk3j9qz2v, qwerty123, aaaaaa1, a long run of digits). The check is conservative and does not flag ordinary Arabic or Latin names such as mohammed.alqahtani or noura1995. It raises the score to at least 1.
• normalized: the canonical address for multi-account detection. It is lower-cased, drops +tag suffixes, and removes the dots of Gmail addresses, so A.B+shop@gmail.com becomes ab@gmail.com. The original stays in email.

Notes#

• Counts as one request. Test mode returns fake data, is free and raises no events.
• Not part of the Standard plan; available on trial, Premium and pay-as-you-go. Without access you get error 117 (feature_not_available).
• Custom rules for the email group can test the address, domain and each flag, overwrite the score, or mark the address valid or invalid. Matches are listed in custom_rules_applied.
• A spam_email event is raised when the score is 2 or higher and is sent to your webhooks.
• A missing or malformed address returns error 119 (invalid_email_address) with HTTP 200.

Request#

• Authenticate with the key parameter or an Authorization: Bearer header.
• Counts as 1 request.
• Available on: Free trial Premium Pay-as-you-go

Parameters#

Every method also accepts format, lang, mode, userID, callback. See Options.

Code samples#

curl -G "https://gurdx.cretip.com/api/scoring/email" \
  --data-urlencode "key=YOUR_API_KEY" \
  --data-urlencode "email=user@example.com"

<?php

$response = file_get_contents('https://gurdx.cretip.com/api/scoring/email?'.http_build_query(['key' => 'YOUR_API_KEY', 'email' => 'user@example.com']));
$result = json_decode($response, true);

if ($result['status'] === 'success') {
    print_r($result['data']);
} else {
    echo $result['code'].': '.$result['description'];
}

const params = new URLSearchParams({"key":"YOUR_API_KEY","email":"user@example.com"});
const res = await fetch(`https://gurdx.cretip.com/api/scoring/email?${params}`);
const result = await res.json();

if (result.status === 'success') {
  console.log(result.data);
} else {
  console.error(result.code, result.description);
}

import requests

res = requests.get("https://gurdx.cretip.com/api/scoring/email", params={"key": "YOUR_API_KEY", "email": "user@example.com"})
result = res.json()

if result["status"] == "success":
    print(result["data"])
else:
    print(result["code"], result["description"])

Response#

Success#

{
    "data": {
        "score": 3,
        "reason": "Email domain is considered dangerous.",
        "isValid": false,
        "isFree": false,
        "isRoleBased": true,
        "isEducational": false,
        "isDisposable": false,
        "blacklisted": false,
        "email": "test@dangerous-domain.com",
        "domain": {
            "name": "dangerous-domain.com",
            "is_dangerous": true,
            "is_spf": false,
            "is_dmarc": false,
            "is_dkim": false,
            "is_mx": false,
            "is_bimi": false,
            "created_at": "2025-02-05",
            "is_new": true
        },
        "custom_rules_applied": {
            "total": 0,
            "rules": []
        },
        "suggestion": null,
        "isGibberish": false,
        "normalized": "test@dangerous-domain.com"
    },
    "status": "success",
    "executionTime": 1
}

Error#

Errors are delivered with HTTP 200 — always check the status field.

{
    "status": "error",
    "code": 101,
    "type": "invalid_key",
    "description": "The API Key is missing or invalid."
}

Response fields#