Email and domain intelligence glossary

Email and domain intelligence is the practice of deriving facts about an email address or domain (what kind of provider it is, whether it can receive mail, who owns it, how risky it looks) without contacting the mailbox owner. This glossary defines 40 terms used in that work, in alphabetical order, each in one to three sentences. Where a term has its own guide on this blog, the definition links to it.

A

A and AAAA records

DNS records that map a hostname to an IPv4 (A) or IPv6 (AAAA) address. In email checks they show whether a domain has a website, and under RFC 5321 they act as an implicit MX when a domain has no MX records.

B

Blocklist

A list of domains to reject or flag, most often disposable email domains. The widely used community source is the disposable-email-domains repository; every list lags behind newly registered domains, as covered in why blocklists go stale.

Business email

An address on a domain owned by an organization (jane@stripe.com), as opposed to a free webmail or ISP domain. Also called a work email. In code, you identify one by ruling out known free, ISP and disposable domains; see business email vs personal email.

C

Catch-all domain

A domain whose mail server accepts messages for any local part, real or not. SMTP probes can't tell a real mailbox from a made-up one on a catch-all, so verification results come back as "unknown"; more in catch-all email domains.

ccTLD

A two-letter country-code top-level domain such as .uk, .de or .in. Each registry sets its own rules, and many use second-level zones like .co.uk or .ac.uk that behave like public suffixes.

D

Disposable email address

A temporary inbox, usually created with no signup, that receives mail for minutes or days and is then abandoned. Services like Mailinator run many such domains; see what a disposable email address is.

DKIM

DomainKeys Identified Mail: the sending server signs messages with a private key, and receivers verify the signature with a public key published in DNS under <selector>._domainkey.<domain>. You can't list a domain's DKIM keys from outside without knowing its selectors.

DMARC

A policy record at _dmarc.<domain> that tells receivers what to do with mail that fails SPF and DKIM alignment (p=none, quarantine or reject) and where to send reports. Originally RFC 7489; as of 2026 its Standards Track successor is RFC 9989. See what SPF and DMARC tell you about a signup domain.

DNS-over-HTTPS (DoH)

Sending DNS queries over HTTPS, standardized in RFC 8484. Public resolvers also offer a JSON variant, which lets serverless and edge code resolve MX, A and TXT records with a plain fetch.

Domain age

The time since a domain was registered, read from the registration event in its RDAP record. Very young domains are a moderate risk signal for signups; see domain age as a signup risk signal.

Domain intelligence

Facts derived from a domain name: its category (company, free, disposable, educational, government, ISP), DNS setup, registration data and the organization behind it. Used for signup screening, lead routing and enrichment.

E

Educational email domain

A domain belonging to a school or university, typically recognized by TLD rules: .edu (restricted to accredited US postsecondary institutions), .ac.<cc> and .edu.<cc>. Subdomains such as cs.harvard.edu belong to the same institution.

Email normalization

Reducing an address to a canonical comparison key: lowercasing the domain, converting IDNs to punycode, and for providers that support it, stripping +tags and Gmail dots. Used for deduplication, never for the address you actually send to.

Email validation

Checks that need no contact with the mailbox: syntax, domain category, DNS records. Fast and safe to run on every keystroke or signup.

Email verification

Checks that try to confirm a specific mailbox exists, usually through an SMTP conversation or a confirmation email. Only the confirmation email is reliable; see email validation vs verification.

Enrichment

Adding attributes to a record from an outside source, most commonly company data (name, industry, size, location) looked up from an email domain. LLM-based enrichment is fast and cheap but can be wrong, so profiles should carry a confidence score.

eTLD+1

The "effective top-level domain plus one label", also called the registrable domain: the part of a hostname a person or company can register. For mail.stripe.com it's stripe.com; for news.bbc.co.uk it's bbc.co.uk. Computed with the Public Suffix List.

F

Firmographics

Company-level attributes used for segmentation and scoring: industry, employee count, revenue, location, funding stage. The B2B equivalent of demographics.

Free email provider

A webmail service anyone can sign up for, such as Gmail, Outlook.com or Yahoo Mail. An address on one says nothing about the user's employer; the free provider category lists the domains pingutil treats this way.

G

Government email domain

A domain run by a public authority, recognized by TLD rules such as .gov, .mil, .gov.<cc>, .gouv.<cc> and .gob.<cc>. Rules vary by country, and some government bodies use ordinary commercial domains.

Greylisting

An anti-spam technique where a mail server temporarily rejects mail from an unfamiliar sender and accepts it when the sender retries later (RFC 6647). It makes real-time SMTP probes return inconclusive results.

gTLD

A generic top-level domain such as .com, .org, .xyz or .app. gTLD registries operate under ICANN contracts, which require RDAP for registration data.

I

IDN

Internationalized domain name: a domain containing non-ASCII characters, such as bücher.de. In DNS it is stored as punycode (xn--bcher-kva.de), so normalize before comparing or looking it up.

ISP email domain

A mail domain provided by an internet service provider to its subscribers, such as comcast.net or btinternet.com. It's a consumer address, so treat it like free webmail, not like a company.

L

Local part

Everything before the @ in an email address. RFC 5321 says it must be treated as case sensitive, though almost every provider ignores case in practice.

M

MX record

A DNS record naming the mail server(s) that accept email for a domain, each with a preference number. A domain with no MX falls back to its A/AAAA record; see checking MX records.

N

Null MX

A single MX record with preference 0 and target . (MX 0 .), defined in RFC 7505. It means the domain accepts no email at all.

P

Plus addressing

Appending +tag to the local part (jane+news@example.com) so mail still reaches jane@. Also called subaddressing; widely supported but provider-specific, and a common way to create many accounts from one inbox.

Privacy relay

A service that gives users forwarding aliases to hide their real address, such as Apple Hide My Email, Firefox Relay or SimpleLogin. The aliases are long-lived and tied to real people, so they are not disposable, though their random-looking local parts can trip randomness checks.

Public Suffix List

A community-maintained list of domain suffixes under which anyone can register names, such as com, co.uk and github.io. It's published at publicsuffix.org and used to compute eTLD+1; see eTLD+1 explained.

Punycode

The encoding (RFC 3492) that represents Unicode domain labels in ASCII, with an xn-- prefix. münchen.de becomes xn--mnchen-3ya.de.

R

Randomized local part

A machine-generated local part such as ccjxx90sze@ or a fake-name stem with random digits. It's a strong sign of scripted signups, detected with character statistics plus a first-name dictionary so real names aren't flagged.

RDAP

Registration Data Access Protocol: the JSON-over-HTTPS successor to WHOIS, with responses defined in RFC 9083. It's the standard way to read a domain's registration date, registrar and status.

Registrable domain

See eTLD+1.

Role-based address

An address for a function rather than a person, such as info@, sales@ or support@. Usually real and deliverable but shared, so many teams flag rather than block them.

S

SMTP verification

Opening an SMTP session with a domain's mail server and checking whether it accepts a RCPT TO for the address, without sending a message. Catch-all domains, greylisting and blocked outbound port 25 make it unreliable.

SPF

Sender Policy Framework (RFC 7208): a TXT record starting with v=spf1 that lists hosts allowed to send mail for a domain. It describes outbound mail, not whether a mailbox exists.

System-generated address

An address used by software rather than people, such as noreply@, mailer-daemon@, bounce@ or postmaster@. Signups from these are almost never a human customer.

T

TLD

Top-level domain: the last label of a domain name, such as com, org or uk. TLD rules alone can classify educational and government domains in many countries.

W

WHOIS

The older, plain-text protocol for domain registration data. Output format varies by registry, and as of January 2025 ICANN no longer requires most gTLD registries or any registrars to run it; RDAP replaces it.

To see several of these signals on a real address (category, verdict, local-part flags, DNS checks), run one through the live demo.