IPQS
Login Register
<< Back to Categories
Response Parameters
Response Field Definitions

IPQS returns a large amount of data with each lookup so your development team can make smarter decisions in your business logic. The "Fraud Score" can also provide valuable insights to identify high-risk emails and mail providers. Another useful data point is the "User Activity" signal, which estimates good behavior associated with the email, such as purchases and account registrations. The "First Seen" date estimates how old the email address is, indicating newly created accounts.

View the recommended logic below to interpret our API results based on use cases for email deliverability or registration/user scoring.


Treat email addresses as valid when:

  • For email marketing and delivery analysis, valid is true, disposable is false, and spam_trap_score is not high.

  • For stricter email marketing deliverability, scrub records with spam_trap_score as medium. For even stricter filtering, scrub emails with frequent_complainer as true.

  • For user quality analysis, valid is true, disposable is false, and fraud_score is less than 90.

  • Fraud Scores can also be a good indicator of user quality, where scores 80+ are suspicious and 90+ are risky. To prevent against account takeover and credential stuffing, emails with "leaked" as true indicate user data recently compromised on the dark web.



Field Description Possible Values
valid Does this email address appear valid? boolean
disposable Is this email suspected of belonging to a temporary or disposable mail service? Usually associated with fraudsters and scammers. boolean
timed_out Did the email verification connection to the mail service provider timeout during the verification? If so, we recommend increasing the "timeout" variable above the default 7 second value so more time can be spent during the mailbox verification request to mail servers. Lookups that timeout with a "valid" result as false are most likely false and should be not be trusted. boolean
deliverability How likely is this email to be delivered to the user and land in their mailbox. Values can be "high", "medium", or "low". string
catch_all Is this email likely to be a "catch all" where the mail server verifies all emails tested against it as valid? It is difficult to determine if the address is truly valid in these scenarios, since the email's server will not confirm the account's status. boolean
leaked Was this email address associated with a recent database leak from a third party? Leaked accounts pose a risk as they may have become compromised during a database breach. boolean
suspect This value indicates if the mail server is currently replying with a temporary mail server error or if the email verification system is unable to verify the email address due to a broken SMTP handshake. This status will also be true for "catch all" email addresses as defined below. If this value is true, then we suspect the "valid" result may be tainted and there is not a guarantee that the email address is truly valid. This status is rarely true for popular mailbox providers and typically only returns as true for a small percentage of business mail servers. boolean
smtp_score Validity score of email server's SMTP setup. Range: "-1" to "3". Scores above "-1" can be associated with a valid email.
  • -1 = invalid email address
  • 0 = mail server exists, but is rejecting all mail
  • 1 = mail server exists, but is showing a temporary error
  • 2 = mail server exists, but accepts all email
  • 3 = mail server exists and has verified the email address
 integer
overall_score Overall email validity score. Range: "0" to "4". Scores above "1" can be associated with a valid email.
  • 0 = invalid email address
  • 1 = dns valid, unreachable mail server
  • 2 = dns valid, temporary mail rejection error
  • 3 = dns valid, accepts all mail
  • 4 = dns valid, verified email exists
 integer
first_name Suspected first name based on email. Returns "CORPORATE" if the email is suspected of being a generic company email. Returns "UNKNOWN" if the first name was not determinable. string
common Is this email from common free email providers? ("gmail.com", "yahoo.com", "hotmail.com", etc.) boolean
generic Is this email suspected as being a catch all or shared email for a domain? ("admin@", "webmaster@", "newsletter@", "sales@", "contact@", etc.) boolean
dns_valid Does the email's hostname have valid DNS entries? Partial indication of a valid email. boolean
honeypot Is this email believed to be a "honeypot" or "SPAM trap"? Bulk mail sent to these emails increases your risk of being blacklisted by large ISPs & ending up in the spam folder. boolean
spam_trap_score Intelligent confidence level of the email address being an active SPAM trap. Values can be "high", "medium", "low", or "none". We recommend scrubbing emails with a "high" status, typically for any promotional mailings. This data is meant to provide a more accurate result for the "frequent_complainer" and "honeypot" data points, which collect data from spam complaints, spam traps, and similar techniques. string
recent_abuse This value will indicate if there has been any recently verified abuse across our network for this email address. Abuse could be a confirmed chargeback, fake signup, compromised device, fake app install, or similar malicious behavior within the past few days. boolean
fraud_score The overall Fraud Score of the user based on the email's reputation and recent behavior across the IPQS threat network. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent. float
frequent_complainer Indicates if this email frequently unsubscribes from marketing lists or reports spam complaints. boolean
suggested_domain Default value is "N/A". Indicates if this email's domain should in fact be corrected to a popular mail service. This field is useful for catching user typos. For example, an email address with "gmai.com", would display a suggested domain of "gmail.com". This feature supports all major mail service providers. string
domain_velocity Indicates the level of legitimate users interacting with the email address domain. Values can be "high", "medium", "low", or "none". Domains like "IBM.com", "Microsoft.com", "Gmail.com", etc. will have "high" scores as this value represents popular domains. New domains or domains that are not frequently visited by legitimate users will have a value as "none". This field is restricted to upgraded plans. string
domain_trust Risk classification of the email's domain based on past abuse issues and positive behavior signals. Values include: "trusted", "positive", "neutral", "suspicious", "malicious", or "not rated". string
user_activity Frequency at which this email address makes legitimate purchases, account registrations, and engages in legitimate user behavior online. Values can be "high", "medium", "low", or "none". Values of "high" or "medium" are strong signals of healthy usage. New email addresses without a history of legitimate behavior will have a value as "none". This field is restricted to higher plan tiers. string
associated_names Displays first and last names linked to the email address, if available in our data sources. Match rates vary by country. This field is restricted to upgraded plans. Object value contains, "status", and "names" as an array. object
associated_phone_numbers Displays phone numbers linked to the email address, if available in our data sources. Match rates vary by country. This field is restricted to upgraded plans. Object value contains, "status", and "phone_numbers" as an array. object
mx_records List of MX records associated with the email's domain name. array
a_records List of A records associated with the email's domain name. array
risky_tld Signals that the domain belongs to a risky TLD extension frequently associated with malware, scams, abuse, or phishing. boolean
spf_record Confirms if the domain has a proper SPF DNS record. boolean
dmarc_record Confirms if the domain has a proper DMARC DNS record. boolean
first_seen An object containing fields related to when the email address was first seen.
Field Description Possible Values
human A human description of the email address age, using an estimation of the email creation date when IPQS first discovered this email address. (Ex: 3 months ago) string or null
timestamp The unix time since epoch when this email was first analyzed by IPQS. (Ex: 1568061634) integer
iso The time this email was first analyzed by IPQS in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00) string
domain_age An object containing fields related to when the domain was registered.
Field Description Possible Values
human A human description of when this domain was registered. (Ex: 3 months ago) string or null
timestamp The unix time since epoch when this domain was first registered. (Ex: 1568061634) integer
iso The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00) string
sanitized_email Sanitized email address with all aliases and masking removed, such as multiple periods for Gmail.com. string
request_id A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice. string
success Was the request successful? boolean
message A generic status message, either success or some form of an error notice. string
errors Array of errors which occurred while attempting to process this request. array of strings

Ready to eliminate fraud?

Start fighting fraud now with 5,000 Free Lookups!

We're happy to answer any questions or concerns.

Chat with our fraud detection experts any day of the week.

Call us at: (800) 713-2618

Schedule a Demo Sign Up