Inside the email signal: syntax, MX, disposable domains and account age

Email is often the first thing a fraudster gets wrong, so Veritus puts every address through several layers of scrutiny before the model ever sees it.

• Syntax and MX — the address is checked for valid structure and its domain is looked up for live MX (mail exchange) records, so a domain that cannot actually receive mail is flagged.
• Disposable-domain detection — throwaway and temporary-mailbox providers are matched against a maintained list.
• Role-account detection — generic mailboxes such as info@, sales@ or admin@ are identified, since real individual signups rarely use them.
• Free-provider classification — the address is tagged as a free consumer provider (Gmail, Outlook and similar) versus a corporate domain.
• Estimated age — Veritus estimates the account-creation age from public registration signals, because a mailbox created minutes ago behaves very differently from one that has existed for years.

Each of these becomes a feature the model weighs alongside the other six signals. A brand-new address on a disposable domain is a very different risk to an established corporate address, and Veritus can tell them apart.