IPQS
Login Register
<< Back to Categories
Response Parameters

Response Field Definitions

Learn about the parameters returned by the Email Verification API. With clear definitions for every response value, you can fine tune your requests to better protect against fraud.

IPQS returns a large amount of data with each lookup so your development team can make smarter decisions in your business logic. The fraud_score can also provide valuable insights to identify high-risk emails and mail providers. Another useful data point is the user_activity signal, which estimates good behavior associated with the email, such as purchases and account registrations. The first_seen date estimates how old the email address is, indicating newly created accounts.

View the recommended logic below to interpret our API results based on use cases for email deliverability or registration/user scoring.

Treat email addresses as valid when:

  • For email marketing and delivery analysis, valid is true, disposable is false, and spam_trap_score is not high.
  • For stricter email marketing deliverability, scrub records with spam_trap_score as medium. For even stricter filtering, scrub emails with frequent_complainer as true.
  • For user quality analysis, valid is true, disposable is false, and fraud_score is less than 90.
  • Fraud Scores can also be a good indicator of user quality, where scores 80+ are suspicious and 90+ are risky. To prevent against account takeover and credential stuffing, emails with leaked as true indicate user data recently compromised on the dark web.
Field Description Possible Values
valid Does this email address appear valid? Boolean
disposable Is this email suspected of belonging to a temporary or disposable mail service? Usually associated with fraudsters and scammers. Boolean
timed_out Did the email verification connection to the mail service provider timeout during the verification? If so, we recommend increasing the timeout variable above the default 7 second value so more time can be spent during the mailbox verification request to mail servers. Lookups that time out with a valid result as false are most likely false and should be not be trusted. Boolean
deliverability How likely is this email to be delivered to the user and land in their mailbox. Values can be high, medium, or low. String
catch_all Is this email likely to be a "catch all" where the mail server verifies all emails tested against it as valid? It is difficult to determine if the address is truly valid in these scenarios, since the email's server will not confirm the account's status. Boolean
leaked Was this email address associated with a recent database leak from a third party? Leaked accounts pose a risk as they may have become compromised during a database breach. Boolean
suspect This value indicates if the mail server is currently replying with a temporary mail server error or if the email verification system is unable to verify the email address due to a broken SMTP handshake. This status will also be true for "catch all" email addresses as defined below. If this value is true, then we suspect the valid result may be tainted and there is not a guarantee that the email address is truly valid. This status is rarely true for popular mailbox providers and typically only returns as true for a small percentage of business mail servers. Boolean
smtp_score Validity score of email server's SMTP setup. Range: "-1" to "3". Scores above "-1" can be associated with a valid email. - -1 = invalid email address - 0 = mail server exists, but is rejecting all mail - 1 = mail server exists, but is showing a temporary error - 2 = mail server exists, but accepts all email - 3 = mail server exists and has verified the email address Integer
overall_score Overall email validity score. Range: "0" to "4". Scores above "1" can be associated with a valid email. - 0 = invalid email address - 1 = dns valid, unreachable mail server - 2 = dns valid, temporary mail rejection error - 3 = dns valid, accepts all mail - 4 = dns valid, verified email exists Integer
first_name Suspected first name based on email. Returns "CORPORATE" if the email is suspected of being a generic company email. Returns UNKNOWN if the first name was not determinable. String
identity_data Enterprise Data Point — An object containing enhanced identity enrichment sourced from highly authoritative data sources such as credit bureaus, telcos, utility companies, and similar organizations. Enriches name, age, and related email addresses, phone numbers, and physical addresses. Each entry in identity_data represents one person. Each field may return multiple values. For example, the first_name field may return multiple values if the person has ever changed their name. If any data is unavailable, it will return either a null value or an empty array. Object
common Is this email from common free email providers? ("gmail.com", "yahoo.com", "hotmail.com", etc.) Boolean
generic Is this email suspected as being a catch all or shared email for a domain? ("admin@", "webmaster@", "newsletter@", "sales@", "contact@", etc.) Boolean
dns_valid Does the email's hostname have valid DNS entries? Partial indication of a valid email. Boolean
honeypot Is this email believed to be a "honeypot" or "SPAM trap"? Bulk mail sent to these emails increases your risk of being blacklisted by large ISPs & ending up in the spam folder. Boolean
spam_trap_score Intelligent confidence level of the email address being an active SPAM trap. Values can be high, medium, low, or "none". We recommend scrubbing emails with a high status, typically for any promotional mailings. This data is meant to provide a more accurate result for the "frequent_complainer" and "honeypot" data points, which collect data from spam complaints, spam traps, and similar techniques. String
recent_abuse This value will indicate if there has been any recently verified abuse across our network for this email address. Abuse could be a confirmed chargeback, fake signup, compromised device, fake app install, or similar malicious behavior within the past few days. Boolean
fraud_score The overall Fraud Score of the user based on the email's reputation and recent behavior across the IPQS threat network. Fraud Scores >= 75 are suspicious, but not necessarily fraudulent. Float
frequent_complainer Indicates if this email frequently unsubscribes from marketing lists or reports spam complaints. Boolean
suggested_domain Default value is "N/A". Indicates if this email's domain should in fact be corrected to a popular mail service. This field is useful for catching user typos. For example, an email address with "gmai.com", would display a suggested domain of "gmail.com". This feature supports all major mail service providers. String
domain_velocity Indicates the level of legitimate users interacting with the email address domain. Values can be high, medium, low, or "none". Domains like "IBM.com", "Microsoft.com", "Gmail.com", etc. will have high scores as this value represents popular domains. New domains or domains that are not frequently visited by legitimate users will have a value as "none". This field is restricted to upgraded plans. String
domain_trust Risk classification of the email's domain based on past abuse issues and positive behavior signals. Values include: trusted, positive, neutral, suspicious, malicious, or not rated. String
user_activity Frequency at which this email address makes legitimate purchases, account registrations, and engages in legitimate user behavior online. Values can be high, medium, low, or "none". Values of high or medium are strong signals of healthy usage. New email addresses without a history of legitimate behavior will have a value as "none". This field is restricted to higher plan tiers. String
associated_names Displays first and last names linked to the email address, if available in our data sources. Match rates vary by country. This field is restricted to upgraded plans. Object value contains, status, and names as an array. Object
associated_phone_numbers Displays phone numbers linked to the email address, if available in our data sources. Match rates vary by country. This field is restricted to upgraded plans. Object value contains, status, and phone_numbers as an array. Object
mx_records List of MX records associated with the email's domain name. Array
a_records List of A records associated with the email's domain name. Array
risky_tld Signals that the domain belongs to a risky TLD extension frequently associated with malware, scams, abuse, or phishing. Boolean
spf_record Confirms if the domain has a proper SPF DNS record. Boolean
dmarc_record Confirms if the domain has a proper DMARC DNS record. Boolean
first_seen An object containing fields related to when the email address was first seen. Object
domain_age An object containing fields related to when the domain was registered. Object
sanitized_email Sanitized email address with all aliases and masking removed, such as multiple periods for Gmail.com. String
result_type How this result was produced by IPQS. An enum containing 3 possible values: cached (result was from recently checked sources), fast (less accurate, quick check) or live (full check completed during this API call). String, enum (cached, fast, live)
request_id A unique identifier for this request that can be used to lookup the request details or send a postback conversion notice. String
success Was the request successful? Boolean
message A generic status message, generally "success", but may contain other information about processing the request or some form of an error notice. String
errors Array of errors which occurred while attempting to process this request. Array of strings
transaction_details Additional scoring variables for risk analysis are available when transaction scoring data is passed through the API request. These variables are also useful for scoring user data such as physical addresses, phone numbers, usernames, and transaction details. The data points below are populated when at least 1 transaction data parameter is present in the initial API request. The following transaction variables return null when the necessary transaction parameters are not passed with the initial API request. For instance, not passing the billing_email will return valid_billing_email as null. Object

identity_data fields

Field Description Possible Values
names An object containing names associated with the email address. first_name: Their first name.
last_name: Their last name.
middle_name: Their middle name.
addresses An object containing physical addresses associated with the email address. address: The street address.
city: The city.
region: The state or region.
postal_code: The postal code.
country: The country.
email_addresses An object containing other email addresses associated with the email address. email: The email address.
first_seen: When the email address was first created.
last_seen: When the email address was last used.
phone_numbers An object containing phone numbers associated with the email address. formatted_phone_number: The full phone number, including country code.
country: The country associated with the phone number.
age An object containing ages of people associated with the email address. human: How many years old the person is.
birthday_iso: Their date of birth in ISO format.
birthday_timestamp: Their birthday in timestamp format.
birthdate_certanty: Whether we are certain the birthdate is correct.

first_seen fields

Field Description Possible Values
human A human description of the email address age, using an estimation of the email creation date when IPQS first discovered this email address. (Ex: 3 months ago) String or null
timestamp The unix time since epoch when this email was first analyzed by IPQS. (Ex: 1568061634) Integer
iso The time this email was first analyzed by IPQS in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00) String

domain_age fields

Field Description Possible Values
human A human description of when this domain was registered. (Ex: 3 months ago) String or null
timestamp The unix time since epoch when this domain was first registered. (Ex: 1568061634) Integer
iso The time this domain was registered in ISO8601 format (Ex: 2019-09-09T16:40:34-04:00) String

transaction_details (object) fields

Key Description Expected Values
risk_score Confidence that this user or transaction is exhibiting malicious behavior. Scores are 0 - 100, with 75+ as suspicious and 90+ as high risk. This value uses different calculations with less weight on the IP reputation than the overall "Fraud Score". Float
valid_billing_address Physical address validation and reputation analysis. Boolean
valid_shipping_address Same as above. Boolean
valid_billing_email Light abusive check and reputation analysis for the email address. We recommend using our dedicated Email Validation API for deeper analysis. Boolean
valid_shipping_email Same as above. Boolean
leaked_billing_email Indicates if the email address was recently exposed or compromised in a database breach. Boolean
leaked_shipping_email Same as above. Boolean
leaked_user_data Indicates if the user's data (including phone & address) have recently been exposed or compromised in a database breach. Boolean
risky_billing_phone Reputation analysis for abusive activity associated with the phone number. Boolean
risky_shipping_phone Same as above. Boolean
valid_billing_phone Valid & active phone number with the phone carrier (not disconnected). Boolean
valid_shipping_phone Same as above. Boolean
billing_phone_carrier Phone number provider such as AT&T or Bell Canada. String
shipping_phone_carrier Same as above. String
billing_phone_line_type Phone number line type, such as Landline, Wireless, Toll-Free, VOIP, Satellite, Premium Rate, Pager, Internet Service Provider, Unknown, or N/A. String
shipping_phone_line_type Same as above. String
billing_phone_country 2-letter country code associated with the phone number. String
shipping_phone_country Same as above. String
billing_phone_country_code The country dialing code associated with the phone number. Integer
shipping_phone_country_code Same as above. Integer
bin_country The country associated with the credit card BIN. String
risky_username Is the username frequently associated with fraudulent behavior? Boolean
is_prepaid_card Is the credit card prepaid? Boolean
fraudulent_behavior Indicates high-risk behavior patterns and a high chance of fraud. Boolean
phone_name_identity_match Enterprise Account Feature — Indicates a reverse identity match between the billing phone number and first/last name.
Unknown: No checks processed.
Match: Positive identity match.
Mismatch: Data matches another user.
No Match: Could not pair identity data.		 String
phone_email_identity_match Enterprise Account Feature — Indicates a reverse identity match between the billing phone number and email address.
Unknown: No checks processed.
Match: Positive identity match.
Mismatch: Data matches another user.
No Match: Could not pair identity data.		 String
phone_address_identity_match Enterprise Account Feature — Indicates a reverse identity match between the billing phone number and physical address.
Unknown: No checks processed.
Match: Positive identity match.
Mismatch: Data matches another user.
No Match: Could not pair identity data.		 String
email_name_identity_match Enterprise Account Feature — Indicates a reverse identity match between the billing email address and first/last name.
Unknown: No checks processed.
Match: Positive identity match.
Mismatch: Data matches another user.
No Match: Could not pair identity data.		 String
name_address_identity_match Enterprise Account Feature — Indicates a reverse identity match between the billing first/last name and physical address.
Unknown: No checks processed.
Match: Positive identity match.
Mismatch: Data matches another user.
No Match: Could not pair identity data.		 String
address_email_identity_match Enterprise Account Feature — Indicates a reverse identity match between the billing physical address and email address.
Unknown: No checks processed.
Match: Positive identity match.
Mismatch: Data matches another user.
No Match: Could not pair identity data.		 String
high_risk_billing_address Enterprise Account Feature — Indicates the billing address has been flagged by IPQS. These addresses are typically dropshippers, package forwarding services, high risk landmarks, package delivery centers,empty lots, empty buildings, etc... Boolean
high_risk_shipping_address Enterprise Account Feature — Indicates the shipping address has been flagged by IPQS. These addresses are typically dropshippers, package forwarding services, high risk landmarks, package delivery centers,empty lots, empty buildings, etc... Boolean
user_flagged_billing_address Enterprise Account Feature — You can create blocklists for specific high risk billing addresses in your account settings. If you've blocked an address this will return true. Boolean
user_flagged_shipping_address Enterprise Account Feature — You can create blocklists for specific high risk shipping addresses in your account settings. If you've blocked an address this will return true. Boolean

Ready to eliminate fraud?

Start fighting fraud now with 1,000 Free Lookups!

We're happy to answer any questions or concerns.

Chat with our fraud detection experts any day of the week.

Call us at: (800) 713-2618

Schedule a Demo Sign Up