Email risk score: measuring address quality before you send

Email scoring is the practice of assigning a numeric score to each address in your list based on a set of signals: whether the mailbox exists, the domain type, the MX configuration, and the presence of risk factors. A high score means the address is safe to send to. A low score means there is a real chance of a bounce, a spam complaint, or a spam trap hit.

Why scoring, not just validation

Standard validation gives a binary answer: the address is valid or it is not. But between "definitely exists" and "definitely does not exist" sits a wide gray zone. Catch-all addresses, unresolvable statuses, role accounts, addresses on suspicious domains — all of them pass a basic syntax check while carrying very different risk levels.

Scoring replaces the yes/no with a number, typically 0 to 100, that weighs dozens of signals at once. A score of 95 is reliable. A score of 40 is risky. A score of 10 will almost certainly cause problems.

That number lets you make more specific decisions: send to addresses scoring 70 or above in the main campaign, review the 40-69 tier separately, drop anything below 40 from marketing sends.

What goes into the score

SMTP result. If the server confirmed the mailbox with a 250 response, that adds to the score. A rejection (550) brings it to near zero. A timeout or catch-all response lands somewhere in the middle, flagged as uncertain.

Domain type. A corporate domain with SPF, DKIM, and DMARC set up gets a bonus. Free providers like Gmail are neutral. A domain registered in the last 30 days gets a penalty — fresh domains are disproportionately used for fraud.

MX configuration. Having an MX record is the baseline. Multiple MX records with different priorities point to real mail infrastructure. An A record with no MX is a sign something is off.

Blocklist membership. An address from a known spam trap database scores zero. A domain on a disposable email list does the same. A role address (info@, support@) takes a penalty, though not always a disqualifying one.

Syntax patterns. An unusually long local part, non-standard characters, or patterns like test1234@ and asdfg@ reduce the score. A name that looks like a real person (ivan.petrov@) nudges it up.

Catch-all status. Addresses on catch-all domains get a penalty because the server accepts everything, real or invented, so individual mailbox existence cannot be confirmed.

How to act on the score

Split your list into three tiers. The top tier (80-100) is your core audience: send all campaigns to them. The middle tier (50-79) gets more careful treatment: send, but watch bounce rates closely after each campaign. The bottom tier (0-49) stays out of marketing sends; keep them for transactional messages only, if at all.

For lead generation, scoring is a quick way to compare traffic sources. If the signup form on page A produces addresses averaging 85 and the form on page B averages 45, page B is attracting bots or unengaged visitors. That is when you adjust the form, add CAPTCHA, or require double opt-in.

When evaluating a purchased or rented list, scoring is the first check. Run the list through a validator that returns scores. If the average is below 60, the list is low quality and sending to it will likely hurt your sender reputation.

What scoring cannot tell you

Scoring does not know whether the person wants your email. An address can score 95 — valid, corporate, clean domain — and the subscriber will still unsubscribe after the first message if they never asked to hear from you.

A high score is not consent. Double opt-in, suppression lists, and regulations like GDPR apply regardless of address quality.

Scoring models also vary between services. One validator might give an address 80 while another gives it 60 for the same address. That is normal: different weighting, different data sources. The important thing is consistency: use the same tool for your entire list so the tiers are comparable.