Validation Flow
When you send an email to Vouch for validation, it goes through a sophisticated multi-stage pipeline designed for both speed and accuracy.1
Authentication & Authorization
Vouch validates your API key, checks project permissions, and verifies rate limits and quotas
2
Smart Parallel Validation
All 9 validation checks start simultaneously with intelligent early-exit optimization
3
Risk Aggregation
Individual signals are combined into a final recommendation based on your project configuration
4
Logging & Analytics
Results are logged (with encrypted emails) for analytics and usage tracking
Smart Early-Exit Strategy
Vouch uses an intelligent validation strategy that minimizes latency while maximizing data quality:BLOCK Checks (Promise.race)
These checks can immediately reject an email if they fail:- Syntax validation
- Disposable email detection
- MX records verification
If any BLOCK check fails, Vouch can return immediately without waiting for other checks to complete.
FLAG Checks (Promise.all)
These checks run to completion to gather maximum intelligence:- SMTP verification
- Catch-all detection
- Role email detection
- Alias detection
- Device fingerprinting
- IP reputation
The 9 Validation Types
1. Syntax Validation
1. Syntax Validation
Action: BLOCKValidates email format against RFC 5322 standards:
- Local part validation (before @)
- Domain part validation (after @)
- Special character handling
- Length limits
[email protected](consecutive dots)@example.com(missing local part)user@(missing domain)
2. Disposable Email Detection
2. Disposable Email Detection
Action: BLOCKChecks against a constantly-updated database of 100,000+ disposable email domains:
- Temporary email services (10minutemail, guerrillamail)
- Throwaway email providers
- Synced daily from multiple sources
tempmail.com10minutemail.comguerrillamail.com
3. MX Records Verification
3. MX Records Verification
Action: BLOCKPerforms DNS lookup to verify the domain has mail servers:
- Queries MX records via Google DNS API
- Cached for 24 hours for performance
- Ensures domain can receive email
- No MX records exist
- MX records point to invalid hosts
- DNS lookup times out
4. SMTP Verification
4. SMTP Verification
Action: FLAG (optional)Connects to the mail server to verify the mailbox exists:
- Performs SMTP handshake
- Sends RCPT TO command
- Doesn’t send actual email
5. Catch-all Detection
5. Catch-all Detection
Action: FLAGIdentifies domains configured to accept emails to any address:
- Tests with random addresses
- Flags for review (not automatic block)
6. Role Email Detection
6. Role Email Detection
Action: ALLOW (configurable)Identifies generic business emails:
admin@,support@,info@,contact@- Useful for B2B applications
- Can be configured to FLAG or BLOCK
7. Alias Detection
7. Alias Detection
Action: FLAGDetects email aliases and plus-addressing:
[email protected](Gmail style)[email protected](some providers)
8. Device Fingerprinting
8. Device Fingerprinting
Action: FLAGTracks devices across multiple email validations:
- Collects 40+ browser/device signals
- Generates stable fingerprint hash
- Detects reuse patterns
- Screen resolution, color depth
- Canvas/WebGL fingerprints
- System fonts
- Hardware info
- Timezone, language
9. IP Reputation
9. IP Reputation
Action: FLAGChecks IP address against fraud databases:
- VPN detection
- Tor exit node identification
- Known fraud IP lists
- Updated daily
- Commercial VPN providers
- Datacenter IPs
- Tor network
- Known bot networks
Risk Scoring & Recommendations
After all validations complete, Vouch aggregates the signals into a final recommendation:Recommendation Logic
Configuration Options
You can customize validation behavior per project:Enable/Disable Checks
Turn individual validations on/off based on your use case
Set Actions
Configure each check to ALLOW, FLAG, or BLOCK
Whitelist Domains
Always allow specific email domains
Blacklist Domains
Always block specific email domains
Caching Strategy
Vouch uses multi-layer caching for optimal performance:What’s Cached
- Project Settings
- MX Records
- Disposable Domains
- IP Lists
- Device Fingerprints
TTL: Until webhook invalidation
- Validation toggles
- Whitelist/blacklist rules
- Risk thresholds
- API keys
Edge Computing Architecture
Vouch is built on Cloudflare Workers for global performance:275+ Data Centers
Deployed to Cloudflare’s global network
Sub-50ms Latency
Requests routed to nearest edge location
Auto-scaling
Handles millions of requests automatically
99.99% Uptime
No servers to manage or crash
Request Flow
Data Security
Email Encryption
All validation logs encrypt email addresses:API Key Security
- API keys are SHA-256 hashed before storage
- Server keys blocked from browsers (Origin/Referer/User-Agent detection)
- Client keys validated against allowed domains
- Separate test/live environments
Performance Characteristics
Typical validation times:| Scenario | Time |
|---|---|
| Cache hit (repeated domain) | 50-100ms |
| All checks enabled | 200-500ms |
| SMTP verification enabled | 500-2000ms |
| Early exit (syntax fail) | 10-50ms |