# Changelog of Bulk Email Verifier & Finder - Mailbox Exists, SPF/DKIM/DMARC (`apivault_labs/email-deliverability-checker`) Actor

- **URL**: https://apify.com/apivault\_labs/email-deliverability-checker/changelog.md
- **Full Actor documentation**: https://apify.com/apivault\_labs/email-deliverability-checker.md

## Changelog

All notable changes to this Actor will be documented here.

### \[2.3] — 2026-07-30 — More reliable live mailbox check

#### Major improvements

- **New verification transport for the live mailbox check.** Reworked the
  SMTP-level acceptance check onto a more reliable keyless flow that returns a
  definitive verdict (exists / does not exist / catch-all) far more often, plus
  direct catch-all and disposable signals — no more guessing from a bare code.
- **Token fetched on our own IP, not the proxy.** A tiny one-time handshake keeps
  paid proxy traffic to the bare minimum (~1-2 KB per address) — only the small
  verification POSTs ride the proxy, ~100x less traffic than routing full pages.
- Keeps the curl\_cffi unique-TLS-fingerprint-per-request rotation from 2.2, so
  traffic isn't blocked as a bot; combined with exit-IP rotation on a residential
  proxy, coverage improves sharply.

### \[2.2] — 2026-07-30 — curl\_cffi TLS fingerprint rotation

#### Major improvements

- **curl\_cffi with browser impersonation.** Live mailbox check now uses curl\_cffi
  instead of httpx, rotating through real browser TLS fingerprints (Chrome 110-124)
  on every request. This defeats TLS fingerprinting that blocks bot traffic.
- **Reduced workers to 2.** Lower concurrency reduces rate-limit pressure on the
  backend, improving coverage from ~40% to ~60-65%.
- Each request gets a unique session with a random browser signature.

#### Technical changes

- Removed Safari/Edge fingerprints that caused connection failures.
- MailboxSession creates fresh curl\_cffi session per request (no shared httpx client).
- Added debug logging for timeout/connection errors.
- Increased timeout to 35s for slower proxy connections.

#### Test results (51 emails)

- Before curl\_cffi: 20/51 checked (40% coverage)
- After curl\_cffi + 2 workers: 30-33/51 checked (59-65% coverage)

### \[2.1] — 2026-07-30 — (superseded by 2.2)

### \[2.0] — 2026-07-30 — Bring-your-own residential proxy for full coverage

- **New `mailboxProxyUrl` input.** Supply a residential/ISP proxy and the live
  mailbox check routes through it, piercing the datacenter-IP block that stops
  the check from reaching a verdict for every address. Accepts
  `host:port`, `host:port:user:pass`, or `http://user:pass@host:port`; a numeric
  session id in the username (e.g. `…__anon.1`) is rotated automatically for
  fresh exit IPs. Stored as a secret. Traffic is tiny (~1 MB per ~1,000 checks).
- Parallel workers now spread across distinct rotating proxy sessions so each
  worker verifies from its own exit IP. With a rotating proxy the check uses a
  fresh exit IP per address and retries across sessions until it gets a verdict,
  so coverage stays high even though the backend rate-limits per IP.
- Falls back to the Apify datacenter proxy when no custom proxy is given.

### \[1.9] — 2026-07-30 — Accurate verdicts for unconfirmed mailboxes

- **Verdict now comes straight from the live-check code** (`ok` = exists,
  `ko` = does not exist, `ca` = catch-all, `mb` = unverifiable, `--` = error),
  instead of being inferred from the human-readable message. More reliable
  existence calls.
- **No more false "valid" for unconfirmed mailboxes.** If the live check can't
  reach a verdict — the server hides the result (`mb`/`--`) or the check
  couldn't complete — the address is now graded `unknown` / `verify-later`
  instead of a confident `valid`, and it isn't billed. Previously such an
  address could be returned as `valid` / `send` off its MX records alone.

### \[1.8] — 2026-07-30 — Fix: live mailbox check restored

- **Live mailbox verification works again.** The previous build used an outdated
  handshake with the live-check backend that had stopped responding; when it
  failed, the session was left without a working key and every mailbox check was
  silently skipped — `mailboxExists` / `mailboxStatus` came back blank for whole
  runs.
- Reworked the live-check transport to the current keyless method plus automatic
  datacenter-proxy exit-IP rotation to clear per-IP blocks, and removed the
  silent-skip path so checks always run.

### \[1.7] — 2026-07-30 — Routing decisions, campaign metrics, suppression export

- **`decision` field on every record** — one scalar your cadence tool, Zapier,
  Make or n8n can branch on: `send`, `send-monitor`, `verify-later`, `replace`,
  `suppress`, plus a plain-English `decisionReason`. No need to re-derive routing
  rules from the raw flags downstream. Added to the CSV export and the table view.
- **Compound role-address detection** — `info.chicago@`, `us.support@`,
  `sales-emea@`, `support_2@` are now flagged. Previously only exact matches like
  `info@` were caught.
- **Pre-send campaign metrics in `SUMMARY`** — `estimatedBounceRate`, `espSafe`
  (below the 2% threshold ESPs enforce), `recommendedSendVolume`, and a
  `decisions` breakdown.
- **`SUPPRESSION.txt` in the key-value store** — newline-delimited list of every
  address graded `suppress` or `replace`, ready to paste into an ESP suppression
  list.

### \[1.6] — 2026-07-30 — Disposable coverage 8.2k → 11.5k domains

- **Disposable detection now merges two maintained blocklists** instead of one.
  The lists overlap only partially, so unique coverage grows from ~8,200 to
  \~11,570 domains — catching throwaway mailboxes that previously slipped through
  (e.g. `ooter.nl`, `trashmail.fr`).
- Malformed lines are filtered out before merging; if either source is
  unreachable the other still applies, and the built-in set remains the floor.
  Still cached for 24h in the `email-verify-lists` store, so no extra latency
  on subsequent runs.

### \[1.5] — 2026-06-19 — Per-domain pacing + cross-domain auto-concurrency

- **Bulk speed**: mailbox checks now run **in parallel across different domains**
  while each single domain is paced politely (never hammered). `mailboxConcurrency: 0`
  (new default) **auto-scales workers to the number of distinct domains** — large
  multi-domain lists (CRM/Apollo/ZoomInfo exports) finish much faster and cheaper.
- Empty input now returns a clear info record instead of an empty dataset.

### \[1.4] — 2026-06-19 — Parallel speed, safeToSend, auto-correct, file input

- **`mailboxConcurrency`** — check mailboxes in parallel (each worker via its own
  proxy IP to dodge rate-limits) for much faster big-list runs.
- **`safeToSend`** — single yes/no flag (valid + not disposable/blacklisted/high-trap).
- **`autoCorrect`** — re-verifies a typo suggestion and reports `correctedEmail`
  when the fixed mailbox actually exists.
- **Disposable parent-domain matching** — catches sub-domains of throwaway services.
- **`fileUrl`** — load a CSV/TSV/text list of emails by URL.

### \[1.3] — 2026-06-19 — Three-event pricing

- Split billing into three pay-per-event charges: **`result`** (one verified
  email), **`found`** (a confirmed email from the Finder — only charged when a
  mailbox is actually found), and **`domain-auth`** (SPF/DKIM/DMARC audit, billed
  once per unique domain). Catch-all / unknown / not-found stay free.

### \[1.2] — 2026-06-19 — MCP/Standby, smarter Finder, fresh lists

#### Added

- **Standby + MCP server** — run the Actor as an HTTP/MCP endpoint for AI lead-gen
  agents (Claude/Cursor/OpenAI). Tools: **`verify_email`** and **`find_email`**;
  REST `GET /?email=…` or `/?name=…&domain=…`. Charges per definitive verdict.
- **Smarter Finder**: resolves a **company name → domain** (keyless search),
  detects the **company email pattern** from any `knownContacts`, and returns a
  **confidence** score on the found address.
- **Auto-updating disposable list** — merges a maintained public blocklist
  (cached daily) so disposable detection stays fresh without redeploys.

### \[1.1] — 2026-06-19 — Sender-reputation, greylisting, no-double-charge

#### Added

- **DNS blacklist (DNSBL) check** — flags domains listed on Spamhaus DBL / SURBL
  (`blacklisted`, `blacklists`). Best-effort over DoH; public-resolver block
  codes are treated as inconclusive (no false positives).
- **Spam-trap risk heuristic** (`spamTrapRisk`: low/medium/high + reason) from
  disposable / trap-style names / blacklist / role signals. (Transparent
  heuristic — not a proprietary honeypot database.)
- **Greylisting-aware retries** (`greylistRetries`, `greylistBackoffSecs`) —
  retries temporary-failure ("unknown") mailboxes after a backoff to convert
  them into definitive valid/invalid verdicts.
- **Verdict cache / no double charge** (`cacheDays`) — addresses verified within
  N days are returned from a private KV store instantly and **not charged again**.
- **List-quality report** — final summary record with an A–F grade, deliverable %,
  full breakdown (valid/risky/invalid/catch-all/disposable/role) and billed count.
- **Internationalized email (IDN / RFC 6530)** — Unicode domains validated via
  punycode.
- GDPR/privacy note in the run summary (addresses processed in-memory, not stored).

### \[1.0] — 2026-06-16

#### Added — initial release

- **Email Finder** — given a person's name + company domain, tries common address
  patterns and returns the one the mail server accepts (`found` / `catch_all_guess`
  / `not_found`); pass-through of any extra input columns.
- **Live mailbox check** — confirms at the destination mail server whether each
  address is accepted, rejected or catch-all (`mailboxExists` / `mailboxStatus`):
  a real existence check, not just syntax/MX. Paced to respect rate limits.
- Bulk email verification over DNS-over-HTTPS and public HTTP (no login, no keys):
  syntax (RFC-aware), MX / domain deliverability, mail-provider
  detection, free / role / disposable flags, typo suggestions, de-duplication and
  a 0-100 deliverability score with human-readable reasons.
- **Sender authentication audit** per domain: SPF, DKIM (with detected selector)
  and DMARC (with policy).
- **Gravatar identity signal** — flags addresses that have a public Gravatar
  (a strong "real, used inbox" signal).
- Filters (only valid / only deliverable / drop disposable / drop role-based)
  and CSV-friendly export.
- Gibberish (random local-part) detection; free / role / disposable flags.
- Billing: you only pay for a definitive verdict (valid / invalid / found).
  Catch-all, risky and unknown results are not charged.