Established Emails API

Email age intelligence for fraud, trust, and risk teams.

Established Emails is an API for checking whether an email address has a minimum observed age. It is designed to be used as a positive anti-fraud signal: if an address appears in the dataset, your system can treat it as having existed no later than the returned year.

It does not claim an exact account creation date, and a missing record should not be treated as proof that an email is fraudulent.

Fraud teams often need lightweight signals that are fast, explainable, and easy to combine with an existing model or rules engine. Email age is useful because older observed addresses are often less disposable than brand-new signups.

Use cases include:

• Signup and onboarding risk scoring
• Checkout and payment review
• Account recovery controls
• Trial abuse and multi-account detection
• Trust and safety enrichment

The strongest use is as a positive signal: "this email has evidence of age." Absence of evidence should remain neutral unless your own model says otherwise.

Try the demo at establishedemails.com.

The demo lets security professionals enter an email address and see the normalized API response, minimum observed age wording, and beta domain classification.

GET /v1/email?email=<encoded-email>

Example:

curl "https://establishedemails.com/v1/email?email=analyst%40example.com"

Example response when a record is found:

{
 "found": true,
 "email": "analyst@example.com",
 "year": 2020,
 "classification": "mainstream"
}

Example response when no established-age record is found:

{
 "found": false,
 "email": "new@example.com",
 "year": null,
 "classification": "unknown"
}

The classification field is in development. It provides lightweight domain context and should not be used as a standalone fraud decision.

Current values:

• mainstream: common mailbox providers such as Gmail, Outlook, Yahoo, iCloud, Proton, Fastmail, and similar domains.
• privacy_relay: relay providers such as Apple Hide My Email, Firefox Relay, SimpleLogin, and DuckDuckGo Email Protection.
• disposable: domains present in the built-in disposable email list.
• suspicious: lightweight keyword-based hints in the local part or domain.
• unknown: no known classification.

Example invalid email response:

{
 "error": "invalid_email",
 "input": "not-an-email"
}

The API returns a year, not a precise creation timestamp.

If the response contains:

{
 "found": true,
 "year": 2020
}

the conservative interpretation is:

This email was observed no later than 2020.

For minimum-age calculations, use the end of the returned year as the latest possible observation date. For example, a year of 2020 means "at least as old as December 31, 2020" for conservative age-floor purposes.

async function getEmailAgeSignal(email) {
 const url = new URL("https://establishedemails.com/v1/email");
 url.searchParams.set("email", email);
 const response = await fetch(url, {
 headers: { Accept: "application/json" },
 });
 const body = await response.json();
 if (!response.ok) {
 throw new Error(body.error || `HTTP ${response.status}`);
 }
 return body;
}

Suggested decision logic:

• Treat found: true with an older year as a positive trust signal.
• Treat found: false as "no signal", not as a negative verdict.
• Combine classification with your own device, velocity, payment, IP, and behavioral signals.
• Keep a human-readable audit reason such as email_observed_since_2020.

Established Emails is a project by Joe Rutkowski.

• Email: Joe@dreggle.com
• GitHub: Joe12387
• LinkedIn: joe12387