- 1. Purpose and applicability of Acceptable Use Policy
- 2. Prohibited list acquisition methodologies
- 3. Prohibited activities and network abuse
- 4. Compliance with global anti-spam regulations
- 5. Monitoring, abuse detection & heuristic rate limiting
- 6. Investigation, notice & immediate termination
- 7. Reporting violations & network operator contact
- 8. Frequently asked acceptable use questions
1. Purpose and applicability of Acceptable Use Policy
The integrity of MailCheckup's verification engine depends on maintaining pristine network reputations across our distributed Port 25 edge dialers. If our dialers are used to test abusive, harvested, or dictionary-generated email lists, remote Mail Transfer Agents (MTAs) at major providers (including Google Workspace, Microsoft 365, Yahoo, and Fastmail) will throttle or block our probes, harming service availability for all legitimate users.
This Policy applies universally to all account tiers, API integrations, web application sessions, batch CSV processing runs, and Model Context Protocol (MCP) tool executions.
2. Prohibited list acquisition methodologies
You agree NOT to submit for verification, upload, or query any email addresses acquired through:
- Automated Web Scraping: Harvesting email addresses from websites, social media profiles, discussion forums, or open directories using automated spiders or scrapers without express consent.
- Dictionary & Permutation Attacks: Generating email addresses by systematically combining first names, last names, initials, and alphanumeric sequences (e.g.,
john1@company.com,john2@company.com) to probe whether a mailbox exists. - Purchased Mass Marketing CD-ROMs & Unverified Dumps: Uploading third-party bulk marketing lists purchased from unverified vendors, consumer list brokers, or dark web credential dumps.
- Deceptive Sign-up Opt-ins: Acquiring contact lists through co-registration offers where consent was obscured, deceptive, or coerced.
3. Prohibited activities and network abuse
The following technical activities are strictly prohibited:
- Port 25 Denial-of-Service (DoS): Flooding remote mail servers with excessive connection attempts intended to exhaust remote sockets or cause denial-of-service.
- Reverse Engineering: Decompiling, reverse engineering, or disassembling MailCheckup's verification algorithms, radix-tree blocklists, or heuristic probes.
- Credential Sharing & Sublicensing: Sharing, renting, or sublicensing API keys to unaffiliated third parties without an executed enterprise contract.
- Circumventing Rate Limits: Utilizing distributed proxies or multiple fraudulent trial accounts to bypass concurrency limits or pricing tiers.
- Forged Envelopes: Attempting to forge SMTP envelope metadata or falsify originating domain information during API queries.
4. Compliance with global anti-spam regulations
Customer warrants that its email communications comply with all applicable anti-spam and commercial communications statutes in every jurisdiction where recipients reside, including:
- United States: CAN-SPAM Act (15 U.S.C. § 7701 et seq.)
- Canada: Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23)
- European Union: Directive 2002/58/EC (ePrivacy Directive) and Regulation (EU) 2016/679 (GDPR)
- United Kingdom: Privacy and Electronic Communications Regulations 2003 (PECR)
- Australia: Spam Act 2003 (Cth)
5. Monitoring, abuse detection & heuristic rate limiting
To preserve infrastructure availability, MailCheckup deploys automated heuristic anomaly detection. Our algorithms monitor list entropy, invalid address ratios, and sequential username permutations.
If an uploaded batch exhibits characteristics consistent with a dictionary attack (e.g. over 85% invalid rate with alphabetical username patterns), our automated circuit breaker immediately freezes the verification run, pauses the workspace API key, and flags the job for engineering review.
6. Investigation, notice & immediate termination
Secuno LLC reserves the right to immediately suspend or permanently terminate any account that violates this Policy. In cases of malicious intent (such as automated dictionary scanning or intentional mail server flooding), suspension is immediate and permanent, and any unconsumed credit balance is forfeited without refund.
In cases of accidental configuration errors or inadvertent list contamination, our compliance desk will issue a formal inquiry providing 24 hours to clarify list provenance before final disposition.
7. Reporting violations & network operator contact
We work collaboratively with email service providers, postmasters, and network security teams. If you are a mail server administrator and observe anomalous queries originating from our network, email abuse@mailcheckup.net with complete SMTP logs and headers.
Our engineering team will identify the responsible API key, terminate the offending job, and place your destination domain on our global internal suppression blocklist if requested.
The table below summarizes permitted versus prohibited activities under this Policy:
| Usage Category | Permitted Status | Compliance Rationale | Enforcement Mechanism |
|---|---|---|---|
| First-Party Opt-in Lists | Permitted | Explicit consent obtained under GDPR / CAN-SPAM | Normal processing flow |
| CRM / Invoiced Contacts | Permitted | Existing customer relationship established | Standard rate limits |
| Legitimate B2B Outreach | Permitted | Verifiable commercial legitimate interest | Standard rate limits |
| Scraped Web Directories | PROHIBITED | Harvested without consent or relationship | Account termination & credit forfeiture |
| Dictionary Permutations | PROHIBITED | Sequential brute-force namespace scanning | Instant automated circuit-breaker freeze |
| Purchased CD-ROM Broker Dumps | PROHIBITED | Unverified third-party data broker sourcing | Immediate list rejection |
| Port 25 DoS Flooding | PROHIBITED | Denial-of-service against destination MTAs | Permanent IP & workspace ban + legal referral |
8. Frequently asked acceptable use questions
Can I verify cold sales outreach lists under this policy?
Yes, provided the addresses represent legitimate B2B business prospects where your organization possesses a verifiable legitimate interest or consent under applicable law. However, you may NOT upload lists acquired from scraped web directories, purchased mass marketing CD-ROMs, or unconsented consumer harvesting.
What constitutes a dictionary brute-force attack on MailCheckup?
Submitting sequential, algorithmically generated email permutations (e.g. user001@example.com, user002@example.com, alex.a@domain.com, alex.b@domain.com) to discover valid mailboxes constitutes dictionary harvesting and will trigger an immediate permanent API key suspension.
Are shared API keys permitted across multiple organizations?
No. API keys are strictly assigned to a single customer workspace. Reselling, sublicensing, or sharing access credentials across multiple unaffiliated entities without an executed reseller or enterprise agreement violates Section 3 of this Policy.
What happens if my account is suspended for an AUP violation?
Accounts suspended for intentional network abuse, dictionary scanning, or illegal spamming forfeit all remaining unconsumed credits and access rights. Unintentional formatting errors or legitimate testing anomalies may be appealed by contacting abuse@mailcheckup.net.
What are the rate limit thresholds for API verification?
Standard production REST API keys support up to 50 concurrent requests and 100 requests per second. Burst requests exceeding these thresholds receive HTTP 429 Too Many Requests responses with Retry-After headers.
How do external network operators report mail server abuse?
Mail system administrators and internet service providers encountering anomalous socket queries from MailCheckup dialers should email abuse@mailcheckup.net with IP addresses and log timestamps for immediate investigation and source domain suppression.