Risk Decision vs Email Verification: Two Different Questions

People often use "verified" and "safe to send" as if they meant the same thing. They do not. Email verification tries to answer one question: does this mailbox exist and accept mail? A risk decision answers another: given what we can see, should this address go into the campaign?

The two overlap, but neither replaces the other. An address can exist and still be a poor choice. An address can look low-risk and still not exist.

This article explains the difference, why outbound teams need both, and how to treat guessed email addresses while they are still unverified.

The Core Problem in This Specific Scenario

Modern prospecting produces a lot of guessed addresses. You find a named person on a company's team page. You know the company uses first.last@ for other staff. So you write down jane.doe@company.com.

That guess might be right. It might also be wrong because Jane uses a nickname, because the company changed formats, or because she left last spring.

Teams then run the guess through some kind of check and see a green label. They read that label as proof. But many checks only look at the domain: does it exist, does it have mail records, is it on a disposable list? Those signals say nothing about whether Jane's particular mailbox is real.

The opposite mistake also happens. A tool confirms that a mailbox accepts mail, and the team sends without asking any other question. Yet the address may be a shared inbox read by nobody, or a catch-all domain that accepts everything and sorts it later.

Mixing up the two questions leads to bounces on one side and wasted sends on the other.

A Targeted Way to Solve It

Separate the questions, answer each one on its own terms, and combine them only at the end.

Question 1: Does the mailbox exist?

This is email verification. The aim is to confirm that a specific address can receive mail. It is the right tool for catching a wrong guess, such as jdoe@ instead of jane.doe@.

Secwyn does not offer mailbox verification today. Email verification is coming soon. Until it ships, any work email that Secwyn suggests from a pattern is labeled unverified, and you should treat it that way.

Question 2: Should we send to it?

This is the risk decision. In Secwyn, checking an email address or domain uses Audit credits and returns a risk score plus one decision: Send, Review, or Block.

The decision is based on signals like the domain's mail setup, disposable or temporary domain patterns, and role patterns such as info@ or sales@. It routes the address. It is not a guarantee of delivery and not proof that the mailbox exists.

How to use it day to day is covered in contact risk scoring before outreach.

Combining the two

Think of a simple grid:

• Low risk, verified: the strongest case. Send under normal rules.
• Low risk, unverified: the domain looks fine, but the specific mailbox is a guess. Send at a modest pace and watch for bounces.
• Uncertain risk (Review): look before sending, whether verified or not. A verified shared inbox may still be the wrong target.
• High risk (Block): do not send, even if a mailbox appears to exist.

How to treat guessed emails today

While verification is not yet available in Secwyn, use this routine for pattern guesses:

1. Confirm the person. Make sure the name came from the company's own website and the role fits your offer. Secwyn finds named people on the company site for companies you have revealed.
2. Check the pattern. If the company publishes any staff email on its site, compare it with the suggested pattern.
3. Run the risk check. Drop Block results and review the Review results by hand.
4. Send small first. Start with a few guesses per company. If one bounces, pause the rest at that company.
5. Use other channels when unsure. The company reveal shows the LinkedIn company page, the site's contact page, and the main phone number on the site.

Steps like these fit inside the broader pre-send audit for cold email.

Where This Approach Fits — and Where It Does Not

This two-question model fits any outreach that relies on addresses you did not get directly from the recipient. Pattern guesses, scraped team pages, and older lists all benefit from it.

It matters most when you send from your own mailbox. In Secwyn's managed outreach, emails go from your Gmail or Google Workspace account, with daily per-mailbox limits that ramp up for new mailboxes. Bounces from bad guesses count against that same mailbox, so keeping both questions in view protects it.

It does not fit as a substitute for good targeting. A real, low-risk address at a company with no need for your offer is still a wasted send.

It also does not settle legal or consent questions. Whether you may contact someone is decided by your own policies and the rules that apply to you, not by a check.

Common Misconceptions

"Verified means safe to send." A verified mailbox can still be a role inbox, a catch-all, or the wrong person. Verification answers existence, not suitability.

"Send means verified." A Send decision means no strong risk signals were found. It does not prove the mailbox exists. That is especially important for guessed addresses.

"If the domain is fine, every guess at that domain is fine." A healthy domain tells you mail can reach the company. It tells you nothing about whether a specific name and format are right.

"Unverified addresses should never be used." They can be used carefully: low volume, risk-checked, with a fallback channel ready. Throwing them all out often leaves no way to reach the right person.

Frequently Asked Questions

What is the main difference between a risk decision and email verification?

Verification checks whether a specific mailbox exists. A risk decision weighs signals about the address and domain and tells you whether to Send, Review, or Block. One is about existence; the other is about whether to act.

Does Secwyn verify mailboxes today?

No. Email verification is coming soon. Suggested work emails are marked unverified, and the current address check returns a risk decision, not mailbox proof.

Why do I need a risk decision if I will verify later?

Verification will not flag every concern. A disposable domain or a role inbox can still accept mail. The risk decision catches those patterns and tells you how to route them.

How should I send to unverified guesses?

Risk-check them first, keep Send results, and review the rest by hand. Start with a small number per company and stop if a bounce comes back.

Can a Block address still belong to a real company?

Yes. Block reflects strong risk signals about the address or domain. If the company is still a good fit, reach it through its contact page, main phone, or LinkedIn company page.

Where do I run a risk check?

Use the risk check page for a single address or domain, or the web bulk check for a list with CSV or XLSX download. Credit details are on the pricing page.