Draw the data flow

List every place the submitted address can go: browser, application logs, queue payload, database, cache, DNS resolver, SMTP egress, third-party provider, analytics, support tools, and backups. Remove destinations that are not necessary for the user’s requested check. A generic analytics event should not contain the address or a reversible query string.

Explain what the service actually does before submission: syntax/DNS only, provider lookup, or authorized SMTP interaction. Name material third-party processing and link to the approved privacy notice. Do not promise mailbox existence when the technique cannot establish it.

Design the form and response

Use POST with CSRF protection, server-side validation, bounded length, and autocomplete appropriate to the workflow. Never place the address in a GET URL. Normalize only under a documented comparison policy and preserve the submitted form where needed for sending.

Return the same shape and similar timing regardless of whether the address belongs to an existing Deliverlens account. A public verification tool should not reveal customer status, suppression status, complaint history, or previous checks.

Bound network and cost

Perform local syntax checks first. Queue permitted network work with per-session, account, IP, domain, and global quotas; concurrency and timeout caps; idempotency; and circuit breakers. Require stronger authorization for bulk checks. Do not let a browser choose targets, ports, or provider credentials.

Store report capabilities as unguessable expiring secrets, preferably hashed at rest. Avoid including the address in capability URLs, logs, page titles, or referrers. Make reports noindex, no-store, and private by capability/account.

Minimize retention

Where possible, retain a keyed digest for deduplication and an encrypted value only for the short period needed to perform the check. Define deletion for inputs, results, queue failures, caches, provider copies, and backups. Give operators redacted evidence by default.

Test abuse and failure

Verify generic responses, rate limits, storage/log redaction, provider outages, cancellation, expiry, and deletion. Inspect browser network traffic for direct provider/API calls. A privacy-aware form is complete when it can answer the stated user task without becoming an address-enumeration oracle or an unbounded network proxy.