email.role_account
The address's local part matches a known shared or automated mailbox name.
What it looks at#
Strips any +tag from the local part (so admin+test@x.com still matches admin),
lowercases it, and checks it against a fixed inline list of common shared and automated
mailbox names: admin, support, info, sales, contact, help, billing, abuse,
postmaster, hostmaster, webmaster, noreply/no-reply/donotreply, security,
privacy, legal, marketing, hr, jobs, careers, office, root, feedback,
enquiries/inquiries. This is a small, fixed list — not fetched or learned — so it will
miss organisation-specific role names it hasn’t been told about.
Why it matters#
A shared or automated mailbox is often not a person: it may be a placeholder nobody
monitors, an inbox that won’t receive a confirmation code in time, or a signal that whoever
submitted the form isn’t the account’s real owner. It is not conclusive on its own — some
legitimate teams genuinely sign up with a support@ address.
What to do#
Medium severity — treat as worth a second look, not an automatic block. Combine with other signals (does the domain match the company name, did the signup complete an email confirmation loop) before rejecting outright.