email.typo_domain
The domain looks like a one- or two-character typo of a major webmail provider.
What it looks at#
Compares the domain against a short, deliberately curated list of about two dozen major
webmail providers (gmail.com, outlook.com, yahoo.com, icloud.com, and similar) using
a restricted edit-distance algorithm (insertions, deletions, substitutions, and adjacent
transpositions, each costing 1). A match only fires if the domain isn’t already exactly one
of the list, and its distance to some entry is within both an absolute cap of 2 and a
relative cap of 20% of that entry’s length (minimum 1) — tight bounds chosen specifically to
avoid flagging domains that are legitimately different, not just short.
The list is short on purpose: every entry doubles as an exemption, so a longer list widens false positives as much as it widens typo coverage.
Why it matters#
gmial.com, gnail.com, and similar near-misses of a major provider are almost always
mistyped, not a real domain someone deliberately chose. An address there will typically
never receive a confirmation email, and the signup silently fails.
What to do#
Medium severity — treat as “confirm before trusting,” not an automatic block. The address may resolve to something (occasionally even mail-accepting), so a “did you mean gmail.com?” prompt at signup time serves the user better than a silent rejection.