github.com/AfterShip/email-verifier

v1.5.0

A reported vulnerability in this library, two more reachable from Verify through its dependencies, a crash reachable from AddDisposableDomains, and the domain lists rebuilt from sources that had stopped being what they claimed. Requires Go 1.25.

Before you upgrade

Go 1.25 or newer is required. The versions of golang.org/x/net and golang.org/x/text that carry the fixes below require it. Supported versions are now the three most recent Go releases; CI covers all three.

YAHOO is gone. emailverifier.YAHOO no longer compiles. The Yahoo API verifier it selected had stopped working — Yahoo removed the endpoint it relied on — so EnableAPIVerifier(YAHOO) was returning success for a check that could not run. Remove the call; there is no replacement.

LookupError has an unexported field. It still compiles, but comparing a whole LookupError against a literal no longer matches. Compare Message, or use errors.Is/errors.As, which now reach the underlying error. This is the same change that fixes GHSA-c2j9-vjcj-qrjc below.

Security

• A nil-pointer dereference through a typed-nil *LookupError (GHSA-c2j9-vjcj-qrjc) — ParseSMTPError could return a nil *LookupError for a non-nil input. Assigned to an error, that is a non-nil interface holding a nil pointer, and calling Error() on it panics. Affects <= 1.4.1; v1.5.0 is the first release carrying the fix, which had landed before the report arrived. (#202)
• golang.org/x/text infinite loop (GO-2026-5970) — reachable from Verify, CheckMX and CheckSMTP through idna.ToASCII. The argument is the address under test, so an address chosen by whoever is being verified could hang the goroutine verifying it. (#212)
• golang.org/x/net/idna accepting ASCII-only Punycode labels (GO-2026-5026) — same path. (#212)

Fixed

• AddDisposableDomains racing the auto-update refresh. Calling it from another goroutine while EnableAutoUpdateDisposable()'s refresh was running was a fatal error: concurrent map iteration and map write — the process goes down and no recover catches it. (#211)
• EnableAutoUpdateDisposable() used to gut the disposable list. The baked-in list and the one fetched at runtime came from different upstreams sharing 28% of their entries, and the refresh deletes whatever the fetched list omits. The first refresh replaced most of the list; it is now a no-op. (#208)
• IsRoleAccount("cto") returned false. cto, ctos, cfo and cfos were added to the source list in December 2025 and the generated map was never rebuilt. (#205)
• IsFreeDomain("atlanticbb.net") returned false. The generated key carried a stray no-break space from an upstream entry. (#207)
• Verify discarded the SMTP result when the exchange failed partway. SMTP came back nil, which could not distinguish a host that never answered from one that answered and refused the sender. It is now kept, whether or not the check succeeded. (#201)
• Reachable was unknown for a domain whose MX lookup says no such host. It is no now, and Verify returns ErrNoSuchHost. (#139)
• Suggestion was empty for disposable domains, which returned early before the suggestion was computed. (#140)

Changed

These change what the library answers without needing any change to your code. Counts are against v1.4.1; both lists also moved in commits that never reached a release, so the deltas are larger than any single change here.

• IsDisposable: 121,862 domains to 75,258 — 40,392 added, 86,996 removed — the generated list now coming from the same source the runtime refresh fetches. Sampled, the removals are overwhelmingly domains that no longer resolve at all, and all 20 well-known throwaway services checked are still reported disposable. (#208)
• IsFreeDomain and SuggestDomain: 6,482 domains to 4,535 — 110 added, 2,057 removed. Two sources that carried throwaway domains under a free label are gone: one dropped in #169, which accounts for 2,009 of the removals, and the other, which had begun merging disposable blocklists into its own output, replaced here by the sources it aggregates. Of the additions, 96 are carrier and portal mailboxes recognised for the first time — docomo.ne.jp, ocn.ne.jp, kakao.com, chollian.net, aol.co.uk and proton.me among them — and the remaining 14 are providers the previous sources had missed, including duck.com, mailfence.com and zohomail.com. (#207, #169)
• A small allowlist keeps real providers the upstream disposable list misclassifies out of it: hush.com, lavabit.com, mail2world.com, qmail.com, 4x4man.com, alphafrau.de. (#209)
• IsRoleAccount: 888 role names to 892, none removed. (#205)

Added

• Resolver() sets a custom *net.Resolver for MX and SMTP host lookups. (#191)

Internal

• cmd/build_metadata/update.sh no longer publishes a truncated or empty list when a fetch fails, and refuses to publish when a list falls outside expected bounds. (#206)
• golangci-lint v2.13.2, actions/checkout v7, actions/setup-go v7, golangci-lint-action v9. (#212)
• A panic in the Yahoo API test no longer aborts the suite, which had been skipping 47 tests since December 2025. (#196)