The disclosure is directed to email addressee verification. A method in accordance with an embodiment includes: obtaining an email message including at least one email address; evaluating each email address of the email message against at least one email rule, and assigning a score to each email address based on the evaluation; and comparing the score assigned to each email address to a threshold, and flagging any suspect email address based on the comparison.