Brokerage CDP · Layer 2 · email identity & hygiene

One typo, three ways to catch it.
A hygiene system only a mailbox can finish.

A bad email (@website.con) or a silently-typo'd one is dead weight in a CRM. It can be repaired in layers that get more confident and more Cloze-native as they go, while the cost stays near zero. The last layer is the one an importer structurally can't build, because it runs on the mailbox. Layers 1 and 2 are built and running in the resolver, behind a regression gate; the results below are from their first live runs.

Confidence
rises ↑
Value to the agent
rises ↑
Cloze-native
rises ↑
Cost
flat ≈ $0

Every layer proposes a fix; a human confirms. Nothing is silently rewritten, because a wrong email correction sends the next touch to the wrong person.

1
at import · instant

Fix on arrival

deterministic · offlinebuilt

Check each address's domain against the list of real TLDs plus a short dictionary of major-provider typos. Broken domains with an obvious intended target get a proposed correction on the spot. And when a proposed fix would make two records' emails identical, the pair surfaces for human review; an unconfirmed fix can never drive an auto-merge.

free · no network high confidence robert@website.con → propose .com jen@gmial.com → propose gmail

First live run

Validates against the full IANA registry (1,437 real TLDs, snapshotted so the check stays offline). On a 59-row realistic import: zero false flags. On the adversarial set: caught dana.wu@gmial.com, proposed gmail.com, and surfaced its hidden duplicate for review. The .co guard is structural: the typo dictionary is only consulted after the real-TLD check fails, so a real TLD can never be “corrected.”
2
overnight · hours

Confirm in the background

DNS passbuilt

Ask DNS whether each domain actually accepts mail (an MX lookup). This catches dead and malformed domains the Layer-1 list would miss. A raw MX query is free and self-hosted; cache by domain so thousands of contacts collapse to a few hundred lookups.

free · cache by domain definitive at domain level website.con → no mail servers → flag

First live run

The “free” claim is literal: the whole DNS protocol is about 80 lines of standard library, one UDP packet per domain. It caught a dead domain Layer 1 passes cleanly (a real TLD, no typo; only DNS can know it takes no mail), and it verified Layer 1's proposed gmail.com target accepts mail: the layers corroborate instead of overlapping. Precision rule: a DNS timeout or server error is never flagged; infrastructure noise must not read as a data-quality accusation.
3
continuous

Reconcile against the mailbox

the moatdesigned · needs the mailbox

Match a silent stored address (one that never gets mail) against a live orphaned address seen in real correspondence. The mail traffic is the tie-breaker string similarity never has: one address demonstrably works and this person demonstrably uses it. Propose the live one.

Signals only a mailbox-native CRM has

  • Bidirectional reply (proves a live human; reuses relationship scoring)
  • Envelope name "Robert Tran <rtran@…>" binds name↔address free
  • Salutation / signature ("Hi Robert"), an LLM / Maia job
  • Same thread as the real address = near-proof
  • Weight personal domains (gmail / outlook / icloud)
  • Auto-drop noreply & automated senders
free · Cloze already has the data high when signals stack
An importer is a batch CSV job. It can't do Layer 3: no mail history, no relationship graph. Cloze has both.
So this isn't a bolt-on. It runs on Cloze's actual moat, the real mailbox, and it answers the resolver's own open limit: people have several addresses, and traffic reveals them. Propose, never rewrite.

Brokerage CDP · Layer 2 (entity resolution & hygiene) · companion to the import bake-off findings · designed 2026 · Layers 1 and 2 built, run live, and regression-gated · Layer 3 awaits what only the mailbox has