I don't know if we can make the API consistent between parseaddr and the parsing header value since they are completely different even right now. Like you already noticed there is no way to register defects and instead parseaddr returns ('', '') to denote the failure to parse.

About parsing malicious domain, my line of thinking was along the lines of presenting whatever is there to user of the API, without 'hiding' that information. It would be harder to figure out the exception if the domain is missing. 

Even though the domain is parsed in the `domain` value, the value itself is clearly invalid. Any attempt to ever use that Address() will definitely cause an error (perhaps, there should be a sanity check in SMTP.send_message for that?).