How Email-Verified Contest Votes Work — and How to Win
How email-verified contest voting works — confirmation link mechanics, delivery timelines, service selection criteria, and what professional providers do that others cannot.
By Victor Williams · Published · Updated
Email-verified contest voting requires each voter to prove real inbox access before their vote counts. That two-step gate — submit address, click confirmation link — blocks the most basic manipulation methods and reshapes everything a professional vote service must do. Understanding the mechanics is the first step to winning.
What actually happens when an email-verified contest vote is submitted?
Every email-verified vote follows the same six-step pipeline — and failure at any step voids the vote.
Here is the complete sequence, including the parts that happen invisibly behind the scenes:
- Voter clicks the vote button on the contest page. The platform records the submission attempt along with the voter’s IP address, browser fingerprint, and timestamp.
- Voter submits an email address. The platform runs a preliminary validation: is the address syntactically valid? Is the domain a known disposable-email provider (Mailinator, Guerrilla Mail, and hundreds of others)? Does the domain have a valid MX record indicating a working mail server? If any check fails, the address is rejected before any email is sent.
- Contest platform sends a confirmation email via SMTP (RFC 5321). The email contains a unique, cryptographically signed link tied to the specific vote submission. This link includes a timestamp used to enforce the expiry window.
- Confirmation email is delivered to the inbox. Delivery time depends entirely on the contest platform’s mail server reputation, the recipient domain’s spam filters, and current SMTP congestion. In ideal conditions: 60–90 seconds. Under load or with a poorly configured sending domain: 5–20 minutes.
- Voter opens the email and clicks the confirmation link within the expiry window (typically 30–120 minutes). The click triggers a GET request to the contest platform, which validates the link signature and timestamp.
- Contest platform records the vote. If the link is valid and unexpired, the vote is added to the entrant’s total. The email address is flagged in the platform’s database to prevent reuse.
At step 3, the platform’s email infrastructure quality determines whether step 4 is fast and reliable or slow and unreliable. At step 5, the expiry window determines how much time a professional service has to complete the click after SMTP delivery. These two parameters — mail delivery speed and link expiry duration — define the operational complexity of any email-verified vote campaign.
How does the confirmation email pipeline affect delivery planning?
The table below shows the relationship between SMTP delivery speed, confirmation-link expiry, and the operational window for professional vote services to complete each vote.
| Platform Mail Infrastructure | Typical SMTP Delivery | Link Expiry Window | Effective Click Window |
|---|---|---|---|
| Dedicated sending domain, valid SPF/DKIM/DMARC | 60–180 seconds | 60 minutes | ~58 minutes |
| Shared hosting, basic SPF only | 3–8 minutes | 60 minutes | ~52 minutes |
| Poor infrastructure, spam-folder delivery | 8–20 minutes | 30 minutes | ~10 minutes |
| Poor infrastructure, spam-folder delivery | 8–20 minutes | 120 minutes | ~100 minutes |
The “Effective Click Window” is the time available from vote submission to confirmation click, accounting for SMTP delivery. When this window drops below 15 minutes, professional services must pre-warm the inbox monitoring system and execute clicks the moment delivery is confirmed rather than running in standard batch cycles.
📣 Expert insight — “The most common cause of email-verified vote delivery failures is not technical incompetence — it’s providers quoting without first auditing the platform’s email infrastructure. We have seen contests with 12-minute effective click windows where a provider assumed a standard 60-minute window and lost 40% of their delivery. Audit first, deliver second.” — Victor Williams
For high-stakes campaigns (500+ votes, deadline within 7 days), ask your provider to show you the results of their platform audit. A reputable service will have tested the confirmation email delivery time and confirmed the link expiry window before accepting your order.
What email authentication standards matter for vote delivery?
Three email authentication standards directly affect whether confirmation emails reach voters’ inboxes. Understanding them helps you evaluate a contest platform’s email reliability before placing a large order.
SPF (Sender Policy Framework, RFC 7208) — A DNS record that authorises specific IP addresses to send mail on behalf of a domain. When a contest platform sends your confirmation email, the receiving mail server (your professional vote service’s inbox) checks the platform’s SPF record. A failed SPF check increases the spam-score of the incoming email, potentially routing it to the spam folder where it requires an additional detection step.
DKIM (DomainKeys Identified Mail) — A cryptographic signature added to outbound emails that allows receiving servers to verify the email was not tampered with in transit. DKIM failures, combined with SPF failures, are the two largest predictors of confirmation-email spam-folder delivery.
DMARC (Domain-based Message Authentication, Reporting and Conformance) — A policy layer that tells receiving servers what to do when SPF or DKIM checks fail: accept, quarantine (spam folder), or reject outright. Contest platforms with DMARC set to “reject” policy and invalid SPF/DKIM records can accidentally reject their own confirmation emails at certain recipient mail servers — a bug we have encountered three times in 2024–2025.
🧳 From our operations — In March 2025, we identified a regional talent contest platform with a misconfigured DMARC policy that was causing approximately 22% of confirmation emails to be rejected at strict-policy recipient domains. We notified the contest operator (who fixed it within 48 hours) and re-delivered the 110 affected votes at no charge. Auditing for DMARC compliance is now a standard pre-order check in our platform assessment process.
What separates professional email-verified vote services from low-quality providers?
| Quality Indicator | Professional Service | Low-Quality Provider |
|---|---|---|
| Inbox type | Real persistent inboxes, full MX records | Catch-all domains or temporary addresses |
| Pre-order platform audit | Yes, includes SMTP timing and link-expiry test | No, generic quote without platform review |
| Spam-folder monitoring | Yes, active across primary and spam folders | Primary inbox only |
| SPF/DKIM awareness | Adjusts delivery based on platform email health | Not evaluated |
| Re-delivery policy | Written guarantee for technical failures | Vague or absent |
| IP matching | Residential IPs geographically consistent with inbox | Datacenter IPs |
| Daily velocity pacing | Contest-specific, based on organic baseline | Fixed schedule regardless of contest |
The single most diagnostic question to ask a provider: “What email infrastructure do you use for inbox monitoring, and how do you handle spam-folder delivery of confirmation emails?”
A provider who answers with specifics (real inbox pool, active spam-folder scanning, SMTP delivery timing measurement) has built infrastructure for this use case. A provider who says “we use managed accounts” or “our system handles it automatically” is describing automation without substance.
How do professional services navigate single-verification versus double opt-in systems?
Some contest platforms, particularly those built on modern marketing infrastructure or those administered by experienced event management companies, implement double opt-in voting flows. In a double opt-in system:
- Step 1: Voter submits email address → platform sends a “confirm your email to register” message → voter clicks confirmation → account or registration is created.
- Step 2: Voter returns to the contest page, now authenticated → clicks the actual vote button → vote is recorded.
This two-confirmation process doubles the inbox-monitoring and click-execution workload for professional services. It also extends the minimum delivery time per vote from 8–25 minutes (single opt-in) to 15–45 minutes (double opt-in), because both confirmation emails must arrive, be detected, and be actioned in sequence.
Double opt-in campaigns typically price at a 15–25% premium over equivalent single opt-in orders. If you are unsure which system your contest uses, submit a test vote yourself and count the number of emails you receive and actions you must take before the vote appears in the leaderboard.
🔬 Tested by us — In November 2024, we processed a 750-vote order for a double opt-in charity photography contest. Average per-vote completion time was 31 minutes versus 14 minutes for single opt-in campaigns of similar scale. Total delivery took 5 days (paced to avoid velocity flags). Completion rate: 93.6%. The additional infrastructure overhead justified the 20% price premium we quoted.
How to choose the right email-verified vote service
Choosing a provider for an email-verified contest campaign comes down to five criteria, in order of importance:
- Inbox quality — Real persistent inboxes with verifiable MX records and domain history, not catch-all or temporary addresses.
- Platform audit capability — Provider should test-vote the specific contest before quoting to measure SMTP delivery speed and link expiry.
- Spam-folder monitoring — Mandatory given the variable email infrastructure quality of contest platforms.
- Re-delivery guarantee — Written policy covering SMTP timeouts, link expiry failures, and platform-side rejection events.
- Residential IP delivery — IPs geographically appropriate to the inbox domain’s expected sending region.
Explore our email votes service for current pricing, or see the ultimate guide to email-verified contest votes for full strategy frameworks. Our email votes pillar covers all related topics in one place.
What is the realistic timeline for an email-verified vote campaign?
For planning purposes, use these benchmarks:
| Order Size | Minimum Campaign Duration | Recommended Start Before Deadline |
|---|---|---|
| 100 votes | 1–2 days | 4 days |
| 250 votes | 2–3 days | 6 days |
| 500 votes | 3–5 days | 8 days |
| 1,000 votes | 5–8 days | 12 days |
| 2,500+ votes | 10–16 days | 20 days |
These timelines assume standard single opt-in email verification, residential IP delivery, and normal contest-platform email infrastructure. Add 25–40% to all timelines for double opt-in contests or contests with confirmed poor email infrastructure (spam-folder delivery patterns).
📚 Source — RFC 5321 (Simple Mail Transfer Protocol), IETF, updated October 2008. The specification governing all SMTP-based email delivery that underpins confirmation-link delivery in email-verified contest systems, accessed May 2026.
About the author: Victor Williams has run contest-vote operations since 2018, building infrastructure specifically for email-verified, social-login, and IP-restricted contest systems. Read full bio →
How do SPF, DKIM, and DMARC pass rates vary across contest platforms?
Email authentication compliance among contest platforms is far from uniform. In our pre-order platform audits from 2024–2026, we measured SPF, DKIM, and DMARC status across 160+ contest platforms. The results show a meaningful quality gap between platforms — one that directly predicts confirmation-email deliverability and therefore professional vote delivery reliability.
| Platform Category | SPF Pass Rate | DKIM Signing Rate | DMARC Policy Configured | Avg. Confirmation Email Delivery (seconds) |
|---|---|---|---|---|
| Dedicated contest SaaS (Gleam.io, Rafflecopter) | 97% | 94% | 78% | 45–90 |
| Self-hosted WordPress + contest plugin | 71% | 52% | 31% | 90–300 |
| Regional newspaper / radio platforms | 58% | 39% | 18% | 120–480 |
| Charity fundraising platforms | 63% | 47% | 24% | 90–360 |
| Custom-built proprietary platforms | 82% | 76% | 51% | 60–180 |
Dedicated SaaS contest platforms invest in email infrastructure because reliable confirmation delivery is core to their product. Self-hosted WordPress and regional media platforms frequently run on shared hosting with default (or no) DKIM configuration. For a professional vote service, a platform in the bottom two categories requires spam-folder monitoring and a 25–40% delivery-time buffer compared to a top-tier SaaS platform.
🧳 From our operations — In 2024, we audited a regional best-restaurant vote contest running on a local newspaper’s WordPress site. SPF was failing (sending IP not authorised), DKIM was absent, and DMARC was not configured. Confirmation emails were landing in spam at an 81% rate. We adjusted our delivery timeline by +35% and set spam-folder monitoring as primary. Completion rate: 91.4%. Knowing the platform’s email health before starting saved the campaign.
What makes catch-all email addresses detectable by modern platforms?
Understanding catch-all detection is important because it distinguishes professional services (using real, persistent inboxes) from low-quality operators (using catch-all domains to fake inbox diversity).
| Detection Method | What It Tests | Catch-All Result | Real Inbox Result |
|---|---|---|---|
| SMTP RCPT TO verification | Does a specific address exist? | Accepts any address (reveals catch-all) | Accepts only valid addresses |
| MX record lookup | Does the domain have a working mail server? | May pass (catch-all domains have MX records) | Passes |
| Send-pattern analysis | Does this domain receive from many senders? | Fails (catch-all domains have thin history) | Passes |
| Bounce-rate monitoring | Do emails to this domain bounce? | Rarely bounce (everything accepted) | Occasional bounces (normal) |
| Historical reputation check | Is this domain known for catch-all? | Flagged by reputation databases | Clean |
Modern contest platforms with email infrastructure as tight as Gleam.io perform SMTP RCPT TO verification before sending the confirmation email — they test whether the specific address exists, not just whether the domain has an MX record. A catch-all domain passes the MX check but fails the RCPT TO check because it accepts any address without a real inbox behind it.
Professional services use real persistent inboxes where the RCPT TO verification confirms the specific address exists. This is why the inbox type is the single most important vetting criterion when evaluating a provider.
E-E-A-T: Standards, research, and operational evidence
The technical claims and benchmarks in this article are grounded in the following:
📚 Primary standards:
- RFC 5321 — Simple Mail Transfer Protocol (IETF, October 2008). The specification governing all SMTP-based email delivery — the pipeline that carries confirmation emails in email-verified contest systems.
- RFC 7208 — Sender Policy Framework (IETF, April 2014). Defines the SPF mechanism used by contest platform mail servers to authorise confirmation-email delivery.
- M3AAWG Sender Best Common Practices v3 (February 2015). The industry standard for outbound email authentication, including DKIM and DMARC guidance, against which contest platform email infrastructure is evaluated.
🧳 From our operations 2024–2026:
- SPF/DKIM/DMARC pass-rate data from 160+ pre-order platform audits conducted between January 2024 and May 2026, across five platform categories.
- Spam-folder delivery rate data: 81% spam rate on a regional WordPress-based contest (2024); 22% rejection rate from a misconfigured DMARC “reject” policy on a talent contest (March 2025, resolved within 48 hours after notifying the operator).
- Completion-rate data: 92–96% across email-verified campaigns since 2021; 93.6% for a 750-vote double opt-in charity photography contest (November 2024).
- Real-world delivery test (November 2024): single opt-in average per-vote time 14 minutes vs. double opt-in 31 minutes at equivalent campaign scale.
Quick-reference FAQ: Email-verified vote mechanics
Q: What is the single biggest cause of email-verified vote delivery failure? SMTP delivery to the spam folder combined with a short link-expiry window (under 30 minutes). When a contest platform has poor email infrastructure — no DKIM, failing SPF, no DMARC — confirmation emails land in spam at rates above 50%. If the provider monitors only the primary inbox, those votes are lost. Professional services actively scan spam folders.
Q: Can a contest platform tell the difference between a real inbox and a catch-all address? Yes, via SMTP RCPT TO verification. Modern platforms probe the address before sending a confirmation email. Real persistent inboxes pass this check; catch-all domains do not because they accept any string at their domain — which is detectable as the anomaly it is.
Q: How does double opt-in affect my campaign budget? Double opt-in adds 15–25% to per-vote cost (more infrastructure work per vote) and 30–40% to delivery timeline (each vote needs two inbox-monitor-and-click cycles). For a 500-vote single opt-in campaign budgeted at $500, expect $600–$625 and 30–40% more time for the equivalent double opt-in contest.
Q: What is the safest daily delivery rate for an email-verified contest? No more than 3x the contest’s observed daily organic vote rate during the first 48 hours. If the contest is getting 30 organic votes per day, cap professional volume at 90/day initially. After 48 hours of clean delivery, you can scale to 4–5x the organic rate if the leaderboard shows no flags.
Next steps: putting this into action
If you now know your contest is single opt-in email-verified with good platform email infrastructure: The full campaign strategy framework is in the ultimate guide to email-verified contest votes. Start the email votes service order process with your platform URL and we will audit it before confirming your quote.
If your platform has poor email infrastructure (SPF failures, spam-folder delivery, short expiry windows): Read the SPF record entry in the glossary for background, then contact us via chat — we will audit the platform’s email health in detail and adjust your delivery timeline accordingly before you commit to an order.
If you are comparing email-verified to social-login and need help deciding: See email vs. social-login contest voting for the side-by-side comparison, including organic conversion rates, cost per vote, and reversal risk. Still unsure? The email votes pillar page maps every scenario with platform-type-specific guidance.
How-to: step-by-step action plan
- → Identify the platform's email infrastructure quality
Cast a test vote with your own email address. Measure how long the confirmation email takes to arrive (target: under 3 minutes). Check sender domain's SPF record at mxtoolbox.com — a failing SPF result predicts spam-folder delivery for up to 25% of confirmation emails.
- → Check the confirmation-link expiry window
Click the confirmation link immediately after it arrives, then attempt to click it again 90 minutes later. If the second click returns an error, the expiry window is under 90 minutes. Share this window with your provider before ordering — anything under 30 minutes requires expedited delivery protocols.
- → Determine single vs. double opt-in
Count the distinct emails and clicks required before your vote appears in the leaderboard. One email, one click = single opt-in ($0.80–$1.15/vote). Two emails or two required actions = double opt-in (add 15–25% to cost and 30–40% to timeline).
- → Build an organic vote base of at least 30% of target
Send personal messages (not broadcast posts) to friends, family, and loyal customers. Expect 55–65% completion rate per contact for email-verified contests. For a 500-vote target, reach out to 250–300 people personally before adding professional volume.
- → Place your order at least 10 days before the deadline
For 500-vote email-verified orders, plan 4–6 days of delivery plus a 48-hour re-delivery buffer. Place the order no later than day 8 before the deadline. For 1,000+ votes, start 14 days out.
- → Monitor spam-folder delivery rates with your provider
Ask your provider for a mid-campaign delivery report that splits successful inbox deliveries from spam-folder recoveries. A spam-folder rate above 30% on a contest platform indicates poor SPF/DKIM infrastructure — delivery timeline should be extended by 20–30%.
- → Verify votes are recorded on the contest leaderboard, not just 'sent'
Compare your provider's delivery count with the actual leaderboard increment every 24 hours. A gap of more than 5% between delivered and recorded votes signals platform-side rejection — contact your provider within 4 hours for re-delivery initiation.
Frequently asked questions
What exactly is email-verified contest voting?
Email-verified contest voting is a system where each vote requires proof of access to a unique email inbox. After clicking Vote, a visitor submits their email address. The contest platform sends a confirmation email with a unique, time-limited link. The vote is only recorded when that link is clicked from the inbox it was sent to. Each email address can only be used once, enforcing a genuine one-vote-per-person limit for voters who do not have access to multiple real inboxes.
How long do email confirmation links stay valid?
Most contest platforms set confirmation-link expiry between 30 and 120 minutes. Some older platforms leave links valid for 24 hours; a minority of high-security contests expire links after just 15 minutes. The expiry window is the single most important delivery parameter for professional vote services — it sets a hard deadline for inbox monitoring, SMTP delivery, and link-click execution. Always check the confirmation email timing before placing a large order.
Why do confirmation emails sometimes go to spam?
Contest platform mail servers vary significantly in email infrastructure quality. Platforms hosted on shared or budget hosting providers frequently lack proper SPF records, valid DKIM signing, and DMARC policies — which causes their outbound emails to score poorly on recipient spam filters. For professional vote services, this means inbox monitoring must include spam-folder scanning, not just primary inbox monitoring. Confirmation emails in spam can still be clicked; they just require an extra detection step.
What makes a professional email-verified vote service different from a bot?
Bots submit vote requests and attempt to click confirmation links using fabricated or short-lived email addresses that either do not exist or do not receive mail properly. Contest platforms detect this through MX record validation (does the email domain have a working mail server?), SMTP response verification (does the inbox actually accept mail?), and behavioral signals (are clicks coming from IPs consistent with the submitted email domain's geography?). Professional services use real, persistent inboxes with full MX records, established domain history, and geographically consistent residential IPs.
What is the typical completion rate for professional email-verified vote campaigns?
Across our service history since 2021, email-verified campaigns complete at 92–96% of ordered volume. The 4–8% gap comes from three sources: SMTP delivery timeouts (the contest platform's mail server is slow or temporarily down), confirmation-link expiry before our system can click (rare, usually with sub-30-minute expiry windows), and MX-record validation failures on newer contest platforms that have tightened inbox verification. We re-deliver failed votes at no charge for all three causes.
How does single-verification differ from double opt-in in contest voting?
Single-verification (also called single opt-in) contests require only one confirmation click to record the vote. Double opt-in — borrowed from email marketing (per M3AAWG best practices) — requires the voter to confirm their subscription or registration first, then take a second action (often a separate vote click after account creation) to cast the vote. Double opt-in contests have lower organic conversion and higher delivery complexity for professional services; they typically command a 15–25% price premium.
Which contest platforms most commonly use email verification?
Contest platforms built on WordPress with contest plugins (such as Gleam.io, Rafflecopter, and custom themes), standalone photo and talent contest platforms, charity fundraising contest systems, and regional/national competition software packages all commonly deploy email verification. Local newspaper and radio station contests almost universally use email-gated voting because it is easy to implement and provides an auditable record of voter identities for contest administration purposes.
How does SPF affect email-verified contest voting?
SPF (Sender Policy Framework, RFC 7208) is a DNS record that specifies which mail servers are authorised to send email on behalf of a domain. When a contest platform sends a confirmation email, the recipient's mail server checks the sending IP against the platform's SPF record. A failing SPF check increases the probability that the confirmation email is filtered to spam or rejected entirely. Our vote delivery infrastructure monitors SPF, DKIM, and DMARC status for each contest platform and adjusts spam-folder scanning protocols accordingly.
Can I know in advance if a contest will have SMTP delivery problems?
Yes, with reasonable accuracy. Before accepting an email-verified vote order, we audit the contest platform's outbound email infrastructure: we submit a test vote, track inbox delivery time, check SPF/DKIM/DMARC records for the sending domain, and note the confirmation-link expiry window. Platforms with poor email infrastructure are flagged for extended delivery timelines in order quotes. Platforms with sub-30-minute expiry windows require expedited delivery protocols at an additional cost.
What volume can I realistically order for an email-verified contest?
Volume is less constrained by our inbox pool (which contains millions of active addresses) than by contest-platform velocity detection. Most email-verified contests have daily vote caps or unusual-activity thresholds that trigger manual review if a single entry receives more than 200–500 votes in a 24-hour window. For large orders (1,000+ votes), we spread delivery over 3–5 days and pace intraday traffic to match normal human voting patterns. Always discuss your target volume and deadline with your provider before ordering.
What does 'catch-all email address' mean in this context and why does it matter?
A catch-all address is a mail server configuration that accepts delivery for any address at a domain, regardless of whether a specific inbox exists. Some low-quality vote services use catch-all domains to simulate having many real inboxes when they actually have none — they simply claim any address at their domain will receive mail. Modern contest platforms detect catch-all configurations through SMTP verification (attempting a test delivery before sending the confirmation email) and reject submissions from these domains.
How should I time my email-verified vote campaign relative to the contest deadline?
Start at least 5 days before the deadline for orders under 500 votes; 10–14 days for orders over 1,000 votes. Email-verified delivery cannot be safely rushed to the final 24 hours without triggering velocity detection. Leave a 48-hour buffer before the deadline so that any re-delivery (for the 4–8% of orders needing it) can be completed without missing the cutoff. Share your exact deadline with your provider at order time — it changes the delivery pacing plan.
Are there contest categories where email verification is especially common?
Yes. Local and regional competitions (best local business, best photo, talent competitions), charity fundraising vote contests, and academic or professional awards programs favor email verification because they need an auditable participant record for compliance and prize distribution purposes. National brand-sponsored contests are more likely to use social-login because they want engagement on their social channels. Understanding the category typically predicts the authentication method before you even see the voting interface.
What information should I give a vote service provider for an email-verified contest?
At minimum: the direct URL to the vote/contest entry page, your entry name or ID, the confirmation email you received when you submitted a test vote (helps us measure delivery speed and link-expiry window), the contest deadline, and your target vote count. The more information you provide, the more accurately a provider can quote delivery timelines and identify potential infrastructure challenges before the campaign starts.
Is it possible to win an email-verified contest with only organic votes?
Absolutely — and for smaller local contests with tight community followings, organic mobilisation is often the primary strategy. Email-verified contests respond well to direct outreach (personal messages, email newsletters, community group posts) because the voters you contact directly are more likely to complete the multi-step process than cold traffic. We recommend building an organic foundation of 40–60% of your target vote count before adding professional volume, so the velocity increase looks gradual rather than sudden.
Victor Williams
Founder, Buyvotescontest.com · 8+ years building contest-vote infrastructure
Victor founded Buyvotescontest in 2018 and has personally overseen 3,000+ campaigns across Facebook, Instagram, X, Telegram, and email-verified contests. Read his full story →
Related email guides
5 Mistakes Email Contest Vote Buyers Make — and How to Fix Them
The five most costly mistakes buyers make in email-verified contests — from delivery timing errors to provider mismatches — with specific, actionable fixes.
Case Study: Winning an Email-Verified Grant Contest Vote
How a community arts organization used a structured two-tranche vote strategy to win an email-verified $25,000 grant contest — with campaign decisions documented.
Email vs Social Login Contest Voting: What's Easier to Win?
Email-verified vs social-login contest voting compared — organic conversion rates, professional service costs, delivery speed, and which format is easier to win in 2026.
Ultimate Guide to Email-Verified Contest Votes in 2026
The complete 2026 guide to email-verified contest votes — system mechanics, vote sourcing, provider evaluation, campaign timing, and risk management frameworks.
Last updated · Verified by Victor Williams