# About Spaw

Spaw is an email verification API at spaw.co. One key, one credit balance, and a verdict that names its reasons and its data sources.

Updated: 2026-09-03

Spaw is an email verification API, launched in 2026 at spaw.co. You send an address, and the API answers whether mail to it will arrive, why, and how much to trust the answer. The same engine sits behind a dashboard, bulk uploads, a browser form widget, and an MCP server for AI agents.

## What one lookup does

Every lookup runs the same pipeline, and the response shows every step of it:

- **Syntax.** The address is parsed against RFC 5322, then against the username rules of the big providers, so `a@gmail.com` is rejected the way Gmail itself would reject it.
- **Live DNS.** MX records are resolved at query time. A domain with no MX record but an A record is reported as implicit MX, a null MX record as a domain that declines all mail, and MX hosts that point at dead or private addresses as unresolvable.
- **SPF and DMARC.** The domain's authentication records are read and the DMARC policy is reported.
- **Open lists.** The domain is matched against the open disposable-provider list, including domains whose mail is handled by a listed operator, and the local part against the open role-address list.
- **Typo-squats.** A curated map catches `gmail.con` and friends and suggests the intended domain.
- **The mailbox itself.** An SMTP handshake asks the receiving server whether the mailbox exists. The conversation ends before any message is transmitted; nothing is ever sent to an address you check.
- **A risk score you can audit.** The 0 to 100 score is a published sum of weights, one per signal, not a black box.

## How billing works

You pay for answers, not attempts.

- A lookup that comes back deliverable or risky costs 1 credit.
- Undeliverable verdicts and invalid input are free.
- Repeating a lookup within 7 days is free.
- Every account gets 10 free credits at the start of each month, with no card required, and unused credits accumulate.

## What we hold ourselves to

- **Every response names its data sources**, with a version, so you can see exactly what the answer was based on.
- **Full data everywhere.** The free tools show the same fields as the paid API.
- **No data sales.** Addresses you submit are used to answer your query and for nothing else. Verification history is deleted after 30 days. The [privacy policy](/privacy) spells this out.

## Channels

- REST API at `https://spaw.co/api/v1`, documented in the [API reference](/docs/api)
- The dashboard, with a playground, history, bulk runs, monitors, and a suppression list
- Bulk uploads of up to 100,000 addresses with signed webhooks
- A browser form widget that checks addresses as people type
- An [MCP server](/docs/mcp) that lets AI agents verify addresses with your API key

Phone validation and IP intelligence are in development.

## Open data we build on

Spaw credits the open datasets it relies on: Google's libphonenumber, DB-IP Lite, the disposable/disposable-email-domains list, the mixmaxhq role-based address list, and the Kikobeats free-email-domains list.

## Contact

Questions, partnership requests, and press: [support@spaw.co](mailto:support@spaw.co).