Changelog

What changed in Spaw, newest first. Every entry names the endpoints and fields it touched, so you can search this page for the thing you noticed.

2026-09-03

Documentation and public pages

The OpenAPI document is published at /openapi.json and /openapi.yaml.
Every docs page has a Markdown twin at the same URL with .md appended, and /llms-full.txt gathers all of them.
One reference page per endpoint, with request and response tables and code samples.
Reference pages for every verdict reason, SMTP reason, and API error code.
The free domain tools have permalinks: one page per domain for MX, SPF and DMARC, and disposable checks.
New public pages: pricing, about, security, and this changelog.

2026-09-02

Lenient address extraction: display names, mailto: links, quotes, trailing punctuation, and invisible characters are stripped before validation.
Provider username rules reject local parts that Gmail, Outlook, Yahoo, iCloud, AOL, and Proton would never issue.
A curated typo-squat map turns gmail.con and similar domains into a likely_typo verdict with a suggestion.
New MX sanity statuses: implicit_mx for domains that rely on the A-record fallback and mx_unresolvable for MX hosts that point nowhere usable.
Disposable detection now also matches on the MX hosts, so a fresh burner domain hosted by a known operator is caught; local allow and deny overrides beat waiting for the upstream list.
Role and free-provider lists sync weekly from their open sources.
smtp_reason carries the provider detail: a full mailbox is risky, a disabled mailbox is undeliverable.
The risk score adds a missing SPF record and the domain's registration age, read from RDAP.
mailbox_confidence estimates the odds of an unverified mailbox.
The response grew from 21 to 26 fields.

2026-09-02

A shared mailbox answer cache across customers, so the same address is probed once.
Bulk runs process in chunks, and each chunk writes its own part file before results are stitched.
Provider balance alerts warn before the mailbox partner runs dry.
Six @spaw.test test addresses answer fixed verdicts at no cost and are never logged.
Every response carries X-Request-Id, repeated in meta.request_id and error.request_id.
Publishable keys accept a daily credit cap (429 KEY_SPEND_CAP_REACHED once it is spent).
A circuit breaker keeps a struggling mailbox provider from slowing every lookup.
Batch requests send their mailbox probes concurrently.
A bounce feedback API (POST /v1/email/feedback) and webhook targets for Postmark, Amazon SES, Mailgun, and SendGrid; bounces join the suppression list, deliveries clear it, and the dashboard shows measured accuracy.
smtp_checked_at, the 27th response field, records when the mailbox was last probed.
Catch-all domains are remembered for a week, and an account's own delivered addresses count as verified for 90 days.
Credit packs are sold through Stripe Checkout from the Billing page.
callback_url and callback_secret on a lookup re-check an unverified answer after 5 and 20 minutes and POST the settled verdict, signed.
Bulk uploads keep the file's own columns, add the verdict columns, and offer ?variant=deliverable|risky|undeliverable downloads.
Publishable keys can require a Cloudflare Turnstile token per lookup.

2026-08-31

POST /v1/email/batch verifies up to 50 addresses in one request.
POST /v1/email/bulk queues up to 100,000 addresses, with an HMAC-signed completion webhook, cancellation, and CSV results.
GET /v1/email/domain/{domain} answers MX, provider, SPF and DMARC, registration age, and list membership for a whole domain.
A per-account suppression list: undeliverable verdicts are remembered, and existing lists can be imported.
Scheduled list monitors re-verify a list on a cadence and alert when its deliverability decays.
Publishable keys (pk_…) power a browser endpoint locked to allowed origins.
An MCP server lets AI agents verify addresses with an existing API key.
Four free tools without signup: email checker, MX lookup, SPF and DMARC checker, and disposable domain checker.
The documentation became a multi-page area with a getting-started guide, an email verification guide, and the API reference.
The product is now Spaw at spaw.co.

2026-08-30

POST /v1/email verifies one address: RFC syntax, live MX resolution, open disposable and role lists, typo suggestions, SPF and DMARC records, and a 0 to 100 risk score built from published weights.
An SMTP mailbox handshake runs on every lookup whose domain accepts mail. No message is ever sent.
MX provider classification names the infrastructure behind a domain (Google, Microsoft, Proofpoint, and others).
Secret API keys (sk_live_…) are created from the dashboard, shown once, and stored hashed.
Credits bill answers only: a deliverable or risky verdict costs 1 credit, undeliverable and invalid answers are free, and a repeat within 7 days is free.
The dashboard playground runs the same lookups as the API.
spaw-form.js, a form helper for the browser, checks addresses on blur, offers a did-you-mean correction, and never blocks a submit.