# Changelog

What changed in Spaw, newest first. Reference: https://spaw.co/changelog

## 2026-09-03: Documentation and public pages

- The OpenAPI document is published at `/openapi.json` and `/openapi.yaml`.
- Every docs page has a Markdown twin at the same URL with `.md` appended, and `/llms-full.txt` gathers all of them.
- One reference page per endpoint, with request and response tables and code samples.
- Reference pages for every verdict reason, SMTP reason, and API error code.
- The free domain tools have permalinks: one page per domain for MX, SPF and DMARC, and disposable checks.
- New public pages: pricing, about, security, and this changelog.

## 2026-09-02: Verdict quality

- Lenient address extraction: display names, `mailto:` links, quotes, trailing punctuation, and invisible characters are stripped before validation.
- Provider username rules reject local parts that Gmail, Outlook, Yahoo, iCloud, AOL, and Proton would never issue.
- A curated typo-squat map turns `gmail.con` and similar domains into a `likely_typo` verdict with a suggestion.
- New MX sanity statuses: `implicit_mx` for domains that rely on the A-record fallback and `mx_unresolvable` for MX hosts that point nowhere usable.
- Disposable detection now also matches on the MX hosts, so a fresh burner domain hosted by a known operator is caught; local allow and deny overrides beat waiting for the upstream list.
- Role and free-provider lists sync weekly from their open sources.
- `smtp_reason` carries the provider detail: a full mailbox is risky, a disabled mailbox is undeliverable.
- The risk score adds a missing SPF record and the domain's registration age, read from RDAP.
- `mailbox_confidence` estimates the odds of an unverified mailbox.
- The response grew from 21 to 26 fields.

## 2026-09-02: Reliability, feedback loop and billing

- A shared mailbox answer cache across customers, so the same address is probed once.
- Bulk runs process in chunks, and each chunk writes its own part file before results are stitched.
- Provider balance alerts warn before the mailbox partner runs dry.
- Six `@spaw.test` test addresses answer fixed verdicts at no cost and are never logged.
- Every response carries `X-Request-Id`, repeated in `meta.request_id` and `error.request_id`.
- Publishable keys accept a daily credit cap (`429 KEY_SPEND_CAP_REACHED` once it is spent).
- A circuit breaker keeps a struggling mailbox provider from slowing every lookup.
- Batch requests send their mailbox probes concurrently.
- A bounce feedback API (`POST /v1/email/feedback`) and webhook targets for Postmark, Amazon SES, Mailgun, and SendGrid; bounces join the suppression list, deliveries clear it, and the dashboard shows measured accuracy.
- `smtp_checked_at`, the 27th response field, records when the mailbox was last probed.
- Catch-all domains are remembered for a week, and an account's own delivered addresses count as verified for 90 days.
- Credit packs are sold through Stripe Checkout from the Billing page.
- `callback_url` and `callback_secret` on a lookup re-check an unverified answer after 5 and 20 minutes and POST the settled verdict, signed.
- Bulk uploads keep the file's own columns, add the verdict columns, and offer `?variant=deliverable|risky|undeliverable` downloads.
- Publishable keys can require a Cloudflare Turnstile token per lookup.

## 2026-08-31: Batch, bulk, domains, monitors, MCP and free tools

- `POST /v1/email/batch` verifies up to 50 addresses in one request.
- `POST /v1/email/bulk` queues up to 100,000 addresses, with an HMAC-signed completion webhook, cancellation, and CSV results.
- `GET /v1/email/domain/{domain}` answers MX, provider, SPF and DMARC, registration age, and list membership for a whole domain.
- A per-account suppression list: undeliverable verdicts are remembered, and existing lists can be imported.
- Scheduled list monitors re-verify a list on a cadence and alert when its deliverability decays.
- Publishable keys (`pk_…`) power a browser endpoint locked to allowed origins.
- An MCP server lets AI agents verify addresses with an existing API key.
- Four free tools without signup: email checker, MX lookup, SPF and DMARC checker, and disposable domain checker.
- The documentation became a multi-page area with a getting-started guide, an email verification guide, and the API reference.
- The product is now Spaw at spaw.co.

## 2026-08-30: Email verification API launch

- `POST /v1/email` verifies one address: RFC syntax, live MX resolution, open disposable and role lists, typo suggestions, SPF and DMARC records, and a 0 to 100 risk score built from published weights.
- An SMTP mailbox handshake runs on every lookup whose domain accepts mail. No message is ever sent.
- MX provider classification names the infrastructure behind a domain (Google, Microsoft, Proofpoint, and others).
- Secret API keys (`sk_live_…`) are created from the dashboard, shown once, and stored hashed.
- Credits bill answers only: a deliverable or risky verdict costs 1 credit, undeliverable and invalid answers are free, and a repeat within 7 days is free.
- The dashboard playground runs the same lookups as the API.
- `spaw-form.js`, a form helper for the browser, checks addresses on blur, offers a did-you-mean correction, and never blocks a submit.