# Verdict quality

A round of accuracy work across parsing, DNS interpretation, disposable detection, and the risk model.

Date: 2026-09-02

- Lenient address extraction: display names, `mailto:` links, quotes, trailing punctuation, and invisible characters are stripped before validation.
- Provider username rules reject local parts that Gmail, Outlook, Yahoo, iCloud, AOL, and Proton would never issue.
- A curated typo-squat map turns `gmail.con` and similar domains into a `likely_typo` verdict with a suggestion.
- New MX sanity statuses: `implicit_mx` for domains that rely on the A-record fallback and `mx_unresolvable` for MX hosts that point nowhere usable.
- Disposable detection now also matches on the MX hosts, so a fresh burner domain hosted by a known operator is caught; local allow and deny overrides beat waiting for the upstream list.
- Role and free-provider lists sync weekly from their open sources.
- `smtp_reason` carries the provider detail: a full mailbox is risky, a disabled mailbox is undeliverable.
- The risk score adds a missing SPF record and the domain's registration age, read from RDAP.
- `mailbox_confidence` estimates the odds of an unverified mailbox.
- The response grew from 21 to 26 fields.

Reference: https://spaw.co/changelog/2026-09-02-verdict-quality