2026-09-10
A support page, a glossary, and the work nobody could reach
Support is a page that knows who you are, not a mailto. Thirty terms have a citable definition each. Pricing goes above 100,000 credits and estimates what a month costs. Comparisons cover all five products. Twenty-five guides, six of them new, and every product page finally links its own. A free endpoint that sends you a real signed webhook. And the email callback, which turns out to have been the one webhook with no private-address guard behind it.
- Support is a page now, not a mailto. Writing to us meant an email address in the footer, with nothing said about what happens next.
/supportis a form that, when you are signed in, already knows your account, your plan, your balance and your five most recent request ids — the things support would otherwise have to ask you for, and the ones you would otherwise have to go and look up. It says plainly what happens next, including what it does not: no auto-reply, no ticket portal, and no response-time commitment we have not measured. What "priority support" on the paid plans actually buys is stated in one sentence rather than implied. - Filed requests are kept for 180 days and then deleted whether or not anyone read them, and the privacy policy now says so — a form that stores a message, a reply-to address and the account it came from is a store of personal data, and the policy's collection and retention sections are exhaustive lists.
- Thirty terms have a page each. Every machine value already had one — 58 verdict reasons, 18 error codes — while the words around them lived only inside guide bodies, where nothing could link to them. Catch-all, greylisting, null MX, implicit MX, ASN, CIDR, E.164, NPA/NXX, LEI, PMB, mail drop, delivery point and the rest are now at
/glossary, each opening with its definition, each true of this product specifically rather than of the dictionary, and each naming the field or reason it maps to. - Pricing goes above the top of the ladder, and shows its working. The ladder stopped at 100,000 credits and offered nothing beyond it: somebody with a million rows a month read to the bottom and left. There is a way to ask now. Beside it, an estimator: put in a month's volume and the share of it you expect to be free — invalid rows, undeliverable verdicts and 7-day repeats all cost nothing — and it names the cheapest tier that covers it and what the two ways of buying work out at.
- It compares them honestly, which took two goes. A pack is bought once and a plan is charged monthly, so the first version subtracted the two prices and told you the plan saved you money in most of the ladder — while the pack it was comparing against covered three or four months. It now spreads the pack over the months its credits actually last, which is what makes the two comparable, and says which is cheaper only where that is true.
- The comparison pages cover the whole product. All nine were email vendors, and the table itself was email-shaped — every competitor compared on an SMTP check, whatever they sold. There are twenty-one now across five products, each compared on the axes that product is actually judged on: a phone vendor on where its line type comes from and how much of the numbering plan it carries, an address vendor on the registers it holds, a business vendor on the registers behind an identifier.
/compareis grouped by product, and each page carries the date its own figures were read rather than one date for all of them. - Twenty-five guides, and every product page links its own. Nineteen guides had been written and not one product or documentation page linked a single one, so the only way to find them was the index. Guides now declare the product they are about, the index groups by it, a guide's "related" reading prefers its own product instead of whatever was published most recently, and every product and docs page carries a rail of its own. Six are new: business verification and cross-signal consistency had none at all, and no other marketing surface either.
- You can send yourself a webhook. Proving your signature check works meant queueing a real, billed bulk run and waiting for it to finish.
POST /api/v1/webhooks/testposts a sample payload for any documented event to a URL you name, signed the way a real delivery is, and hands back the secret, the signature and the exact bytes the two were computed over, so you can verify your own HMAC against ours before anything depends on it. Free, and in all three clients. - The email callback had no private-address guard. Every webhook we send refuses a URL whose host resolves onto a private or reserved address — the check runs at delivery rather than when the URL is saved, because a name that resolved publicly can be repointed later. The
callback_urlon an email lookup was the exception: that path had its own copy of the delivery code, written before the guard existed, and never gained it. It goes through the same signer as everything else now. - The guard also missed one address of its own:
::, the IPv6 unspecified address, which the network stack routes to the local machine exactly as127.0.0.1does, and which the loopback entry beside it does not cover. - Every free tool and browser endpoint has its own rate budget. A guest has no key for the throttle to hash, so all six tool demos shared one allowance and so did the four browser endpoints — while each page and each documentation section quoted its own number. A checkout form checking an address and a phone number was spending one budget twice. Each is separate now, which is what makes the published number true, and a test refuses the next unauthenticated route that joins a shared one.
- The Requests page says "every API call this account made" and now means it: the request log and the public latency figures shared one early return, so a call on any route outside the five lookup groups wrote no row at all. The latency table is still lookups only, deliberately — a free endpoint whose duration is mostly your own server's would make a published percentile mean something else.
- Smaller corrections, all of them a number that had quietly stopped being true: the consistency endpoint takes five signals and raises nine flags, not four and seven;
/pricingnames three answers that cost more than one credit, not two; the glossary's own first draft misstated the phone feed count, the heaviest address weight and the PO box rule, all three of which are published elsewhere on the site and now agree.
markdown version: /changelog/2026-09-10-support-glossary-and-the-things-that-were-not-linked.md · atom feed: /changelog.atom