2026-09-20
The sign-up form now runs the email lookup on your address
Creating a Spaw account checks the address you type with the same email endpoint the account is for: a likely typo is offered back before you submit, an address that cannot receive the confirmation link is refused, and everything the product calls risky opens an account as it always has. Changing the address on your profile is checked the same way.
- The address is checked while you are still looking at the field. Leave the email box on /register and the form runs the same lookup
POST /api/v1/emailanswers, and says what came back: a likely misspelling is offered as one click that rewrites the field (gmial.comforgmail.com, andacme.cofor a domain you would otherwise have to spot yourself), a mailbox the handshake confirms gets a quiet line saying so, and an address that cannot receive mail gets the reason before the form is submitted rather than after. It is advisory — nothing is disabled and the button always works, because the address is verified for real when the account is created. - Only an undeliverable address is refused. A domain publishing no mail servers or a null MX record, mail servers that do not resolve, a username the provider does not issue, a mailbox the provider reports as missing or closed: in each case the confirmation link cannot arrive, and that link is the account — the API refuses every request from an unconfirmed address, and the starting credits land on the click. Everything the product calls risky still opens an account, exactly as before: a role address, a free provider, a catch-all domain, a domain registered last week. Those are answers this product sells, not grounds to turn a customer away at its own door. A disposable address is refused by the rule that has always refused it, in its own words.
- The refusal you read is the refusal you get. The line under the field and the error on submit are one sentence from one answer, so fixing what the hint told you cannot lead to a second refusal worded differently — and the answer is reused across both, so signing up costs one mailbox check rather than two.
- A check that cannot run opens the door. If DNS, the registration data or the mailbox handshake cannot be reached, the form stops objecting and the sign-up goes through. Refusing a paying customer because something upstream is down is worse than the unconfirmable address the check exists to catch, so it is never the outcome.
- Changing the address on your profile is checked the same way — with one exception that has always applied to the disposable check and now applies here too: the address your account already holds always passes. A mailbox that goes quiet for an afternoon must not lock you out of the one screen you would correct it from.
markdown version: /changelog/2026-09-20-the-sign-up-form-runs-the-email-lookup.md · atom feed: /changelog.atom