Risk signals
Every deliverable or risky answer lists the signals that fired in risk_signals, each with the weight applied and the dataset it was read from. The weights sum to risk_score, capped at 100, and an undeliverable verdict is always 100 with an empty list. Four rules bind the list: catch_all_gateway replaces catch_all behind a security gateway, young_domain and new_domain are exclusive, no_reply is added on top of role, and relay cancels disposable. The score is arithmetic, not a model; the decision is your sending policy.
The published weights, in order
Each signal has its own page with the full explanation, an example and what to do with the input.
| signal | weight | reads | dataset | meaning |
|---|---|---|---|---|
| disposable | +80 | disposable | disposable-domains | The mailbox lives at a disposable-address service, so it exists to be thrown away; this is the largest weight there is. reason: disposable |
| parked_domain | +60 | parked | parking-nameservers | The domain is parked or for sale and still accepts mail, so whoever collects that mail is not your customer. reason: parked_domain |
| likely_typo | +60 | did_you_mean | typo-domains | The domain is on the curated map of misspellings that resolve and run catch-alls to harvest misdirected mail, and did_you_mean carries the intended address. reason: likely_typo |
| mx_blocklisted | +60 | mx_blocklisted | threat-blocklists | At least one MX host resolves into a network on the threat blocklists the IP product installs — Spamhaus DROP and ASN-DROP, abuse.ch Feodo Tracker — a burner signal no domain list has caught yet. reason: mx_blocklisted |
| implicit_mx | +30 | mx_implicit | live-dns | The domain publishes no MX record, so mail would fall back to its own address under RFC 5321; such web-only domains rarely accept mail and are never probed. reason: implicit_mx |
| role | +30 | role | role-addresses | info@, support@, billing@ and the rest of the open role-address list name a function, so the inbox may be shared, filtered or unread. reason: role, no_reply |
| catch_all | +30 | catch_all | mailbox-smtp | The handshake said yes to a recipient that cannot exist, so a yes for this one proves nothing; mailbox_confidence estimates the rest. reason: catch_all |
| young_domain | +30 | domain_age_days | rdap-registration | The registry's RDAP record puts the registration less than 30 days back — the age of a domain set up for one campaign. |
| recycled_mailbox | +30 | previously_invalid | mailbox-history | A definitive no-such-mailbox was recorded for the address earlier and the mailbox answers now — the shape of a recycled address, the spam-trap kind included. reason: recycled_mailbox |
| mailbox_full | +20 | smtp_reason | mailbox-smtp | The handshake found the mailbox and was told it is full, so mail will bounce until the owner clears it. reason: mailbox_full |
| gibberish | +20 | is_gibberish | local-part-analysis | Six letters or more with no vowel, or six consonants in a row, and nothing the bundled name lists recognise — deliberately conservative. |
| generated | +20 | looks_generated | local-part-analysis | A hex string, a UUID, a base64-looking run, one or two letters before four digits, a word before six digits, or a placeholder word such as test or asdf. |
| no_reply | +20 | role_type | role-types | noreply, donotreply, mailer-daemon and their kin are addresses mail is sent from and never read at; this weight is added on top of the role weight. reason: no_reply |
| widely_seen | +20 | widely_seen | lookup-velocity | At least three other Spaw accounts looked the address up in the last 24 hours — an address hitting many signup forms at once. |
| catch_all_gateway | +15 | mx_provider_type | mailbox-smtp | The domain accepts every address but its mail runs through Proofpoint, Mimecast or Barracuda, where accepting every recipient is the gateway's design; this lighter weight takes the place of the catch-all one. reason: catch_all |
| new_domain | +10 | domain_age_days | rdap-registration | The registration is between 30 and 179 days old — past its first month, not yet an established domain. |
| no_spf | +10 | has_spf | live-dns | The domain has no SPF policy in DNS, which a maintained business domain almost always has; free providers are exempt because theirs is known. |
| unverified | +10 | smtp_checked | mailbox-smtp | The handshake ran and did not settle the mailbox — greylisting, a timeout, an unreachable server, a partner outage — so smtp_checked is false and the verdict is risky. reason: unverified |
| expiring_domain | +10 | domain_expires_at | rdap-registration | RDAP puts the registration's end inside the next 30 days — a domain that may be about to lapse. |
| alias | +5 | is_alias | local-part-analysis | mia+promo@ is the same inbox as mia@ under a disposable label — a favourite of signup-bonus farmers, and the reason to dedupe on normalized_email. |
| relay | +5 | is_relay | forwarding-services | Firefox Relay, SimpleLogin, Addy.io, DuckDuckGo Email Protection and their kind deliver to a real person's mailbox under a name they control; the identity is withheld, not the mailbox. |