Yahoo Mail and AOL Mail run on the same infrastructure since Yahoo acquired AOL, and the merged platform also hosts a long list of country domains (yahoo.co.uk, yahoo.fr, ymail.com, rocketmail.com and more). Spaw reports all of them as mx_provider: "yahoo".
How Yahoo shows up in DNS
Yahoo domains publish MX records under yahoodns.net: yahoo.com points at hosts such as mta5.am0.yahoodns.net, mta6.am0.yahoodns.net and mta7.am0.yahoodns.net, and aol.com at mx-aol.mail.gm0.yahoodns.net. Spaw matches the .yahoodns.net suffix. Yahoo is a mailbox host, but a large consumer one with an aggressive perimeter, and that perimeter is what a verification handshake talks to.
How Yahoo answers a verification handshake
Yahoo's inbound servers are the most frequent source of unverified answers among the big consumer providers. They commonly defer a first connection from an unfamiliar sender with a temporary failure, apply per-connection rate limits, and sometimes accept a recipient at RCPT TO only to decide later. A verification probe cannot wait the minutes a deferral asks for, so many Yahoo lookups end with smtp_checked: false and an smtp_reason of greylisted or timeout. Clear rejections do happen, and when they do they are reliable: an address Yahoo says does not exist really does not.
What that means for your verdicts
Expect three kinds of answers. A confirmed mailbox gives deliverable with mailbox_exists: true. A confirmed missing mailbox gives undeliverable with reason: mailbox_not_found. And a large share of lookups gives deliverable with smtp_checked: false, mailbox_exists: null and a mailbox_confidence estimate; the unverified state adds ten risk points, so these addresses usually land in the low band rather than at zero.
Before any probe, Yahoo's username rules apply to yahoo.com, aol.com and their listed variants: letters, digits, dots, underscores and hyphens. Anything else is undeliverable with reason: invalid_local_part at no cost. Yahoo is not on Spaw's established-provider list for the confidence bonus, because a consumer perimeter that defers probes says little about individual mailboxes.
The most effective way to firm up Yahoo answers is your own delivery data. Report delivered and bounced outcomes through the feedback endpoint or an ESP webhook: a delivered report turns later lookups of that address into a confirmed mailbox with smtp_reason: delivered_recently, and the bounce rate of the domain feeds every confidence estimate on it. For an unverified single lookup, pass callback_url so Spaw re-checks after 5 and 20 minutes and pushes the settled verdict.
SPF and DMARC at Yahoo
Consumer Yahoo and AOL users have nothing to configure; yahoo.com and aol.com publish their own SPF and a DMARC policy of p=reject. That policy has a practical consequence for senders: mail that claims a yahoo.com or aol.com From address but is sent through another service fails DMARC and is rejected. Spaw's dmarc_policy field shows the live policy for any domain.
Practical notes for sending to Yahoo users
Yahoo joined Google in requiring aligned SPF or DKIM, a DMARC record, one-click unsubscribe and a low complaint rate from bulk senders in 2024, and it recycles abandoned addresses into spam traps more readily than most providers. Old Yahoo addresses on a list are therefore worth re-verifying before every campaign, and a mailbox_not_found answer on one should be treated as final. Yahoo does not support plus-addressing in the Gmail sense; it uses a separate disposable-address feature with a hyphen, which looks like a normal address to a verifier.
For a live look at any Yahoo-hosted domain, run it through the free MX lookup and the SPF and DMARC checker.