Guides
Practical, specific answers on every signal Spaw verifies — email addresses, phone numbers, IP addresses, postal addresses, business identifiers and the consistency between them. What each check actually does, what its answer means, and what it does not tell you. Grouped by the product they are about.
Email verification
Documentation- A catch-all behind a security gateway is the gateway's design, not a squat
Proofpoint, Mimecast and Barracuda typically accept every recipient at the edge. What mx_provider_type says, why the weight drops to 15, how to send.
2026-09-13
- DKIM selectors explained, and why 'none found' is not 'no DKIM'
A DKIM key lives under a selector only the sender knows. What a selector is, which names the common platforms use, and what dkim_selectors answers.
2026-09-13
- Gate a signup form with the sending policy
One boolean per answer, decided by rules you set once: which signals block, how high the score may go, how sure a catch-all must be. How to use ok_to_send.
2026-10-08
- MTA-STS, TLS-RPT and BIMI for senders
The three DNS records beyond SPF, DKIM and DMARC: what each promises, what receivers do with it, what Spaw reads, and the order to add them in.
2026-09-13
- Reading a domain monitor alert
A domain monitor alerts when a domain goes dead, gets parked, lands on a blocklist, loses a policy or changes provider. Every status and flag, and what to do.
2026-09-13
- Recycled spam traps, and the mailbox that came back
A mailbox that bounced for months and then accepts mail again is the shape of a recycled spam trap. What recycled_mailbox means, and what to do with one.
2026-09-13
- Relay addresses are not burners
Firefox Relay, SimpleLogin, Addy.io and DuckDuckGo aliases sit on disposable lists but deliver to a real mailbox. What Spaw answers, and how to treat them.
2026-10-08
- What email verification keeps under GDPR
An email address is personal data. What Spaw stores about one and for how long, what is read across accounts, who sees it, and how it is erased.
2026-09-13
- Disposable email domains and how detection works
Temporary inboxes live minutes. How the open disposable-domain list is built, why matching on MX hosts catches new burners, and what Spaw returns for one.
2026-09-13
- Email bounce rate benchmarks and what "acceptable" means
Published averages put hard bounces near 0.2% and soft bounces under 1% for opted-in lists. What mailbox providers enforce, and how to set your own target.
2026-10-02
- Email list cleaning checklist before a campaign
Ten steps in order: normalize and dedupe, import known bounces, verify in bulk, segment by verdict, authenticate, warm up, then keep it clean with monitors.
2026-10-02
- How Spaw computes the risk score
The risk score is a sum of published weights over documented flags, capped at 100, with undeliverable fixed at 100. Every weight, thresholds, examples.
2026-10-08
- How to verify an email address without sending an email
Parse the address, resolve the domain's mail servers, then ask the server about the mailbox in an SMTP handshake that ends before any message is sent.
2026-10-02
- Role-based email addresses and how to treat them
info@, support@, billing@ and about a thousand more belong to a function, not a person. How Spaw detects them, why senders flag them, and when to keep them.
2026-10-02
- SMTP bounce codes explained, from 550 5.1.1 to 421 4.7.0
What each SMTP reply and enhanced status code means, which are hard bounces, and how a verification handshake maps them to smtp_reason values.
2026-10-02
- SPF, DKIM and DMARC for developers
What each record proves, what it looks like in DNS, how receivers combine them, and what Gmail and Yahoo require from bulk senders since 2024.
2026-10-08
- What is a catch-all email address, and how should you handle it?
A catch-all domain accepts mail for every address, so no handshake can confirm one mailbox. What Spaw reports, how the confidence score works, when to send.
2026-10-08
- Why an email validation regex is not enough
A regex only rejects the impossible. It cannot say whether the domain accepts mail, the mailbox exists, or the address is a burner. What to run after it.
2026-09-03
Phone intelligence
Documentation- An area code is not a time zone
NANPA lists 24 area codes on more than one clock, and a lookup reads the exchange. Which numbers answer two zones, and what in_call_window checks.
2026-09-27
- Fictional and test phone numbers: the ranges regulators reserve and what a lookup answers
The ranges NANPA, Ofcom, ARCEP, ACMA and ComReg reserve for fiction, what libphonenumber says about each, and what Spaw and its test numbers answer.
2026-09-27
- How to store phone numbers in E.164
Store one E.164 string, the extension and the raw input. How trunk prefixes, 00 and 011, extensions and did_you_mean work, and why a regex is not enough.
2026-09-27
- Number pooling: why a US code's holder is often not your block's holder
In a pooled US code each block of a thousand can have its own holder. How often it differs from the code's, and what carrier and line type then describe.
2026-09-27
- SMS delivery error codes: retry, remove the number, or fix your sender
Twilio, Sinch and MessageBird delivery error codes sorted by what to do next, and which of them a phone lookup can warn you about before you send.
2026-09-27
- SMS pumping (artificially inflated traffic): what the default SMS policy lets through
SMS pumping bills you for codes sent where someone earns a share of each message. What the default SMS policy passes, and the rules that refuse it.
2026-09-27
- UK number ranges in a phone lookup, from 01 to 09
What a phone lookup answers for each UK range from 01 to 09, which ranges carry risk weight, and how much of each range Ofcom lists as allocated.
2026-09-27
- What FTC unwanted-call complaints can and cannot say about a number
Complaints to the FTC name the number shown on caller ID. What 90 days of them show, what they cannot prove, and how Spaw's complaint fields read them.
2026-09-27
- Gate SMS verification codes with the SMS policy
One boolean per phone answer, decided by rules you set once: the countries you send to, the line types and signals you refuse. How to use ok_to_send.
2026-09-27
- Stop OTP abuse with block data and disposable numbers
Which numbers soak up one-time codes and free trials, the four open signals that catch them, and a signup policy that does not punish real people.
2026-09-27
- What an unassigned block means
A number can pass its numbering plan and still belong to nobody. How the regulators' tables settle it, what the statuses mean, and why the answer is free.
2026-09-26
- Why US numbers cannot be split into mobile and landline
The North American plan hands mobiles and landlines the same blocks. What a number can still tell you, what the block holder proves, and what porting breaks.
2026-09-27
IP intelligence
Documentation- How Tor exit rotation defeats a static blocklist
Exits join and leave the Tor list through the day, so a copied list is wrong both ways. What the hourly sync, the thirty-day history and recently_tor do.
2026-09-12
- How accurate is free IP geolocation?
Country holds, city does not: what the weekly measurement against operator-declared locations found, how location_confidence grades it, and what to build on.
2026-10-02
- How to verify Googlebot and GPTBot
Anyone can send a Googlebot user agent. The two proofs that hold, the published ranges and forward-confirmed reverse DNS, and what is_crawler answers.
2026-09-12
- Why residential proxies cannot be detected from open data
A residential proxy is a home connection rented out. No public feed names one, so the API does not claim to. The signals that do exist, used honestly.
2026-09-12
- A VPN and relay policy that does not punish real people
Relay users are ordinary Apple customers and VPN users are often paying ones. How privacy_service, is_relay and risk_signals let you challenge instead of block.
2026-09-04
- Block datacenter and bot signups with one IP lookup
Scripted signups come from cloud boxes. How is_datacenter, hosting_provider and asn_type separate them from people, and the proxy mistake that hides it.
2026-09-04
- Gate consent and defaults by country: is_eu, timezone and currency from an IP
Show the consent banner where the law requires it, pick a currency and clock the visitor recognises, and know where IP geolocation stops being reliable.
2026-09-04
Address verification
Documentation- How to tell a UK virtual-office or formation address from a trading address
The 2024 appropriate-address rule, 28,936 companies at the Companies House default address on 1 September 2026, and what open UK sources can and cannot say.
2026-09-23
- A suite at a single-family home
What the flat or suite written on an address says against the units a register lists at the building: unit_check, its two signals, and which registers can tell.
2026-09-17
- Gate a checkout with the shipping policy
One boolean per address, decided by rules you set once: which signals block, how high the score may go, whether a register must confirm the building.
2026-10-14
- Placeholder addresses: what people type instead of an address
asdf, n/a, no address, 123 Fake Street: what a form gets when nobody means to give an address, how Spaw spots it by whole name, why Test Valley Road is safe.
2026-09-23
- Reading a British postcode district page
One page per outward code from installed data: live and terminated postcodes by sector, the roads Open Names files there, nearest districts, a company count.
2026-09-23
- What a postcode directory learns from a register
A register of buildings adds the towns it writes under each postcode to the directory, beside its rows and never in their place. Why, and what the US gets.
2026-09-17
- A registered agent's address is not a mail drop, and not a home
A mailbox branch, a formation agent's office and a building full of companies all collect other people's post. What mail_drop_source distinguishes.
2026-09-23
- How an open register locates a building
National registers publish where each building stands, and some say what it is for. Which carry what, how grids are projected, what location_source means.
2026-09-16
- How to read the address confirmation map
Every address answer says which dataset stood behind each part and what the parser changed. What each source means, and why unconfirmed is not wrong.
2026-10-14
- Number ranges: what the US range match can and cannot say
The Census publishes every US street's house-number ranges. What match_level range and number_out_of_range mean, and why the table is declared partial.
2026-09-16
- What a street match means in Great Britain
Britain has no open list of buildings, but it has one of streets. What Open Names confirms, the 87 percent of street lines it matched, why exists stays null.
2026-10-02
- Can you look up UK addresses from a postcode for free?
Not the addresses: every full UK list derives from Royal Mail’s licensed PAF. Free: whether a postcode exists, its status, centroid, places, district streets.
2026-10-14
- How to read an address-existence answer
Premise, street and postcode matches prove different things, and absence from a partial register proves nothing at all. A field-by-field reading of exists.
2026-10-14
- What a PMB (private mailbox) is, and why it cannot prove where you live
A PMB is a box at a mail-receiving agency, written the way USPS requires. What that spelling proves, why banks need a street address, and why no list exists.
2026-09-22
Business verification
Documentation- A LEI check digit is a typing check
Twenty characters ending in an ISO 7064 checksum. What checksum_valid settles, what only a register can settle, and why the two are reported side by side.
2026-09-10
- How a UK dissolution shows up in open data
The free company file is a snapshot of the live register, so a struck-off company is removed rather than marked dissolved. What to watch instead.
2026-09-10
- When two registers disagree about a company
A LEI record and a national register can carry different names and different statuses for one company. What Spaw compares, what it refuses to resolve, and why.
2026-09-10
Cross-signal consistency
Documentation- How to read a consistency report
Four fields, ten comparisons, both sides of each one quoted, and deliberately no score. A field-by-field reading, and how to write a rule you can defend.
2026-10-02
- When two weak signals coincide
A burner mailbox is common. A datacenter address is common. Both on one signup is not. The four pairing comparisons, and the rule that keeps them honest.
2026-09-10
- Why a VPN withholds the country comparisons
A VPN exit, a relay or a datacenter egress locates the operator, not the person. What low_confidence withholds, what it does not, and what to read instead.
2026-09-10
Try it on your own data
Every Spaw account gets free credits at the start of each month, no card. One key answers every signal these pages describe, and the pricing page has every billing rule in full.