# Confidence Scoring

The `confidence` field is a detection score from 0–100, built from matched checks. The optional [`signals`](https://docs.disify.com/api/signals.md) array provides context. The score is not a probability or a measured accuracy percentage. Use `disposable` as the disposable verdict.

## How the score is built

Each matched [signal](https://docs.disify.com/api/signals.md) contributes a fixed number of points. The points are **added together** and **capped at 100**. The `disposable` boolean flips to `true` once the total reaches the threshold of **50**.

**Edge case: `confidence` ≥ 50 but `disposable: false`**

The `no_mx_records` signal can raise the score without changing the earlier disposable verdict. For example, `high_entropy` (+20) plus `no_mx_records` (+30) can return `confidence: 50`, `disposable: false`, and `dns: false`. This is why comparing the score to 50 does not always reproduce `disposable`.

| Signal | Points |
| --- | --- |
| `blacklist_exact` | 100 |
| `mx_blacklist_exact` | 100 |
| `mx_ip_blacklist` | 100 |
| `alias_base_exact` | 100 |
| `blacklist_parent` | 90 |
| `keyword_match` | 80 |
| `mx_blacklist_parent` | 70 |
| `pattern_heuristic` | 60 |
| `high_entropy_suspicious_tld` | 50 |
| `free_provider_alias_pattern` | 35 |
| `no_mx_records` | 30 |
| `fresh_domain` | 25 |
| `high_entropy` | 20 |
| `suspicious_tld` | 15 |

A single high-confidence signal (any blacklist or exact-alias match) is enough to cross the threshold on its own. Weaker heuristic signals (`suspicious_tld`, `high_entropy`, `no_mx_records`) generally need to combine before a domain is flagged.

## Score ranges

| Score | Meaning | Typical signals |
| --- | --- | --- |
| **0** | Not disposable | No signals triggered |
| **15–20** | Low suspicion | `suspicious_tld`, `high_entropy` |
| **25–35** | Moderate suspicion | `fresh_domain`, `no_mx_records`, `free_provider_alias_pattern` |
| **50** | Likely disposable | `high_entropy_suspicious_tld` (threshold reached) |
| **60** | Probably disposable | `pattern_heuristic` |
| **70–80** | Very likely disposable | `mx_blacklist_parent`, `keyword_match` |
| **90–100** | Strong detection score | Blacklist/exact-alias matches or several combined heuristics |

## Choosing a threshold

Start with `disposable`. If you need a custom rejection or review policy, evaluate it against your own traffic and document the trade-off: a higher score threshold accepts more detected addresses; a lower one challenges more addresses.

A score of 90 or 100 does not prove a blacklist match: several heuristics can add up to that score. Inspect `signals` if your policy depends on the kind of evidence. Handle DNS and email ownership separately.

See [Detection Signals](https://docs.disify.com/api/signals.md) for what feeds each score band.

Source: https://docs.disify.com/api/confidence.html