Detection Signals

The optional signals array explains detection evidence and temporary DNS failures. Signals can appear with either disposable verdict. Use disposable for the verdict and confidence for the score. Accept new signal names without breaking your integration.

Signal reference

Signal	Description
blacklist_exact	Domain found in the exact domain blacklist.
blacklist_parent	A parent domain is blacklisted (subdomain walk-up match).
mx_blacklist_exact	MX hostname found in the MX blacklist.
mx_blacklist_parent	A parent of the MX hostname is blacklisted.
mx_ip_blacklist	MX server IP address found in the MX blacklist.
keyword_match	Domain name contains a recognized keyword such as tempmail, disposable, or throwaway.
pattern_heuristic	Address matches a suspicious pattern: tmp+, +tmp, tmp., .tmp, or 6 or more dots.
high_entropy	The first label of the submitted domain looks randomly generated, based on entropy or its consonant-to-vowel ratio.
high_entropy_suspicious_tld	High-entropy domain combined with a suspicious TLD.
suspicious_tld	Domain uses a TLD commonly associated with disposable services.
no_mx_records	Domain has no MX records configured.
dns_indeterminate	The DNS result was temporarily inconclusive. It adds no confidence and is not cached as a missing record; retry later.
fresh_domain	Domain age is below the freshness threshold (30 days by default). Requires domain_age; also reported as domain_age.fresh.
alias_base_exact	Email's canonical form (plus-alias stripped, Gmail dots stripped) matches a known temp-mail base account on Gmail, Outlook, Hotmail, Live, MSN, or iCloud. See Plus-Alias Detection.
free_provider_alias_pattern	Email on a major free provider (Gmail, Outlook, Hotmail, Live, MSN, iCloud) uses an abuse-style aliasing pattern — heavy Gmail dot manipulation or a random-looking +tag — without an exact base-account match. The heuristic cousin of alias_base_exact. See Plus-Alias Detection.

How signals map to detection

The MX-based signals (mx_blacklist_*, mx_ip_blacklist) are what let DISIFY catch disposable services that rotate their domains but reuse the same mail servers — a common evasion tactic that pure domain blocklists miss.

Some signals are sufficient on their own: pattern_heuristic contributes 60 points, while keyword_match contributes 80. Weaker signals can combine. The per-email free_provider_alias_pattern adds context without changing the verdict by itself. See Confidence Scoring for point values and score/verdict differences.

Use signals for tuning, disposable for the verdict

Inspect signals to explain a result or implement a deliberate review policy. Do not treat a particular score as proof of a blacklist match.