# Detection Signals

The optional `signals` array explains detection evidence and temporary DNS failures. Signals can appear with either disposable verdict. Use `disposable` for the verdict and [confidence](https://docs.disify.com/api/confidence.md) for the score. Accept new signal names without breaking your integration.

## Signal reference

| Signal | Description |
| --- | --- |
| `blacklist_exact` | Domain found in the exact domain blacklist. |
| `blacklist_parent` | A parent domain is blacklisted (subdomain walk-up match). |
| `mx_blacklist_exact` | MX hostname found in the MX blacklist. |
| `mx_blacklist_parent` | A parent of the MX hostname is blacklisted. |
| `mx_ip_blacklist` | MX server IP address found in the MX blacklist. |
| `keyword_match` | Domain name contains a recognized keyword such as `tempmail`, `disposable`, or `throwaway`. |
| `pattern_heuristic` | Address matches a suspicious pattern: `tmp+`, `+tmp`, `tmp.`, `.tmp`, or 6 or more dots. |
| `high_entropy` | The first label of the submitted domain looks randomly generated, based on entropy or its consonant-to-vowel ratio. |
| `high_entropy_suspicious_tld` | High-entropy domain combined with a suspicious TLD. |
| `suspicious_tld` | Domain uses a TLD commonly associated with disposable services. |
| `no_mx_records` | Domain has no MX records configured. |
| `dns_indeterminate` | The DNS result was temporarily inconclusive. It adds no confidence and is not cached as a missing record; retry later. |
| `fresh_domain` | Domain age is below the freshness threshold (30 days by default). Requires `domain_age`; also reported as `domain_age.fresh`. |
| `alias_base_exact` | Email's canonical form (plus-alias stripped, Gmail dots stripped) matches a known temp-mail base account on Gmail, Outlook, Hotmail, Live, MSN, or iCloud. See [Plus-Alias Detection](https://docs.disify.com/api/plus-alias.md). |
| `free_provider_alias_pattern` | Email on a major free provider (Gmail, Outlook, Hotmail, Live, MSN, iCloud) uses an abuse-style aliasing pattern — heavy Gmail dot manipulation or a random-looking `+tag` — without an exact base-account match. The heuristic cousin of `alias_base_exact`. See [Plus-Alias Detection](https://docs.disify.com/api/plus-alias.md). |

## How signals map to detection

The MX-based signals (`mx_blacklist_*`, `mx_ip_blacklist`) are what let DISIFY catch disposable services that **rotate their domains but reuse the same mail servers** — a common evasion tactic that pure domain blocklists miss.

Some signals are sufficient on their own: `pattern_heuristic` contributes 60 points, while `keyword_match` contributes 80. Weaker signals can combine. The per-email `free_provider_alias_pattern` adds context without changing the verdict by itself. See [Confidence Scoring](https://docs.disify.com/api/confidence.md) for point values and score/verdict differences.

**Use signals for tuning, `disposable` for the verdict**

Inspect `signals` to explain a result or implement a deliberate review policy. Do not treat a particular score as proof of a blacklist match.

Source: https://docs.disify.com/api/signals.html