Reason codes

Risk signals (lower the score)

Code	Meaning
`disposable_domain`	Known throwaway email service. Always blocks.
`domain_does_not_accept_mail`	The domain cannot receive email. Always blocks.
`shares_mail_servers_with_disposable_domains`	A new domain using the same mail servers as throwaway services.
`domain_typo`	The domain is a typo of a popular one and cannot receive mail. Check `did_you_mean`.
`possible_domain_typo`	The domain looks like a typo but does receive mail.
`unnatural_name`	The part before `@` does not look like a human name.
`keyboard_pattern`	Keyboard walks such as `qwerty` or `asdf`.
`long_digit_run`	A long run of digits.
`repeated_characters`	Things like `aaaa` or `xxxx`.
`very_short_local_part`	One or two characters before `@`.
`no_letters`	No letters before `@`.
`role_account`	A shared inbox such as `info@`.
`newly_registered_domain`	The domain was registered recently.
`breaks_domain_address_pattern`	Does not follow the company's usual address shape.
`plus_alias`	Uses a `+tag`.
`dotted_gmail`	A Gmail address with dots. Often harmless; it matters when combined with other signals.
`same_inbox_many_aliases`	You have seen many spellings of this same inbox.
`signup_burst_at_domain`	Many unique signups at this domain in the last 10 minutes.
`domain_reported_fake_by_customers`	Other customers report fake signups from this domain.
`datacenter_ip`	The IP belongs to a cloud server.
`tor_exit_node`	The IP is a Tor exit node.
`many_signups_from_ip`	Many different inboxes from this IP in the last hour.

Trust signals (raise the score)

Code	Meaning
`natural_name`	Looks like a real human name.
`work_domain`	A company domain.
`school_domain`	A school or university domain.
`privacy_relay`	A privacy relay: a real person hiding their address.
`matches_domain_address_pattern`	Follows the company's usual address shape.
`domain_has_spf`	The domain has an SPF record.
`domain_has_dmarc`	The domain has a DMARC record.
`domain_trusted_by_customers`	Other customers report this domain's signups as real.