---
title: "Reason Codes"
description: "Every risk and trust reason code SignupSieve returns, what each one means, and how it affects the verdict."
canonical_url: "https://signupsieve.pages.dev/docs/reason-codes"
---

> Index of every page on this site: [llms.txt](https://signupsieve.pages.dev/llms.txt)

# Reason codes

**Risk signals** (lower the score)

<table>
<thead>
  <tr>
    <th>
      Code
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        disposable_domain
      </code>
    </td>
    
    <td>
      Known throwaway email service. Always blocks.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        domain_does_not_accept_mail
      </code>
    </td>
    
    <td>
      The domain cannot receive email. Always blocks.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        shares_mail_servers_with_disposable_domains
      </code>
    </td>
    
    <td>
      A new domain using the same mail servers as throwaway services.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        domain_typo
      </code>
    </td>
    
    <td>
      The domain is a typo of a popular one and cannot receive mail. Check <code>
        did_you_mean
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        possible_domain_typo
      </code>
    </td>
    
    <td>
      The domain looks like a typo but does receive mail.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        unnatural_name
      </code>
    </td>
    
    <td>
      The part before <code>
        @
      </code>
      
       does not look like a human name.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        keyboard_pattern
      </code>
    </td>
    
    <td>
      Keyboard walks such as <code>
        qwerty
      </code>
      
       or <code>
        asdf
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        long_digit_run
      </code>
    </td>
    
    <td>
      A long run of digits.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        repeated_characters
      </code>
    </td>
    
    <td>
      Things like <code>
        aaaa
      </code>
      
       or <code>
        xxxx
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        very_short_local_part
      </code>
    </td>
    
    <td>
      One or two characters before <code>
        @
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        no_letters
      </code>
    </td>
    
    <td>
      No letters before <code>
        @
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        role_account
      </code>
    </td>
    
    <td>
      A shared inbox such as <code>
        info@
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        newly_registered_domain
      </code>
    </td>
    
    <td>
      The domain was registered recently.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        breaks_domain_address_pattern
      </code>
    </td>
    
    <td>
      Does not follow the company's usual address shape.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        plus_alias
      </code>
    </td>
    
    <td>
      Uses a <code>
        +tag
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        dotted_gmail
      </code>
    </td>
    
    <td>
      A Gmail address with dots. Often harmless; it matters when combined with other signals.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        same_inbox_many_aliases
      </code>
    </td>
    
    <td>
      You have seen many spellings of this same inbox.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        signup_burst_at_domain
      </code>
    </td>
    
    <td>
      Many unique signups at this domain in the last 10 minutes.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        domain_reported_fake_by_customers
      </code>
    </td>
    
    <td>
      Other customers report fake signups from this domain.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        datacenter_ip
      </code>
    </td>
    
    <td>
      The IP belongs to a cloud server.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        tor_exit_node
      </code>
    </td>
    
    <td>
      The IP is a Tor exit node.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        many_signups_from_ip
      </code>
    </td>
    
    <td>
      Many different inboxes from this IP in the last hour.
    </td>
  </tr>
</tbody>
</table>

**Trust signals** (raise the score)

<table>
<thead>
  <tr>
    <th>
      Code
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        natural_name
      </code>
    </td>
    
    <td>
      Looks like a real human name.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        work_domain
      </code>
    </td>
    
    <td>
      A company domain.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        school_domain
      </code>
    </td>
    
    <td>
      A school or university domain.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        privacy_relay
      </code>
    </td>
    
    <td>
      A privacy relay: a real person hiding their address.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        matches_domain_address_pattern
      </code>
    </td>
    
    <td>
      Follows the company's usual address shape.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        domain_has_spf
      </code>
    </td>
    
    <td>
      The domain has an SPF record.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        domain_has_dmarc
      </code>
    </td>
    
    <td>
      The domain has a DMARC record.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        domain_trusted_by_customers
      </code>
    </td>
    
    <td>
      Other customers report this domain's signups as real.
    </td>
  </tr>
</tbody>
</table>

## Sitemap

See the full [sitemap](https://signupsieve.pages.dev/sitemap.md) for all pages.