Spam Domains

spam is true when a domain has been flagged in UserCheck's dataset for spam or other abusive activity.

The field is returned by the domain and email endpoints, and is available in Gates as domain.spam.

The flag is about a domain's observed behaviour, not its configuration, so it is not derivable from the other fields in the response.

Relationship to disposable

The two are independent fields answering different questions. disposable is about whether addresses on the domain are temporary; spam is about whether the domain has been associated with abuse.

They do interact in one direction worth knowing about. disposable is only set once a domain is confirmed to belong to a temporary email service, so a domain that is clearly being abused but not yet confirmed as one is commonly flagged as spam first, and may move to disposable later. A domain you expected to be disposable can therefore show up as spam: true, disposable: false. See Disposable Domains.

Scope of the flag

spam is reserved for domains that are widely and clearly used as abuse infrastructure. It is a broader, less clear-cut judgement than disposable, so the bar for flagging one globally is that the abuse is recognizable across many accounts rather than confined to a single target.

That means a small operation aimed at one site specifically may never appear here, even when it is unmistakable abuse from that site's point of view. Domains in that category belong on your account's own blocklist, which is scoped to you and takes effect immediately. See the Blocklist endpoint.

Reading a false value

spam: false is the default state of a domain and carries no positive information. It means nothing has been recorded against the domain, not that it has been cleared. Most unflagged domains are perfectly ordinary, and a domain that has only just started being used for abuse looks the same as one that never will be.