---
title: Spam Domains
description: What the spam field flags, how it differs from disposable, and what a false value does and does not mean.
---

`spam` is `true` when a domain has been flagged in UserCheck's dataset for spam or other abusive activity.

The field is returned by the [domain](/docs/api/domain-endpoint) and [email](/docs/api/email-endpoint) endpoints, and is available in Gates as `domain.spam`.

The flag is about a domain's observed behaviour, not its configuration, so it is not derivable from the other fields in the response.

## Relationship to disposable

The two are independent fields answering different questions. `disposable` is about whether addresses on the domain are temporary; `spam` is about whether the domain has been associated with abuse.

They do interact in one direction worth knowing about. `disposable` is only set once a domain is confirmed to belong to a temporary email service, so a domain that is clearly being abused but not yet confirmed as one is commonly flagged as spam first, and may move to `disposable` later. A domain you expected to be disposable can therefore show up as `spam: true, disposable: false`. See [Disposable Domains](/docs/concepts/disposable).

## Scope of the flag

`spam` is reserved for domains that are widely and clearly used as abuse infrastructure. It is a broader, less clear-cut judgement than `disposable`, so the bar for flagging one globally is that the abuse is recognizable across many accounts rather than confined to a single target.

That means a small operation aimed at one site specifically may never appear here, even when it is unmistakable abuse from that site's point of view. Domains in that category belong on your account's own blocklist, which is scoped to you and takes effect immediately. See the [Blocklist endpoint](/docs/api/blocklist-endpoint).

## Reading a false value

`spam: false` is the default state of a domain and carries no positive information. It means nothing has been recorded against the domain, not that it has been cleared. Most unflagged domains are perfectly ordinary, and a domain that has only just started being used for abuse looks the same as one that never will be.