Evidence

Every full check carries its evidence: a chronological record of the actual steps we took and what each server said back. It is there so you never have to take a verdict on faith.

How to read it

Evidence is an ordered list of steps. Each line is one thing we did — a syntax parse, a DNS lookup, or a single line of the SMTP conversation — together with the real response we received. You read it top to bottom, the way the exchange actually happened, and the final line is the verdict it led to.

A real example

Here is the evidence behind a risky / catch_all verdict:

1.  syntax        ok            local-part and domain are well-formed
2.  dns / mx       ok            mx=aspmx.l.example.com (pri 1), alt1.aspmx.l.example.com (pri 5)
3.  smtp connect   220           mx.example.com ESMTP ready
4.  smtp ehlo      250           mx.example.com at your service
5.  smtp mail from 250 2.1.0     sender accepted
6.  smtp rcpt to   250 2.1.5     recipient accepted
7.  catch-all probe 250 2.1.5    rcpt to <qkz9r7t3x@example.com> also accepted → domain is catch-all
8.  verdict        risky         mailbox accepted, but the domain accepts everyone; existence unproven

Step 7 is the important one: because the random, non-existent address was also accepted, acceptance of the real address in step 6 proves only that the domain is catch-all.

What evidence is not

Evidence is a record of what happened on the wire. It is never a key-value echo of the input you sent us. You will not see a line like email = you@example.com presented as “evidence” — repeating your own input back is not proof of anything. If a step did not run, it is marked skipped rather than invented.