# HonestMX verification methodology

HonestMX parses and normalizes an address, resolves its mail routing, classifies known disposable/webmail/provider infrastructure and—when safe—opens an SMTP session to the public mail exchanger. It sends `MAIL FROM` and `RCPT TO` commands but never sends message content or `DATA`.

When the target recipient is accepted, HonestMX compares it with a randomized recipient on the same infrastructure. A random acceptance indicates catch-all behavior rather than proof of the requested mailbox. Recent non-personal control evidence may be reused for six hours only when the MX fingerprint is unchanged; the response and signed receipt identify whether that control was `live` or `cached` and preserve its observation time.

A separate tenant-scoped recipient-result cache can reuse a non-unknown completed observation for seven days. A cache hit creates a new result ID, performs no new SMTP attempt, costs zero, identifies `source=cache`, and preserves the original `checked_at`; reading or reusing it does not extend its evidence age or retention deadline.

`confidence` is a deterministic evidence-strength rubric, not a measured delivery probability. HonestMX does not publish a universal accuracy percentage until trusted real-world outcomes support provider- and rule-specific calibration with documented sample and error thresholds.

The verifier deliberately returns `unknown` when greylisting, source-IP policy, a timeout, an obscuring gateway, or ambiguous SMTP text prevents a recipient-specific conclusion. `catch_all` and `unknown` are not converted into optimistic booleans. A `deliverable` result is an SMTP observation, not an inbox-placement forecast.