Hi!

There are a few things that can cause that. We have multiple endpoints doing the actual work, and then some centralized intelligence behind that. The individual endpoints will cache some domains for a short while, and the backend will do advanced heuristics, intelligence and anomaly detection. A previously unknown domain might be okay “at first sight”. But looking at the “bigger picture” later on, we correlate name servers, DNS records, domain history, etc, to some known bad or disposable domain. This could cause a domain to initially be flagged as okay, but later on we decide it should be blocked.

Also, some domains are “fragile”. If the mail server is temporarily not responding, it could get flagged as a recommended “block”, but that should only happen to badly configured domains, or otherwise “suspicious” entities. A properly set up mail server, and good reputation on “things” (domain, MX, NS, owner, etc) shouldn’t get that result.

If you have any specific examples that often gets different results, please send them to: support (at) check-mail.org