Skip to content
emailrules.today
Live · cloudflare.com4 Aug 2026

Nothing here is yours.

One finding is shared with your sending platform. The mechanical half is done and the judgement is still yours.

19 DNS lookups23 blocklists askedno entriesno score, ever

read from DNS, quoted verbatim

SPF
v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
-all
DMARC
v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com
p=reject
DKIM
k1._domainkey (Mailchimp) mandrill._domainkey (Mandrill) s1._domainkey (SendGrid)
3 selectors
BIMI
v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem
published
MX
mxa-canary.global.inbound.cf-emailsecurity.net mxb-canary.global.inbound.cf-emailsecurity.net mxa.global.inbound.cf-emailsecurity.net mxb.global.inbound.cf-emailsecurity.net
receiving
LISTS
none of 23 blocklists hold an entry
23 asked

Who sends as you

Signs your mailMandrill, Mailchimp, SendGridmandrill._domainkey k1._domainkey s1._domainkey
in agreement
SPF authorisesMandrill, Zendeskinclude:spf.mandrillapp.com include:mail.zendesk.com

4 Aug 2026 · no score, no grade, nothing inferred

Who this domain authorises

  • You send through Mandrill

    • include:spf.mandrillapp.comread from your SPF, verbatim
    • mandrill._domainkeyDKIM key present

  • Your SPF authorises Zendesk

    • include:mail.zendesk.comread from your SPF, verbatim

Keys are also published on selectors belonging to Mailchimp, SendGrid, and your SPF does not authorise them. Selectors like k1._domainkey are short enough to collide, so this is worth checking and is not worth believing on its own.

include:_spf.salesforce.com · include:_spf.google.com is Salesforce and Google Workspace, which is where staff read mail. It says nothing about where campaigns leave from, and a checker that counts it as your sending platform has told you about your inbox, not your list.

This is what your DNS authorises, not proof of what you send. A domain can authorise a platform it stopped paying for two years ago, which is why an include on its own is reported as permission rather than as use. Only a real message names the address that actually sent your campaign.

What this cannot see. DNS tells us what you have published, not what you actually send. It cannot read your consent records, your subject lines, or whether DKIM aligns on a real message — the three things that decide where a campaign lands. For those, send us a real campaign and we read them off the message itself.

Whose job each one is

Blocklists

Nothing has an entry for you.

23 lists asked0 with an entry1 could not be asked

cloudflare.com is not on any of the 23 lists that answered us today. That is the whole result — there is no score, and a clean answer is allowed to be short.

Which lists, and which would not answer
  • SpamCopanswered
  • PSBLanswered
  • Mailspikeanswered
  • Spam Eating Monkeyanswered
  • blocklist.deanswered
  • 0SPAManswered
  • InterServeranswered
  • SPFBLanswered
  • GBUdb Truncateanswered
  • s5h.netanswered
  • ZapBLanswered
  • SWINOGanswered
  • Kemptanswered
  • Anonmailsanswered
  • Fabelanswered
  • NoSolicitadoanswered
  • Schulteanswered
  • JIPPGanswered
  • UCEPROTECT Level 1answered
  • UCEPROTECT Level 2answered
  • UCEPROTECT Level 3answered
  • Backscattereranswered
  • SEM Backscatteranswered
  • URIBLdeclined the query

Each of these answered an entry it is required to publish, and one it is required not to, before we believed anything it said about you. A list that fails either is reported as unanswered rather than as clean — because a blocklist that declines to reply looks exactly like one giving you the all-clear. How we choose them.

Check another domainPut this in a one-page briefSee which rules are yours

Putting this in a client report? Embed a live, dated badge that re-checks itself.

Watch this domain

One email if authentication DNS for cloudflare.com actually changes. Same list as rule alerts — one inbox, one promise.

One email when a rule that matches your setup moves. Optional domain: one email if SPF, DKIM or DMARC actually changes in DNS. Nothing else.

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.