emailrules.today

A check of the message, not the DNS

Send us your actual campaign.

We will tell you what is technically wrong — like everyone else — what is legally exposed, like nobody else, and whose job each one is. DNS shows what you published. A message shows what you actually send.

The inbound address is not switched on yet. Rather than show you a box that silently does nothing, here is the door that works today: paste one whole message and the same engine reads it — the same findings, the same rules, the same result page.

Paste a whole message

What it reads

Everyone checks a message against authentication. Nobody checks one against consent.

  • DKIM alignment on the message you actually sent

    The d= domain against the From domain, plus whatever the receiver recorded. DNS can tell you a key is published; only a real message can tell you it signed the right domain.

  • One-click unsubscribe, both headers

    List-Unsubscribe and List-Unsubscribe-Post. One without the other does not satisfy RFC 8058, and one without the other is the single most common real failure.

  • A postal address in the body

    CAN-SPAM requires one on commercial mail. An address that lives only inside an image is not one, because the text is all a filter ever reads.

  • Whether Apple has any text to summarise

    Apple Mail writes its own preheader from the first live text. Image-only campaigns get summarised from the subject line, and alt text does not save you.

  • Open tracking, stated as a fact

    Whether the message carries a pixel, then the French rule that is in force and the Italian one that starts on 29 October 2026 — conditional on where you send, never asserted as a verdict.

  • The subject line against the body it describes

    Only what a single message can defend: an offer named in the subject that is nowhere in the text, or a manufactured Re: on a message that is not a reply.

Every finding names the dated rule it comes from and says whether it is your ESP's job, shared, or yours — with the one concrete first move. There is no score, no grade and no percentage, here or on the share card.

What we keep

The findings. Not the message.

We store the findings, the From domain, the verdict sentence and the two dates. We do not store the body, the subject, the recipient, the address you sent from, or the raw headers. The message is parsed in memory and dropped. The share link expires after 30 days, and the page tells you the date it goes.

Send a real campaign, not a test with customer data in it. We read the HTML for facts and never render it, follow no link in it and run nothing from it — but the honest advice is still to send the same message you send your list, not one addressed to a person.

Already have the headers?

Paste a whole message instead. It runs the same engine — paste the full source and you get the content and consent findings too, not only the authentication ones.

For what you have published rather than what you send, check a sending domain.

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.