Skip to content
emailrules.today
Live · oatly.com4 Aug 2026

Two of these are yours.

19 DNS lookups23 blocklists asked1 with an entryno score, ever

read from DNS, quoted verbatim

SPF
v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net include:shops.shopify.com include:sendgrid.net include:emaileuc.freshservice.com include:amazonses.com ip4:77.81.189.101 ip4:46.254.14.229 ip4:168.245.76.176 ip4:194.68.215.35 ip4:87.253.233.197 -all
-all
DMARC
v=DMARC1; p=reject; rua=mailto:yd816iek@ag.eu.dmarcadvisor.com,mailto:rua@dmarc.portsgroup.com;
p=reject
DKIM
k1._domainkey (Mailchimp) s1._domainkey (SendGrid) s2._domainkey (SendGrid) selector1._domainkey (Microsoft 365) selector2._domainkey (Microsoft 365)
5 selectors
BIMI
not published
optional
MX
oatly-com.mail.protection.outlook.com
Microsoft 365
LISTS
1 of 23 blocklists hold an entry
23 asked

Who sends as you

Signs your mailMailchimp, SendGridk1._domainkey s1._domainkey s2._domainkey
in agreement
SPF authorisesMailchimp, SendGrid, Amazon SES, Shopifyinclude:servers.mcsv.net include:sendgrid.net include:amazonses.com include:shops.shopify.com

4 Aug 2026 · no score, no grade, nothing inferred

Who this domain authorises

  • You send through Mailchimp

    • include:servers.mcsv.netread from your SPF, verbatim
    • k1._domainkeyDKIM key present

  • You send through SendGrid

    • include:sendgrid.netread from your SPF, verbatim
    • s1._domainkeyDKIM key present
    • s2._domainkeyDKIM key present

  • Your SPF authorises Amazon SES

    • include:amazonses.comread from your SPF, verbatim

  • Your SPF authorises Shopify

    • include:shops.shopify.comread from your SPF, verbatim

include:spf.protection.outlook.com is Microsoft 365, which is where staff read mail. It says nothing about where campaigns leave from, and a checker that counts it as your sending platform has told you about your inbox, not your list.

This is what your DNS authorises, not proof of what you send. A domain can authorise a platform it stopped paying for two years ago, which is why an include on its own is reported as permission rather than as use. Only a real message names the address that actually sent your campaign.

What this cannot see. DNS tells us what you have published, not what you actually send. It cannot read your consent records, your subject lines, or whether DKIM aligns on a real message — the three things that decide where a campaign lands. For those, send us a real campaign and we read them off the message itself.

Whose job each one is

Blocklists

2 entries need you.

23 lists asked1 with an entry1 could not be asked

Needs you

Which lists, and which would not answer
  • SpamCopanswered
  • PSBLanswered
  • Mailspikeanswered
  • Spam Eating Monkeyanswered
  • blocklist.deanswered
  • 0SPAManswered
  • InterServeranswered
  • SPFBLanswered
  • GBUdb Truncateanswered
  • s5h.netanswered
  • ZapBLanswered
  • SWINOGanswered
  • Kemptanswered
  • Anonmailsanswered
  • Fabelanswered
  • NoSolicitadoanswered
  • Schulteanswered
  • JIPPGanswered
  • UCEPROTECT Level 1answered
  • UCEPROTECT Level 2answered
  • UCEPROTECT Level 3answered
  • Backscattereranswered
  • SEM Backscatteranswered
  • URIBLdeclined the query

Each of these answered an entry it is required to publish, and one it is required not to, before we believed anything it said about you. A list that fails either is reported as unanswered rather than as clean — because a blocklist that declines to reply looks exactly like one giving you the all-clear. How we choose them.

Check another domainPut this in a one-page briefSee which rules are yours

Putting this in a client report? Embed a live, dated badge that re-checks itself.

Watch this domain

One email if authentication DNS for oatly.com actually changes. Same list as rule alerts — one inbox, one promise.

One email when a rule that matches your setup moves. Optional domain: one email if SPF, DKIM or DMARC actually changes in DNS. Nothing else.

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.