No account · free · takes one minute

Who is sending as you.

Gmail, Yahoo and Microsoft already mail you a report every day listing every address that sent mail claiming to be your domain. Almost nobody reads them, because they arrive as gzipped XML. Give us an address to send them to and we will read them for you.

What you will actually see

Four outcomes, from two bits, and only one of them is ever your problem.

Authenticated as you
SPF and DKIM both aligned. Mail you sent, arriving as you intended.
Forwarded, not forged
SPF failed, DKIM passed. SPF breaks by design when a message is forwarded — the forwarder becomes the sending host. DKIM signs the message and survives. This is a mailing list or an auto-forward, and it is the single largest source of red rows in every other tool.
Sent by you, but nothing signed it
SPF aligned, DKIM did not. Usually a platform where DKIM was never finished.
Nothing proves this came from you
Neither aligned. A sender you forgot, or someone using your domain — the address and the volume tell you which. This is the only row that has ever needed anybody to do anything.

The honest parts

The link is the key. There is no account, so whoever has your results URL can read your results. That is the same trade the one-time message check makes. A report contains sending addresses and message counts — never message content, subjects or recipients — so the thing at risk is a list of your senders, not your mail. If that is not a trade you want, this is not for you and the trade is stated here rather than buried.

Reports take a day to start. Receivers batch them every 24 hours, so the page will be empty until tomorrow. It says so rather than showing you a zero and letting you conclude something is broken.

We keep 60 days. Long enough to see a weekly pattern, short enough that we are not sitting on a year of anyone's sending history.

You can point more than one tool at it. The rua tag takes a comma-separated list. Nothing here asks you to stop using whatever you already have, and if you are testing us against it, that is the correct way to do it.

Not sure whether you publish DMARC at all? Check the domain first — it reads the record live and tells you what the policy currently says.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.