Methodology

Who stands behind this

A named human owns the shelf: claims are checked, dated, and corrected in public. Tools may help with typing or research grunt work. They do not invent citations, enforcement theatre, or fake scores. If a page cannot be traced to a primary source a person read, it does not ship. That is the opposite of LLM content farms — and the opposite of vendor blogs that cannot afford to say their product is the problem.

What counts as a source

A rule ships only with a primary source that was read: the regulator’s own publication, the court’s own opinion, the mailbox provider’s own documentation, the RFC, or the platform’s own help centre. Law-firm summaries and trade press are useful for finding things and are never the citation. If a claim cannot be dated, it does not go in.

Why every page states enforcement honestly

An obligation existing and an obligation being enforced are different facts, and conflating them is how compliance content becomes fear-selling. Where nobody has been fined, the page says nobody has been fined. That costs us urgency and buys the thing worth more, which is being trusted the one time it really matters.

Re-verification

Every rule carries a last-verified date. Pages older than 90 days show a warning saying so rather than quietly pretending to be current. The last full review of the corpus was 4 Aug 2026.

Corrections

Send them to tell us on the corrections page. Corrections are published in the page history with a date and a credit to whoever caught it. If we got something wrong, the record of being wrong stays visible. Published corrections are collected at /corrections.

Which blocklists we ask, and which we do not

We ask SpamCop, PSBL, Mailspike and Spam Eating Monkey about addresses, and URIBL about domains. Every one of them answers an entry it is required to publish, and one it is required not to, before we believe anything it says about you. RFC 5782 makes that possible: an address blocklist must list 127.0.0.2 and must not list 127.0.0.1. A list failing either control is reported as unanswered, never as clean, because a blocklist that declines to reply looks exactly like one giving you the all-clear.

Two are missing on purpose. Spamhaus is the one that matters most and the one we cannot ask: its free zones refuse queries from public resolvers, and this site runs on one. Measured on 3 August 2026, its ZEN zone answered an error code through one public resolver and a plain “not listed” through another — for a name that is definitely listed. Reading that second answer as clean is how a tool tells you your domain is fine when it never managed to ask. It switches on if we hold a Data Query Service key, and not before. Barracuda requires registering the addresses that will query it, and serverless functions have no fixed address to register, so using it here would mean using it outside its terms.

Five lists is fewer than the hundred a checker can advertise. Most of that hundred is dead, private, or will refuse an automated querier and be counted as a pass. We would rather name five that answered today.

Conflicts of interest

We sell no tracking pixels, no seed-list testing, no inbox-placement scores and no ESP. We intend to sell continuous monitoring against these rules, and it is disclosed on every page that mentions it. It is not built yet, so today this site sells nothing at all. That is why it can afford to tell you when a tracking pixel is a liability.

Not legal advice

This is a reference for people who ship email, written by an email geek. It is not legal advice and no lawyer reviewed it. Confirm anything that matters with your own counsel before you rely on it.