Privacy policy

Domain checks

When you check a domain, we look up its public DNS records. We don't store the domain or the result. Your IP address is kept briefly (minutes) in a counter that limits how many checks one address can run.

Test emails

When you send an email to a test address, we store the result of our checks and the email's headers (sender, subject, servers it passed through, signatures) so you can see them. We never store the body or attachments. Tests are deleted after 7 days. Anyone with the test page's link can see the result.

Accounts and DMARC reports

• Your account: your email address and a hashed password.
• Your domains, and the aggregate DMARC reports receivers send about them: the receiving organisation, the period, and per sending server its IP address, message counts and SPF/DKIM/DMARC results. We look up the reverse DNS name of those IP addresses to show who sent the mail. Aggregate reports contain no message content and no recipients.
• We don't accept failure (ruf) reports, which can contain parts of messages.
• Reports are deleted 12 months after the period they cover. A report email we couldn't read is kept for 30 days to fix the problem, then deleted.
• When you delete a domain or your account (Settings), its reports are deleted at once.

Where the data is

On our own server at Hetzner in Germany (EU). We don't use analytics or advertising cookies; the only cookies are the ones that keep you logged in and protect forms. We don't share your data with anyone, and we email you only about your account and your domains.