AI agents over MCP
Delegate the routine work to Claude, ChatGPT or Cursor: DKIM key audits, "what changed overnight", DMARC enforcement calls, new-client intake and spam-folder forensics. One sign-in, ten tools, read-only by default, and it can never touch your DNS. A public server runs the DNS checks with no account.
Posture score
One number per domain (0–100, A–F) built from SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT, BIMI, reverse DNS and five DNS blacklists. Weighted so DMARC enforcement matters most, and every finding links to the exact record that fixes it.
DKIM key management
Every selector in one inventory: discovered from the default selectors of each major provider, learned from the selectors that sign your mail in DMARC reports, or added by you. Key type, size and fingerprint, provider-hosted (CNAME) keys, key age with rotation reminders, full rotation history, and which signers do not align.
DKIM signature validator
Paste a raw message and every DKIM signature is verified again from scratch: body hash, RSA or Ed25519 signature against the published key, and alignment with the From domain. No trusting the receiver's Authentication-Results header.
Drift detection
Each check snapshots every record. Consecutive checks are diffed: a weakened DMARC policy, a vanished DKIM key, a changed MX set or a new blacklist listing becomes a change entry with a severity and, when it matters, an alert.
DMARC report analysis
A report address per domain, signed inbound webhook or file upload. Reports are kept as received and parsed into sources, alignment and daily volume. Known senders are labelled automatically; unknown ones are called out.
Enforcement advisor
The advisor reads your last 30 days of reports and says plainly whether you can move to p=quarantine or p=reject, what is blocking it, and gives the record to publish, starting at pct=25.
Alerts where you work
Email to the team owner by default. Add rules for extra email addresses or Slack, per domain or for the whole team, with a minimum severity.
Signed webhooks
Subscribe your own endpoints to DKIM key rotations, record changes, blacklist listings, alerts and new DMARC reports. Standard Webhooks signatures, retries with backoff, a delivery log with redelivery, and secret rotation without downtime.
Fix-it records
Host, type, value. Complete and exact. When the right value depends on something we cannot know (your sender list), we say so instead of guessing.
Domain security
Registration expiry through RDAP, TLS certificate expiry on the web host, and lookalike domains (typos, homoglyphs, swapped TLDs) that become active with MX records.
Email intelligence
Introduction-style checks for single addresses or CSV lists: syntax, MX, provider, free, disposable, role, sender-policy strength and a risk score with reasons.
Built for many domains
Clients group domains for MSPs and agencies. Invite teammates with roles, import domains from CSV, share a read-only domain page with a client, print a monthly posture report with your own brand.
API and MCP
A REST API with an OpenAPI 3.1 spec for automation, and an MCP server (OAuth or team token) so Claude, ChatGPT or Cursor can check a domain, audit DKIM keys, verify a message, read DMARC advice or list what changed, with the same engine.
In early access
Two products in private beta, on the same team, API token and agent connection.
Email verification: list cleaning and API
Upload a list in the dashboard, or call the API, and get every address back as deliverable, risky, undeliverable or unknown with the reason.
Inbound and outbound email filtering
Inbound filtering stops spam, phishing and spoofed senders before they reach your mailboxes; outbound filtering stops a compromised account from getting your IPs and domain blacklisted.
Start with one domain, free.
Publish one TXT record to prove ownership. The first check runs within a minute.
No card for the free plan · Billing by Stripe · We never send mail on your behalf · Privacy