Privacy

The short version: the tools run in your browser, we do not have accounts, we do not use cookies, and we do not keep a record of what you check. The rest of this page says exactly what does happen, because "we take your privacy seriously" is not a fact.

What happens when you scan a domain

Every DNS check (SPF, DKIM, DMARC, MX, BIMI, MTA-STS, blocklists, the Domain Report, the stack detector) runs in your browser. Your browser asks a public DNS-over-HTTPS resolver directly: Cloudflare (1.1.1.1) first, Google (8.8.8.8) as a fallback. Those queries never pass through our servers. The resolvers see the DNS names being looked up, under their own policies (Cloudflare, Google).

The New Domain Readiness check also asks the domain's registry over RDAP (via rdap.org) for the registration date, and probes whether the domain's website answers. Again from your browser.

One exception: a report link like theemailstack.com/report/example.com is served by a small Cloudflare Worker that writes the domain into the page title so shared links preview properly. That request reaches Cloudflare's edge. We have request logging for that Worker turned off, so we do not keep a list of the domains people look up. Cloudflare keeps its own aggregate traffic statistics for the zone, without paths.

What happens when you open a message

The EML Viewer, the DMARC Report Reader, the Inbox Mix Report and the header analyzer parse your files entirely in your browser. The file is never uploaded. The only things that leave your device are DNS lookups for domains and IP addresses found in the message (to re-verify DKIM, read the DMARC record, and check reverse DNS and blocklists), sent to the public resolvers above. Remote images in a message are blocked until you choose to load them, because loading them tells the sender you opened it.

What we receive from you

• Newsletter signups and tool submissions are sent as an email to the site owner through Cloudflare Email Routing. We keep that email. We do not put your address into any third-party marketing system without telling you on the form.
• Email you send us at hello@theemailstack.com is forwarded to the owner's mailbox.
• Share links from the Domain Report carry the report's data inside the link itself. Nothing is stored on our side; whoever you send the link to gets exactly what is in it.

Analytics

We use Cloudflare Web Analytics, which counts page views without cookies, without fingerprinting, and without tracking you across sites. There are no advertising pixels on this site.

What we do not do

• No accounts, no logins, no cookies.
• No access to anyone's inbox. We never ask for mailbox credentials or OAuth scopes.
• No storage of scanned domains, uploaded messages, or DMARC reports.
• No sale or sharing of anything to data brokers or advertisers.

Hosting

The site is served by Cloudflare from its global network. Cloudflare processes connection metadata (IP address, request headers) to deliver the site and to protect it, under Cloudflare's privacy policy.

Questions

Write to hello@theemailstack.com. If something on this page turns out to be wrong, we will fix the behaviour or the page, whichever is wrong.