The ledger
Read the Records
MX, SPF, DMARC and DKIM, read from public DNS
You are offline. The read asks DNS servers on the internet, so it waits for the connection. The ledger stays as printed.
Specimen: our own host, read 10 Oct 2026 at 03:20 UTC.
| Record | What we read | Verdict |
|---|---|---|
| MXwhere mail to you is delivered | no recordNo MX record. Mail sent to this domain has nowhere to go and bounces. |
Fails |
| SPFthe list of servers allowed to send as you | no recordNo SPF record. Anyone can claim to send as you, so Gmail and Yahoo treat your real mail with suspicion. |
Fails |
| DMARCwhat receivers do with a message that fails | no recordNo DMARC record. Since February 2024 Gmail and Yahoo require one from anyone sending in bulk, and they file mail without it as suspect. |
Fails |
| DKIMthe signature that proves a message came from you | no key readNo key at the 20 selectors we tried. Your provider may use one we did not guess; their DKIM page names it. |
No key read |
Nothing at toreject.vercel.app says who may send its mail or what to do with a forgery, so Gmail, Yahoo and Outlook have no reason to trust a message that claims to come from it.
That is our own host. It sends no mail, so publishing none of these records is the right answer for it. Type your domain above to read yours.
The Ladder
None to quarantine to reject, each step dated
p=none
Receivers report forgeries to the address in your record and deliver them anyway. You paste it on day one, and the reports show every server that sends as you.
Dated
p=quarantine
Mail that fails goes to spam. This is enforcement: receivers act on a failure instead of only reporting it.
Dated
p=reject
Mail that fails is refused. A forgery of your domain never reaches an inbox, and a bounce tells you the day one of your own services stops signing.
Dated
Step up one rung when the daily record shows 7 days in a row with every listed service's DKIM key published and the SPF record within 10 lookups. Paste p=quarantine on the day the record says safe, then p=reject after 7 more clean days at quarantine.
Why is my mail bouncing?
Because the receiver could not tell the message came from you. Since February 2024 Gmail has asked every sender for SPF or DKIM, and anyone sending 5,000 or more messages a day for all three records; Yahoo set the same bar for bulk senders that month. Outlook.com has sent mail from large senders without them to Junk since 5 May 2025, with rejection to follow.
Gmail's bounce for it reads, word for word: 550 5.7.26 This email has been blocked because the sender is unauthenticated. (Gmail SMTP errors and codes). The ledger above shows which record is behind it.
What the Read Leaves Out
Four limits, printed before you pay
No message is opened
The read asks public DNS for four kinds of record. No mail passes through us, and the signed record says so in its first line: alignment is inferred from what you publish.
The reports go to you
Receivers mail their daily reports to the address in your DMARC record, which is yours. Reading them is your job, or the call's, in this version.
Keys at the names we know
A DKIM key is found only at the selector names we ask for. HubSpot and Shopify number theirs per account, so the read needs yours before it can find them.
Our own host fails
toreject.vercel.app sends no mail, so it publishes none of these records. The specimen in the ledger is that read, dated.
The method, with every source and the prices of the alternatives