The signed record
Verify a Receipt
Its name and its signature, checked in your browser
A Toreject receipt is the daily record of one domain as canonical JSON: every read with its resolver and time, the policy on each date, the SPF lookup count and the date of each step. Its name is the SHA-256 of those bytes, and when the server holds a signing key, the bytes carry an Ed25519 signature. This page recomputes both. It asks the server for one thing, the public key at /api/receipt-key, and the receipt itself never leaves your browser.