public DNS · nothing sent · nothing stored
What does the internet actually say about your email?
Type your domain. We look up what public DNS really publishes about it, draw the answer under the same rendering law we use in production, show you the records verbatim, and tell you the second we looked.
nothing checked yet
A published record and a protected domain are two different claims.
A DMARC record that reads p=none is published — we read it, so we draw its node solid — and it asks receivers to do nothing about mail that fails. Every other checker in this category renders that as a green tick, because a record exists. We draw the segment leaving it dashed, because the protection does not.
v=DMARC1; p=none; rua=mailto:…
published · not protecting anything
The four states, and what each one is a claim about
- witnessedsolid
- We queried the name, the resolver answered, and the record says what it needs to say. We saw it.
- inferredhollow
- We derived it rather than observed it. Nothing on this page is inferred — DNS either answered or it did not — but the state is drawn in the legend because the law is one law everywhere.
- unknowndotted
- We looked and found nothing, or we have not looked yet. The resting state of this page is entirely dotted for that reason.
- stoppedsevered
- It ends here and the reason is printed beside it: a mechanism blocked by a precondition, a domain that does not exist, or a resolver that would not answer.
It is the same rule inside the product. An open is a tracking pixel firing, so an opened station renders hollow on every message in the dashboard, forever. We never draw a solid line through something we did not observe — which is most of what rootmail is.
What this page will not do
- We do not send anything.
- Not a test message, not a verification email, nothing. This reads public DNS and that is the entire extent of it. You typed a domain into an email company's input box; you are owed that sentence before you have to ask for it.
- We do not store your domain.
- It is not written to a log, a cookie, a session or an analytics event. It exists for the length of one request and goes back to you. The rate limit counts lookups against a salted hash of your address and never sees the domain at all.
- There is no permalink.
- The result has no URL of its own, and the answer travels in the body of a POST rather than a query string so it never lands in an access log or a referrer. Screenshot it — that is the sharing mechanism. A shareable link would make us a public directory of other people's DNS posture, which is a different and worse product.
- This is a live resolver, always.
- rootmail ships a mock DNS mode for local development, and this page cannot reach it: the lookups here are written against a real resolver directly and no environment variable can turn them into a simulation. A mock rendering as a result would be exactly the lie this page exists to refuse.
- “We could not look” is never drawn as “you have no record”.
- A resolver that fails is a fact about our lookup, not a fact about your DNS. A failed query renders as a severed line that says so; only a resolver that positively answered “there is nothing published at that name” is allowed to render as not-found.
10 lookups an hour from one address, 200 an hour across everyone · each lookup gets 3 seconds and then we say we do not know
the same answer as JSON: POST /api/check with {"domain":"yourbusiness.com"} — it refuses GET so the domain never lands in a URL