Privacy policy
We built this site to keep as little about you as possible: no accounts, no cookies, no analytics. The site's own code holds check data in memory for at most 15 minutes; the web server also keeps an access log for 14 days. This page lists everything that is kept, where, and for how long.
In short
- No account, no sign-up, no cookies, no analytics, no advertising, no tracking pixels.
- Your browser loads nothing from other companies: every script, style and image comes from this site.
- When you run a check, the name you check and a counter tied to your IP address are held in the site's memory for minutes, then forgotten; our DNS resolver may keep the DNS answers for that name for up to a day, without knowing who asked. The web server's access log also records your IP address and the page address, which includes the name, for 14 days. Nothing is written to a database.
- DMARC report files you open in the analyzer are read by your browser and never sent to us.
- We never send email to the domains or addresses you check.
What happens when you run a check
A check runs on our server. Your browser sends it the name you entered (for example example.com) as part of the page address or of a request to our API. The server then asks DNS resolvers about that name, and some tools also fetch files over HTTPS from the addresses the domain's records name (the MTA-STS policy, the BIMI logo and its certificate, which can be on another company's server, such as a certificate authority's) or greet its mail servers (see the methodology). Those servers see requests from our server, not from you.
Our code uses your IP address for one thing: counting your checks so that nobody can use the tools to flood our server or someone else's servers. For IPv6 we count per /64 network, not per single address. The web server's access log also records your IP address, to find faults and stop abuse (see the table below).
The SPF, DMARC and BIMI record generators build the record in your browser while JavaScript is on, and then send nothing to us. With JavaScript off, pressing the button sends the form to our server once: the server builds the record from your fields and sends the page back. It does not store the fields; the access log below records only the page address (such as /spf-generator), not what you typed. The DKIM generator creates keys only in your browser and has no such fallback. One exception is planned: once our SPF checker is live, the SPF generator shows a Count lookups now button for includes we have not measured. Pressing it sends only those include names to that checker, one check per name, and nothing else you typed; each check is counted and kept like any other check on this site.
What we keep, and for how long
The first three rows live only in the memory of the server process, and a restart erases them. The access log is a file on the server, deleted after 14 days.
| What | Why | How long |
|---|---|---|
| The result of a check: the name checked, the verdict, and the raw answers from DNS, mail and web servers | So that the same check within a minute is answered at once instead of asking the servers again | 60 seconds |
| The same result under a random ID | So that “Download full evidence” gives you exactly the result you saw | 15 minutes |
| Rate-limit counters: your IP address (or IPv6 /64 network) alone, and together with the domain you checked; and a counter per checked domain | To stop floods of checks, against us or against the checked domain | Each counter disappears at most 10 minutes after the last check that used it |
| Web server access log: time, IP address, the address requested (which for a result page includes the name checked), the page you came from, browser type | To find faults and stop abuse | 14 days |
Stored results contain no information about you: not your IP address, not your browser. The site's own code keeps no log of requests. If the server hits an unexpected error, the error message is printed to the server console, and it can include the name that was being checked. These console messages are deleted after 14 days, like the access log. When the web server hits an error with a request, for example while the site restarts or when a request is too large, it writes a line to its error log with the time, your IP address, the address requested and the page you came from; that log is also deleted after 14 days.
Like every resolver, our DNS resolver, which runs on the same server, keeps the DNS answers it receives in its memory for as long as each record's time-to-live allows; ours keeps them at most one day. It does not know which visitor asked and keeps no log of the names it looks up.
DMARC report files
The DMARC report analyzer reads the file you choose inside your browser. The file, its contents and its name are never sent to our server or anywhere else. When you open a file, your browser may download the analyzer's program code from this site; that request contains nothing from your file. The JSON download on that page is created in your browser as well.
Who else handles data
- Our hosting provider runs the server the site is on; the memory and logs described above are on that server.
- DNS resolvers. Every check result names the resolver that answered. When that is a public resolver (such as 1.1.1.1 or 8.8.8.8), its operator sees the names our server looks up, but not who asked.
- Google Workspace hosts our mailbox and may store it outside the EU. If you write to [email protected], your message and address are stored there.
When you email us
If you write to [email protected], we receive your email address and whatever you put in the message, and use them only to answer you. We keep the conversation while it is useful for that and delete it on request.
Legal basis
We process the names you check to run the check you ask for (Article 6(1)(b) of the EU General Data Protection Regulation, GDPR). Our code uses your IP address only to count your checks, so that nobody can use the tools to flood our server or other people's servers: this is our legitimate interest in protecting the service and those servers from abuse (Article 6(1)(f)). The web server's access log and error log serve the same interest and also help us find faults (Article 6(1)(f)). We process emails you send us to answer them, which is also our legitimate interest (Article 6(1)(f)).
Your rights
Under the GDPR you can ask what we hold about you (Article 15) and ask us to correct it (Article 16), delete it (Article 17), restrict its use (Article 18) or send you what you gave us in a machine-readable file (Article 20). Write to [email protected]. Check results and counters are kept only for minutes and not by name. The access log keeps IP addresses and page addresses for 14 days, so if you want us to look there, tell us your IP address and roughly when you used the site; we will tell you what we could check.
Your right to object: you can object at any time to the processing we base on our legitimate interest (Article 21): our use of your IP address for abuse protection and fault finding, and our handling of emails you send us. Write to [email protected].
You can also complain to a data protection authority, in particular the one in the EU country where you live or work (Article 77). Ours is the Estonian Data Protection Inspectorate (aki.ee).
Who is responsible
MX Verdict is built and run by Jevgeni Simonov, a solo developer based in Estonia, in the European Union, who is also the controller of the personal data this site processes. Contact: [email protected].
Changes to this policy
When what we keep changes, this page changes with it before the change goes live, and the date below moves. Checks currently stop after 20 seconds at most, so no request keeps data about you beyond the times listed above.
Page updated .