What is built, what is being built, and what is honestly still an idea

Help for every check, in plain words

A page per check explaining what it looks at, what each verdict means, and what to do about it - plus the concepts behind them and a glossary, all reachable without an account.

• One help page for each of the thirteen checks
• SPF, DKIM, DMARC, alignment and policy explained without assuming you already know
• A help page for every screen on this site
• Search across all of it

Read the check help

The free domain check

Thirteen checks across DNS, authentication and hardening, run against public DNS at the moment you ask. The engine is finished and it does real work - but it is not wired up on this site yet, so running a check here returns an error. That is a deployment gap, not a missing feature, and it is the next thing to fix.

• Domain, nameservers and MX - who controls the zone and where mail arrives
• SPF, its lookup budget, DKIM selectors, and the DMARC record, policy, reporting address and rollout percentage
• DNSSEC, MTA-STS, TLS-RPT and BIMI
• A plain-language finding and a recommended action for every one of them
• Not applicable is reported as not applicable, never as a failure
• What is missing: this site cannot reach the check service from its own address, so the panel above fails

The public REST API

Every capability is an endpoint, and the check panel on the home page is a consumer of that API rather than a second copy of the logic. It is deployed and answering on a development address, with the specification generated from the running service. What does not exist is the published address: the host this site's own API reference tells you to call does not resolve, and this site does not reach the API either.

• An OpenAPI specification generated from the running API rather than written beside it
• Versioned in the URL path, with older versions kept working and kept tested
• One error shape everywhere, carrying a correlation id you can quote
• The check catalog is served by the API, so a check added on the server appears on the site without a site change
• What is missing: a published address. There is a development one, but the host the reference documents does not resolve, so nothing here is a stable thing to build against
• Tokens are a separate item below, and they are not open either

Accounts and organisations

Sign-up, sign-in and an organisation you own are built and working, but you cannot get an account from this site. Two separate things are in the way, and both have to go: this site cannot reach the service at all, and the confirmation email cannot leave our hosting account, so the address you enter would never be verified. Treat an account as unavailable rather than as something that half works.

• Email and password sign-up and sign-in, and an organisation created with you as its owner - built, and running
• This site cannot reach the service, so the sign-up form here cannot complete whatever else is true
• Sending of the confirmation email is blocked upstream at the hosting account, not in our code
• Real transactional sending is not wired through yet either, so the block is not the only thing in the way
• The free plan does not yet unlock anything the check does not already give you without an account

Your account panel

The signed-in surface: navigation, a dashboard, your domains and your past checks. The shell is built and the screens render, but a signed-in browser session cannot yet read its own domains or check history, so the dashboard has nothing real to show.

• Left navigation, breadcrumbs and a dashboard landing screen
• Your domains, and the checks you have already run, listed against them
• A signed-in session does not yet carry the permission to read either, which is a known defect with a ticket

DMARC report collection and the dashboard

The part that turns a one-off check into monitoring: you publish a reporting address, mail providers send daily reports, and the XML becomes something a person can act on. The pipeline now accepts, parses, classifies and stores a real aggregate report end to end on our own machines - but it is not exposed anywhere you can reach, so you cannot point reports at us today.

• Inbound report intake that does not lose a report under load - built, running on the internal rung only
• Parsing, classification and enrichment of the sending sources
• Pass rate, volume and trend over time, per domain - not built
• Alerts on a new sending source and on repeated spoofing - not built

The domain report

A full report of a check - findings, the evidence behind each one, what to do in what order, and a glossary - on screen and as a PDF you can send to whoever fixes DNS. The template exists; nothing on this site links to it yet.

• Every finding with the record it was read from
• Actions ordered by what changes the outcome most
• A PDF built from the same content as the screen, not a separate document

API tokens and scopes

Minting, listing, rotating and revoking tokens, with scopes that are never implied by one another and are intersected with what your plan sells. The service does all of it. The panel has a screen that LISTS your tokens; creating, rotating and revoking one from there is not built, and the panel cannot reach the service from this site anyway.

• Scopes as resource and action, enforced before a request reaches a handler
• A token can never carry more than the plan behind it
• Rotation and revocation, with an audit trail
• What is missing here: creating, rotating and revoking a token from the panel - the screen lists them but does no more than that
• And, as everywhere on this list, a way for this site to reach the service at all

Inviting your team

Seats, roles and invitations inside your organisation. The service supports it; there is no way to invite anybody from this site, and an invitation would be sent by email, which is the same thing blocking sign-up.

• Invitations by email - and email is exactly what is blocked
• Role presets rather than a permission matrix
• Seat count visible before it bites
• What is missing here: the invite screen, and a working way to deliver the invitation

The MCP server

A thin wrapper over that same API, so an AI assistant operates the product with the same permissions and the same audit trail as a person - never more. It is built and running on our own machines with its tools generated from the specification. It is not published, and it will not be until the API it wraps is stable and tokens are open.

• Tools generated from the API specification rather than hand-written
• Remote MCP over streamable HTTP - running internally, not reachable by you
• Anything that writes DNS deliberately excluded from the developer preset
• Public release is deliberately sequenced behind the API and behind tokens

Report history you can download

Every report kept as a time series, so you can show what a domain looked like before and after a change - and hand that to an auditor or an insurer.

• Reports stored per domain over time
• Download of any past report
• A view of what changed between two of them

Email that is worth receiving

The weekly digest, alerts, and the option to have a report emailed to you rather than read on screen.

• A digest that says what changed and what to do about it
• Alerts you can turn off per kind, not only all or nothing
• The report emailed to an address you choose

What you would pay, before you sign up

Pick a plan and a term, say how many domains you watch, and see the figure - including what the domains past your allowance add. The pricing service that answers is finished and it is the same one an invoice would be produced from, so the quote and the bill cannot disagree. What is missing is the same thing the free check is missing: this site cannot reach that service from its own address, so the calculator on the pricing page returns an error there.

• Domains are what you choose; seats come with the plan
• The monthly figure, the amount actually billed, and how many months that covers
• Domains past the allowance shown as their own line, at the published rate
• Nothing is computed in your browser - the page prints what the pricing service returned
• What is missing: this site cannot reach the pricing service from its own address

Guided enforcement

The step everyone stalls on: moving a domain from monitoring to quarantine to reject without breaking legitimate mail.

• A readiness view built from your own report history
• A proposed DNS change shown as a before and after
• Approval per domain, by a person - enforcement is never applied automatically
• A snapshot of the zone before any write, kept as the rollback

A check result you can send to someone else

The person who runs the check is usually not the person who can change the DNS. A result you can hand to your host, your IT contractor or whoever holds the registrar login - as a link, with the findings and the evidence intact.

• A stable link to a completed check, showing the same findings and evidence
• Unguessable, and it expires - a stale link must not read as current
• It says when the check ran, on its face
• It discloses nothing about who ran it

Plans, billing and the usage meter

Paying for the paid plan, seeing what you have used, and a spend cap that slows service down rather than stopping it.

• The usage meter visible before an overage, not after
• A spend cap that never stops taking your reports
• Prices published only once they are decided - the pricing page marks what is not

Monitoring beyond DMARC

MTA-STS, TLS-RPT, BIMI and DNSSEC are checked today, as part of the free check. Watching them over time, and collecting the reports the first two produce, is not built.

• MTA-STS policy hosting and change detection
• TLS-RPT report collection
• BIMI, including the certificate it requires
• DNSSEC posture over time

Finding the forms on your own site that send mail for strangers

A contact form or a plugin left open is a way to send mail from your domain that DMARC cannot stop, because the mail really is yours. Whether we can detect that safely, and lawfully, is being researched - it is gated on proving you own the domain and on a legal review before it is enabled for anybody.

• Ownership proven before anything is probed
• Non-destructive and rate limited, or not shipped
• A legal and abuse review as a blocking gate
• May not ship at all