A working demo · not a product
Two halves of the same problem. Authentication — is this domain allowed to send, and does the record actually work? And the message — will it survive Outlook, dark mode, and the third of readers who have images switched off?
Every DNS record below is fetched live when you press the button. Nothing here is cached, sampled or guessed.
Try , , — or your own. Public DNS only; nothing is sent anywhere but the resolver.
Your message is never stored. It is read inside the one request and the response is the only copy that has ever existed — there is no row in a database to delete. The previews render in sandboxed frames with scripting switched off, so nothing pasted here can run.
RFC 7208 allows a single SPF evaluation ten DNS-querying mechanisms. The eleventh is a permerror, which receivers read as not authorised — so a record can look perfect and be failing. Your senders can push you over the line by editing their own includes, without telling you.
Read off the SPF include chain, which is the one place a domain has to declare its senders. A name you do not recognise is either a platform somebody signed up for and forgot, or a problem.
DNS gives no way to list a domain's selectors, so a prober has to guess them. Envelope tries the 47 that the large platforms actually publish. Nothing found is not proof of nothing there — but it does mean no common platform's key is where it would normally be.
Everything above is arithmetic on the bytes you pasted — it has a right answer and no model is consulted for any of it. Writing is the one job here that is genuinely a language problem, so it is the one job handed to a small open-weight model. It is optional, it runs after the report, and nothing depends on it.
Plenty of tools will tell you a domain "has SPF". Very few resolve the include chain and count the DNS lookups, and that count is what decides whether the record works. A domain sitting at ten is one supplier's edit away from failing SPF everywhere, silently.
resolved live · every include walked
Outlook on Windows renders with the Word engine. Gmail strips most of <style>. Around a third of opens have images off, and Apple Mail inverts palettes it was not told about. The checks here are about surviving hostile renderers, not about being valid.
outlook · dark mode · images off
Not a score out of ten. Each line names the record, the tag, the phrase or the tag count that produced it, says what the receiving end does about it, and gives the fix. You should be able to disagree with any of it.
quotable · arguable · reproducible
A pasted message is analysed inside the request and never written down — there is no row to delete and no retention policy to trust. A domain link saves the domain and nothing else, so opening it later re-runs the lookups instead of showing you a stale snapshot.
no message ever persisted
Envelope reads DNS and reads your message. It does not send mail, does not connect to your mail server, and cannot tell you what a particular provider will do with a particular message on a particular day — nobody can. It tells you which of the things you control are wrong.