Everything InboxGrade can do

Point your DMARC rua= at us and we parse every aggregate report your receivers send. Free, unlimited, no seat pricing.

• DMARC Aggregate Ingest

  Point your DMARC rua= at a per-domain ingest address and we parse the daily XML reports from Google, Microsoft, Yahoo, and the rest.

• Per-Source-IP Breakdown

  Every sending IP that touched your domain, grouped with SPF, DKIM, alignment, message count, and applied policy.

• Forged vs Legit Sender ID

  Reverse DNS and ASN lookups separate your real senders (ESPs, forwarders) from spoofing attempts.

• Policy Evolution Timeline

  Track p=, sp=, and pct= as reporters observed them so you can move from none to quarantine to reject with data.

• Raw XML Archive

  Every report is kept in its original XML in object storage, downloadable at any time.

The core of InboxGrade: a weighted A-F grade across 11 deliverability dimensions, computed from the raw message your receiver actually saw.

• Overall Grade (A-F)

  A single letter grade from a weighted score across 11 deliverability dimensions, so you know at a glance if your mail is landing.

• SPF Auth Check

  Parses the Received-SPF header from the inbound MX to confirm envelope-from authorization pass/fail.

• SPF Syntax Audit

  Walks your SPF record tree, counts recursive DNS lookups against the RFC 7208 limit of 10, and flags duplicates, +all, and nested-include risks.

• DKIM Verification

  Cryptographically verifies every DKIM signature against the raw MIME using mailauth, with a per-signature verdict plus key-length warnings.

• DMARC Alignment

  Derives SPF-aligned and DKIM-aligned verdicts against the From domain to produce an RFC 7489 DMARC pass/fail.

• Blacklist Lookups

  Real-time DNSBL checks of your sending IP against Barracuda, SORBS, SpamCop, Mailspike, UCEPROTECT, PSBL, WPBL, and more.

• SpamAssassin Score

  Reports every SpamAssassin rule that fired on your message with a plain-English explanation.

• TLS Version Check

  Parses STARTTLS version and cipher from Received headers to flag outdated TLS on the delivery path.

• PTR / rDNS Check

  Forward-confirmed reverse DNS lookup of your sending IP against the HELO hostname.

• MTA-STS & TLS-RPT

  Checks for an MTA-STS DNS pointer with enforce/testing mode and a TLS-RPT reporting record.

• BIMI Check

  Resolves default._bimi TXT with logo (l=) and VMC (a=) parsing so your brand mark shows in Gmail.

• List-Unsubscribe

  Validates List-Unsubscribe and List-Unsubscribe-Post for RFC 8058 one-click compliance required by Gmail/Yahoo bulk rules.

• ARC Chain Parsing

  Parses and verifies every ARC-Seal, ARC-Message-Signature, and ARC-Authentication-Results hop so forwarded mail keeps its auth.

• URL / Link Analysis

  Extracts every link in the body, flags shorteners, mismatched display text, and ranks domains for reputation risk.

• Received-Chain Visualization

  Reconstructs every hop (from/by/with/id/timestamp/TLS) in order so you can see exactly how the message was delivered.

A tiny bash script runs on your mail server and sends a synthetic probe through your production MTA on a schedule — then we alert you when something breaks.

• Scheduled Probe Monitors

  A ~60-line POSIX bash script runs on your mail server and sends a synthetic probe through your production MTA on a schedule.

• Low-Score / Fail Alerts

  Emails you when a monitor probe lands below your configured score threshold or an auth check fails.

• Overdue Monitor Alerts

  Notifies you when an expected probe never arrives, surfacing silent delivery failures.

• Rotatable Install Secret

  Hashed per-monitor install secret, rotatable from the dashboard to invalidate a running script.

Every report InboxGrade generates is addressable, cacheable, and open. No auth, open CORS, versioned, edge-cached.

• Public JSON API v1

  Versioned read-only REST at /api/v1 with no auth, open CORS, and edge caching for reports, history, and leaderboard.

• Report Fetch by Token

  GET /api/v1/report/{token} returns the full parsed check tree, grade, score, delivery path, and report URL.

• Per-Sender-IP History

  GET /api/v1/history/{ip} returns up to 100 past reports and a trend series for any sending IP.

• Public Leaderboard

  GET /api/v1/leaderboard ranks top sender domains over a configurable rolling window with avg/best/worst scores.

• Shareable Report Permalinks

  Every test gets a /r/{token} URL you can send to your email provider or hand to a client.

Sign-in accounts, saved history, white-label PDF export, and billing — the account-side features that turn one-off checks into an ongoing deliverability practice.

• Saved Test History

  Signed-in accounts keep every test with a 30-day score chart and pass-rate stats.

• PDF Export (White-Label)

  Export any report as a branded PDF for client deliverables or ticket attachments.

• Clerk Accounts

  Sign in with Google, Microsoft, or email via Clerk to unlock saved history, monitors, and DMARC Analytics.

• Stripe Billing

  Pro tier billed through Stripe for history, monitoring, and PDF export.