For technicians

How monitoring works

InboxGrade monitoring is deliberately boring. You run a short bash script on your own mail server; it sends one small plain-text email to us through your MTA — the same code path your real production mail uses — and we grade it. No agent, no daemon, no inbound firewall rules, no credentials on your server besides a per-monitor install secret.

What the script does, step by step

1. Mint: HTTPS POST to inboxgrade.io/api/monitor/mint with the install secret you were issued. Receives a token and a one-time mint address like test-abcd12@tests.inboxgrade.io.
2. Compose: Builds a ~400 byte plain-text MIME message. From is the host's FQDN (or whatever you put in INBOXGRADE_FROM). To is the one-time mint address. Body is literally "InboxGrade synthetic probe. Token: XXXX".
3. Send: Pipes the message to /usr/sbin/sendmail -t -f <sender>. Delivery uses your MTA exactly as production does — same relays, same keys, same reputation. We never touch your queue.
4. Grade: Our Postmark inbound receives it, parses headers, scores SPF/DKIM/DMARC/TLS/PTR/List-Unsubscribe/blacklists/BIMI/MTA-STS, writes a row to Postgres.
5. Verify: The script polls /api/tests/<token> for up to 60 seconds. Prints OK + grade on success. Exits 2 if the score is below your configured threshold, 1 on infrastructure error, 0 if clean.

What the script does not do

• Does not read your mail queue, inbox, logs, or configuration files.
• Does not install anything on your system. It's a single shell file; delete it to uninstall.
• Does not open any inbound ports or require firewall changes.
• Does not require root. Run as any user that can invoke sendmail.
• Does not store state between runs. All config is baked into the script itself.
• Does not call out to anywhere other than inboxgrade.io and your own MTA.
• Does not phone home with system info, hostnames, user lists, or anything else beyond the probe email itself.

What leaves your network

1. One HTTPS POST to inboxgrade.io containing the install secret.
2. One plain-text email to tests.inboxgrade.io via your normal outbound mail path.
3. Up to 20 small HTTPS GETs to inboxgrade.io polling for the grade.

What we store

• The parsed metadata of the probe emails you send us (headers, auth results, source IP, from address). Standard inbound mail metadata.
• Grade history for your dashboard and trend chart.
• Your install secret, hashed. Rotatable from the dashboard at any time (invalidates the running script).

We don't retain the raw message body of a monitor probe past 24 hours; see privacy.

Review the full source before you install

The script is generated per-monitor with your interval, threshold, and secret baked in. It's roughly 60 lines of POSIX bash and has no dependencies beyond curl and your sendmail binary. Open it in your editor before chmod +x; nothing to hide.

Running on a minimal container? If sendmail isn't present, point the SENDMAIL variable at msmtp, ssmtp, Postfix's sendmail, or any binary that accepts an RFC 822 message on stdin.