Built to report evidence, not impressions

mailauth reads the raw headers of an email and tells you what actually happened to it: whether SPF, DKIM and DMARC passed, whether they line up with the domain the message claims to come from, which servers it travelled through, and what the receiving provider recorded about it.

The one thing it will not do

It will not guess and present the guess as a finding. This sounds like a small thing and it is the entire design.

• When Microsoft stamps where a message actually landed, the tool reports Inbox or Junk as recorded fact. When the provider does not record it — Gmail does not — it says so instead of inventing a placement.
• When a blocklist refuses the query rather than answering it, that is reported as an error, not as “clean”. Several competing tools read a refused query as a clean result, or as a listing, and both are wrong.
• Alignment is judged against the policy the domain actually publishes, not against a fixed assumption about strict or relaxed mode.
• A message can carry several DKIM signatures. DMARC needs one that both passes and aligns, so a second unaligned signature is reported as ordinary, not as a failure.

Free, and why

The analysis runs in your browser, so serving it costs almost nothing. There is no account, no signup and no advertising. A paid tier is planned later for the checks that genuinely need a server — querying blocklists that refuse public resolvers, for one — but everything the browser can do will stay free.