Privacy notice

When you press start, we mint a single-use test address. When a message arrives at that address we store:

• the full raw message, exactly as it was delivered, up to 25 MiB;
• its headers and excerpts of its decoded body, including the rendered HTML used for the preview;
• the sender address, the sending IP, and the analysis derived from them — authentication results, blocklist answers, DNS records, scores.

Nothing else. There is no account, no sign-up, no email address of yours on file, and no profile that outlives the test. The tool pages (SPF, DMARC, MX, blacklist and the rest) store nothing at all — they look something up and hand you the answer.

Reports and stored raw messages are deleted automatically within 7 days of the test address being issued. An hourly job does the deleting; a separate storage lifecycle rule removes any raw message still present after 8 days, so nothing survives because a job failed.

We also keep counts — how many messages a purge run deleted, how many blocklist queries a day used. Counts only: no addresses, no tokens, no message content.

MailSends runs entirely on Cloudflare: hosting and Workers for the site and API, D1 for report data, R2 for raw messages, Email Routing for inbound mail, Turnstile for the anti-abuse challenge on the start button, and Web Analytics for cookieless page counts. Cloudflare processes all of the above on our behalf.

Some lookups leave that boundary, because a check cannot be done without asking someone else. Each one below says what is disclosed and to whom:

• DNS. Record lookups go to Cloudflare’s resolver.
• Blocklists. Blocklist checks query Spamhaus and the public DNSBLs named in the report. Those queries necessarily carry the IP address or domain being checked — that is what a blocklist query is. The domains your message links to are checked the same way.
• Registration data. To report how old the sending domain is, we ask that domain’s registry over RDAP, or the public rdap.org directory when we do not know the registry. The query carries the sending domain.
• Domain popularity. We ask Cloudflare Radar how widely the sending domain is queried, and who operates its top-level domain. The query carries the sending domain.
• Link checks. To tell you whether a link works, we request it — so the site you linked to sees a request, as any recipient clicking it would.
• Google Safe Browsing. When configured, the full URLs your message links to are sent to Google to be checked for phishing and malware. This is the largest disclosure on this list: it is message content, not just a domain name. It is optional, and when it is switched off nothing is sent to Google at all.
• Sender-published policies. BIMI logos and MTA-STS policies are fetched from the hosts the sending domain nominates in its own DNS records.

We do not sell data, we do not run ads, and there is no third-party advertising or cross-site tracking script anywhere on the site.

We describe MailSends as anonymous, and we mean something specific by it: no account and no cross-site tracking. We do not know who you are and we do not follow you around the web.

It does not mean the message is anonymous. An email carries personal data by its nature — a from address, a sending IP, headers, whatever is written in the body. All of that is in the report, because the report would be useless without it. Do not send a test message containing anything you would not want the holder of the report link to read.

A report is protected by its link, not by a password. Anyone holding the link can read that report and download the raw message it is about. The secret in the link is unguessable, is kept in the URL fragment so it is never sent to our servers or recorded in logs, and stops working when the report expires. Treat the link itself as the credential: share it only with people you would show the message to.

Questions about any of this, or a request about a specific report: privacy@mailsends.com. Reports expire on their own within 7 days, so the fastest way to delete one is usually to wait.