A sensible order for diagnosing a domain
If mail from your domain is being rejected or filtered, work outwards rather than starting with the most complex record. MX first, because if nothing accepts mail then nothing else matters. Then SPF to see which hosts are authorised to send, then DKIM to confirm signing keys are published and sound, and finally DMARC, which is only meaningful once the two checks underneath it work.
If instead you have one specific message that went wrong, start with the header analyzer. The receiving server has already done much of the work and written its route and authentication verdicts into the headers.
What reaches our servers and external services
Password generation and assessment, header parsing and decoding, and the Email HTML Preview's sanitization all run locally in your browser. The HTML preview blocks external resources by default; if you explicitly enable remote images or fonts, your browser contacts those third-party hosts directly and can reveal your IP address to them.
DNS, mail-routing, authentication, domain-reputation, WHOIS/RDAP, and domain-age tools send the domain name to our API. DNS and normalized RDAP answers may be cached at the edge for performance. The SMTP Tester sends the public hostname and selected fixed submission port to our Worker, which resolves it, rejects any private or reserved destination, and performs only a bounded greeting, EHLO, optional STARTTLS, and QUIT exchange.
The Email Leak Checker is the deliberate exception to domain-only handling: it sends the complete address through our uncached Worker endpoint to XposedOrNot because an account-level breach search cannot work with only a domain. The page discloses this before submission, requests incident names only, and neither caches nor stores the result in our service.
Public endpoints use operation-specific admission controls to reduce abuse as a DNS proxy, SMTP scanner, or breach-query relay. The four new network-backed tools use strongly consistent per-actor limits; SMTP also has per-target limits, a 25-second transaction deadline, and both per-target and service-wide concurrency leases. Normal interactive use stays well below those limits.