Privacy policy
Last updated 12 October 2026
The short version: nothing about you or what you look up is logged or stored.
What we process
- What you check (the address, subnet, domain or email address you type) is sent to our server in the body of the request, so it never appears in a web server log. It is used for the lookup and nothing else.
- Your IP address is used, in memory only, for fair use: how many checks you ran in the last ten minutes, and a block if you were blocked. It is first turned into a keyed hash (for IPv6, of its /64). The key is made when the service starts and is never written down, so the hash cannot be traced back to you. The record is forgotten ten minutes after your last check, or when a 24-hour block ends.
The deliverability test
A test address (t-…@mailcheck.wehack.net) works for one hour and accepts up to 3 messages. A message you
send to it is received by our mail server, analysed in memory and discarded: it is never written to a mailbox or to
disk. Only the findings are kept, for the hour, in memory: the sending server's address, names and encryption, the
SPF, DKIM and DMARC results, the software the message names and its known vulnerabilities, and the domains its links
point to. Never the subject, the text, an attachment or a full link. Only the browser tab that created the address
holds the secret needed to see them; there is no shareable link. Mail to any other address there is refused.
Software names and versions found in a message are looked up in the OSV vulnerability database (osv.dev); only the
software name and version are sent to it.
The decoder
Everything you paste into the decoder is decoded in your browser. Nothing is sent to us or anyone else.
The email analyzer
A message you paste, open or drop is read in your browser and never sent: not its text, not its subject, not its addresses, not its attachments (they are hashed in your browser), not its links' paths. Only what is needed for the lookups is sent to our server: the IP addresses and server names in its Received lines, the domains of its From and return addresses (never the part before the @), its DKIM selectors and domains, the domain names its links point to, and results the message already states or that your browser worked out (such as "spf=pass", "an attachment is a program", "the body hash does not match"). They are used like any other lookup and not kept. The SHA-256 of an attachment is shown with a link to VirusTotal; nothing is sent to VirusTotal unless you click it.
The preview of a message blocks every image from the internet, so viewing it tells the sender nothing. If you choose Load blocked images and confirm, your browser fetches those images directly from the sender's servers and any trackers, which then learn that the message was opened, when, your IP address and your browser. Our server is not involved in that and is told nothing.
What we keep
- Nothing about lookups or visitors is written to disk or logged.
- Answers from the lists are kept in memory for up to 30 minutes, and whole reports for 5 minutes, so the lists are not asked the same question twice. They hold the result for an address or domain, never who asked.
- Our web server's log line for each page request records the page, never your address. Your address is replaced by a hash under a key that changes every month. That line is counted for anonymous visitor statistics (how many visitors a day) and deleted within about two minutes.
Who we ask
To answer a lookup, our server (never your browser) asks:
- the DNS blocklists and good-sender lists on the Sources page, and the name servers of the domain being checked, through our own DNS resolver. They see our server's address and the address or domain being checked. One exception: a list whose own servers do not answer us but do answer Cloudflare's public resolver (marked "asked through Cloudflare" on the Sources page; today SPFBL) is asked through Cloudflare's resolver, 1.1.1.1, which then also sees the address being checked;
- Cisco Talos, for an IP address's reputation;
- Team Cymru, for the network an IP address belongs to;
- the domain's registry (RDAP, or WHOIS where there is no RDAP), for its registration details;
- the domain's own website at
mta-sts.<domain>, for its MTA-STS policy. - the DNS root servers and each domain's own name servers directly, to trace how a name resolves.
None of them is told anything about you. Threat feeds (abuse.ch, Emerging Threats, CINS Army, GreenSnow, Binary Defense, IPsum, OpenPhish, Phishing Army, Phishing.Database, CERT Polska, the Block List Project, the disposable-email-domains project, Spamhaus DROP and the Tor Project's exit list) are downloaded whole by our server on a schedule, so they are never told what anyone looks up. Locations come from our own copy of the DB-IP Lite database.
Donations
The Donate button opens a dialog served from this site: the QR codes and addresses are ours, and nothing is loaded
from anywhere else. Only if you choose PayPal does your browser go to PayPal's own donate page, under
PayPal's privacy statement. The dialog remembers which thank-you note it
showed last, in your browser's local storage (donateNote).
Cloudflare Turnstile
To keep this free service for people and away from bots, a lookup on the Check and Email pages first runs
Cloudflare Turnstile. Its script and
frame load from challenges.cloudflare.com only when you start a lookup, so Cloudflare sees your IP address,
browser details and how you interact with the check, under
Cloudflare's Turnstile privacy addendum. Usually it is
invisible; sometimes it asks you to click. Our server sends Cloudflare the token it produced and your IP address to
confirm it, as Cloudflare recommends. Then our server gives your page a pass for 30 minutes, held in the page's memory
only (no cookie), so you are not checked again for every lookup. Turnstile never sees what you look up. The decoder
does not use Turnstile.
In your browser
No cookies, no trackers, no analytics scripts, and nothing loaded from other websites except Cloudflare Turnstile when you start a lookup (above). The page remembers your light or dark choice (mailcheckTheme) and the donate dialog's last note (donateNote) in your browser's local storage. Neither leaves your device.