# Psychevus

> Independent software engineering, systems security and AI systems. Free tools and interactive engineering instruments with cited sources.

## Tools

- [Inbox check](https://psychevus.com/tools/inbox-check): free check of a domain's SPF, DKIM and DMARC from public DNS, with plain-language answers to: will Gmail and Outlook trust its email, can others impersonate it, is it ready for bulk email; plus a fix plan for the detected email provider and DNS host. Result links: https://psychevus.com/tools/inbox-check?d=example.com
- [Compare two domains](https://psychevus.com/tools/inbox-check/compare): side-by-side email security of two domains (inbox trust, impersonation, BIMI, MTA-STS, TLS-RPT), with a clear winner. Links: https://psychevus.com/tools/inbox-check/compare?a=example.com&b=example.org
- [Lookalike domain radar](https://psychevus.com/tools/inbox-check/lookalikes): which lookalikes of a domain (other endings, rn for m, -billing, typos) are registered right now, which can receive email, and which share the domain's own servers. Links: https://psychevus.com/tools/inbox-check/lookalikes?d=example.com. API: https://psychevus.com/api/v1/lookalikes?domain=example.com; MCP tool find_lookalike_domains
- [Email header analyzer](https://psychevus.com/tools/inbox-check/headers): paste a message's raw headers to see SPF, DKIM and DMARC results with alignment, each delivery hop with delay and TLS, Reply-To redirection, Microsoft SCL and SpamAssassin verdicts, and one-click unsubscribe; runs in the browser, nothing uploaded.
- [SPF and DMARC record generator](https://psychevus.com/tools/inbox-check/records): builds one SPF record from the services that send for a domain with DNS lookups counted live (API: https://psychevus.com/api/v1/spf-lookups?include=_spf.google.com,sendgrid.net), a DMARC policy with rollout, and MTA-STS and TLS-RPT records; can start from a domain's current records: https://psychevus.com/tools/inbox-check/records?d=example.com
- [DNS propagation watch](https://psychevus.com/tools/inbox-check/propagation): what Cloudflare, Google, NextDNS and AdGuard resolvers return right now for a domain's SPF, DMARC, DKIM, MTA-STS, TLS-RPT or BIMI record, compared with the value just published, with TTLs. API: https://psychevus.com/api/v1/propagation?domain=example.com&record=dmarc
- [Bulk check](https://psychevus.com/tools/inbox-check/bulk): SPF, DKIM and DMARC verdicts for up to 25 domains at once in the browser, sortable, with CSV export; for agencies and IT providers.
- [DMARC report analyzer](https://psychevus.com/tools/inbox-check/dmarc-reports): reads DMARC aggregate reports (.xml, .xml.gz, .zip) in the browser and groups senders by service (recognised from DKIM/SPF domains and DKIM selectors), with pass rates, what to fix, likely spoofing, and whether it is safe to move from p=none to p=quarantine. Nothing is uploaded.
- [Signed proof](https://psychevus.com/tools/inbox-check/proof): a signed, independently verifiable record (EdDSA/Ed25519 compact JWS) of a domain's public email-security DNS and grade at a moment in time. Create: https://psychevus.com/api/v1/proof?domain=example.com. Verify: https://psychevus.com/api/v1/proof?token=… or offline with the keys at https://psychevus.com/.well-known/psychevus-proof-keys.json.
- [Email Security Index](https://psychevus.com/tools/email-security-index): a live public ranking of 48 well-known brands (big tech, payments, banks, shopping, work software, news) graded A–F from public DNS, refreshed every six hours; open data at https://psychevus.com/api/v1/email-security-index (JSON, CC BY 4.0).
- [Report card](https://psychevus.com/tools/inbox-check/report?d=example.com): one printable page per domain with an A–F grade (SPF and DKIM 25, DMARC enforcement 30, bulk-sender rules 15, MTA-STS 8, TLS-RPT 4, DNSSEC 8, CAA 4, BIMI 6; checks that don't apply are excluded), a plain-language summary, the fixes in order and lookalike exposure (not graded).
- [TLS-RPT report analyzer](https://psychevus.com/tools/inbox-check/tls-reports): reads SMTP TLS reports (RFC 8460; .json, .json.gz, .zip) in the browser: share of delivery sessions over verified TLS, failures grouped by result type with fixes, per-MX and per-reporter views, and whether MTA-STS can move from testing to enforce. Nothing is uploaded.
- [Payment-change check](https://psychevus.com/tools/payment-check): should you trust an email saying a supplier's bank details have changed? Compares the sender and Reply-To with the supplier's real domain for lookalike tricks (other endings, look-alike or other-alphabet characters, typos, added words), reads the sender domain's registration age, the supplier's DMARC policy and the message's DMARC result, and returns stop, caution or verify with the steps to take; never declares a request safe. The email is read in the browser. API: https://psychevus.com/api/v1/payment-check?supplier=example.com&sender=billing@example-invoices.com; MCP tool check_payment_change_request
- [Domain monitor](https://psychevus.com/tools/inbox-check/monitor): free daily monitoring of a domain's SPF, DKIM, DMARC, MX, DNSSEC and CAA records, plus a weekly lookalike-domain scan; emails the confirmed address only when something changes, after two checks at least an hour apart agree.

## For developers and AI assistants

- [Inbox check JSON API](https://psychevus.com/api/v1/inbox-check?domain=example.com): GET, no key, read-only; OpenAPI at https://psychevus.com/tools/inbox-check/openapi.json
- Remote MCP server: https://psychevus.com/api/mcp (Streamable HTTP, stateless; read-only tools check_email_domain, find_lookalike_domains, analyze_email_headers, count_spf_lookups, check_payment_change_request, check_dns_propagation)

## Email deliverability guides

- [Error 550 5.7.515 Access denied: what it means and how to fix it](https://psychevus.com/tools/inbox-check/guides/550-5-7-515-access-denied): 550 5.7.515 means Outlook.com refused your message because your sending domain doesn’t meet its authentication level: SPF must pass, DKIM must pass, and the domain must publish a DMARC record (at least p=none) that aligns with SPF or DKIM. Fix the one that fails — usually DKIM or a missing DMARC record — and the rejections stop.
- [SPF PermError: too many DNS lookups — why it happens and how to fix it](https://psychevus.com/tools/inbox-check/guides/spf-too-many-dns-lookups): SPF records may trigger at most 10 DNS lookups while being evaluated. Each include, a, mx, ptr, exists and redirect counts, and so do the lookups inside every service you include. Above 10, the check returns PermError and inboxes treat your SPF as failed. Remove services that no longer send for you, move bulk senders to a subdomain, and avoid ptr.
- [How to set up DMARC: a safe path from p=none to quarantine](https://psychevus.com/tools/inbox-check/guides/how-to-set-up-dmarc): Add a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Make sure SPF and DKIM pass for every service that sends as you, read the daily reports for two to four weeks, then change p=none to p=quarantine. Only quarantine or reject actually stops others sending email in your name.
- [What is MTA-STS, and does my domain need it?](https://psychevus.com/tools/inbox-check/guides/what-is-mta-sts): MTA-STS (RFC 8461) tells other mail servers that your domain only accepts mail over an encrypted connection to a verified server. Without it, an attacker on the network path can strip encryption from delivery to you, or redirect it. It needs a TXT record at _mta-sts, a policy file served at https://mta-sts.<your domain>/.well-known/mta-sts.txt, and, to see failures, a TLS-RPT record at _smtp._tls. Start in testing mode, read the reports, then switch to enforce.
- [BIMI: how to show your logo next to your emails in Gmail](https://psychevus.com/tools/inbox-check/guides/what-is-bimi-logo-in-gmail): BIMI (Brand Indicators for Message Identification) lets inboxes show your logo next to your messages. It only works once your domain can’t easily be forged: DMARC must be set to p=quarantine or p=reject. Then publish a TXT record at default._bimi.<your domain> pointing to your logo as an SVG Tiny PS file. Gmail and Apple Mail also require a Verified Mark Certificate or Common Mark Certificate; Yahoo can show the logo without one.
- [Lookalike domains and invoice fraud: how to spot and stop them](https://psychevus.com/tools/inbox-check/guides/lookalike-domain-invoice-fraud): A lookalike domain is a near-copy of yours (yourcompany-billing.com, yourcornpany.com) registered to send convincing email. Because the fraudster sets up SPF, DKIM and DMARC for their own domain, the mail passes inbox checks and your DMARC can’t stop it. Warning signs are a recent registration and mail servers. What stops the fraud is process: payment details are never changed by email alone, and changes are confirmed by phone on a known number.
- [SPF, DKIM and DMARC for Google Workspace: the exact records](https://psychevus.com/tools/inbox-check/guides/google-workspace-spf-dkim-dmarc): For Google Workspace, publish one SPF TXT record — v=spf1 include:_spf.google.com ~all — at your domain, turn on DKIM in Google Workspace and publish the record it gives you (selector google), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.
- [SPF, DKIM and DMARC for Microsoft 365: the exact records](https://psychevus.com/tools/inbox-check/guides/microsoft-365-spf-dkim-dmarc): For Microsoft 365, publish one SPF TXT record — v=spf1 include:spf.protection.outlook.com ~all — at your domain, turn on DKIM in Microsoft 365 and publish the record it gives you (selector selector1, selector2), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.
- [SPF, DKIM and DMARC for Zoho Mail: the exact records](https://psychevus.com/tools/inbox-check/guides/zoho-mail-spf-dkim-dmarc): For Zoho Mail, publish one SPF TXT record — v=spf1 include:zohomail.com ~all — at your domain, turn on DKIM in Zoho Mail and publish the record it gives you (selector zmail, zoho), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.
- [SPF, DKIM and DMARC for Proton Mail: the exact records](https://psychevus.com/tools/inbox-check/guides/proton-mail-spf-dkim-dmarc): For Proton Mail, publish one SPF TXT record — v=spf1 include:_spf.protonmail.ch ~all — at your domain, turn on DKIM in Proton Mail and publish the record it gives you (selector protonmail, protonmail2, protonmail3), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.
- [SPF, DKIM and DMARC for Fastmail: the exact records](https://psychevus.com/tools/inbox-check/guides/fastmail-spf-dkim-dmarc): For Fastmail, publish one SPF TXT record — v=spf1 include:spf.messagingengine.com ~all — at your domain, turn on DKIM in Fastmail and publish the record it gives you (selector fm1, fm2, fm3), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.
- [SPF, DKIM and DMARC for iCloud Mail custom domains: the exact records](https://psychevus.com/tools/inbox-check/guides/icloud-custom-domain-spf-dkim-dmarc): For iCloud Mail custom domains, publish one SPF TXT record — v=spf1 include:icloud.com ~all — at your domain, turn on DKIM in iCloud Mail custom domains and publish the record it gives you (selector sig1), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.
- [SPF, DKIM and DMARC for GoDaddy email: the exact records](https://psychevus.com/tools/inbox-check/guides/godaddy-email-spf-dkim-dmarc): For GoDaddy email, publish one SPF TXT record — v=spf1 include:secureserver.net ~all — at your domain, turn on DKIM in GoDaddy email and publish the record it gives you (selector default), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.
- [SPF, DKIM and DMARC for Titan Mail: the exact records](https://psychevus.com/tools/inbox-check/guides/titan-mail-spf-dkim-dmarc): For Titan Mail, publish one SPF TXT record — v=spf1 include:spf.titan.email ~all — at your domain, turn on DKIM in Titan Mail and publish the record it gives you (selector titan1), then add a DMARC TXT record named _dmarc, starting with v=DMARC1; p=none; rua=mailto:you@yourdomain.com and moving to p=quarantine once reports are clean.

## Short answers

- Why are my emails going to spam? The most common technical reason is missing or broken authentication: Gmail requires every sender to pass SPF or DKIM, and bulk senders also need DMARC. Mail that can’t prove where it comes from is the first to be filtered. Reputation, complaints and content matter too, but authentication comes first.
- What are SPF, DKIM and DMARC, in plain words? SPF is a guest list of servers allowed to send email for your domain. DKIM is a tamper-proof seal on every message. DMARC is your instruction to inboxes about mail that fails both: deliver it, send it to spam, or refuse it.
- Do small businesses need DMARC? Yes, if you want to stop others sending email in your name. Without a DMARC policy of quarantine or reject, anyone can send a fake invoice or payment request that appears to come from your domain.
- Is DMARC p=none enough? It satisfies the Gmail, Yahoo and Outlook sender requirements, but it doesn’t protect you: p=none only asks for reports, so forged mail is still delivered. Move to p=quarantine once your own services pass SPF and DKIM.
- What does error 550 5.7.515 mean? Outlook.com rejected your message because your sending domain didn’t meet its authentication level — SPF, DKIM and an aligned DMARC record of at least p=none. Fix whichever of the three fails.
- How long do DNS changes take? Usually minutes to an hour, occasionally up to 48 hours, depending on your DNS host and the record’s time-to-live. Run the check again after you change a record.
- Why can’t the check find my DKIM key? DKIM keys live under a name chosen by your email provider (a “selector”). The check tries the names providers commonly use. If your provider uses an unusual one, the key may exist but not be found; if you never turned DKIM on, it isn’t there.
- Does this tool read my email or store my domain? No. It reads only your domain’s public DNS records — the same records every mail server reads. No mailbox is accessed, and checks are counted only as daily totals without the domain.

## Lab instruments

- [Delivery under failure](https://psychevus.com/lab/delivery): Lose a request, lose a reply, press twice or edit a retry. Then add retries, idempotency keys, atomic claims and fingerprints, and scrub through the exact message sequence.
- [Agent authority simulator](https://psychevus.com/lab/agent-authority): Give an AI agent private data, untrusted content and an outbound channel, then test which controls actually stop indirect prompt injection.
- [Action gate](https://psychevus.com/lab/action-gate): An agent proposes to report on, suspend or delete an environment. Set the facts and see which check stops it, why, and the decision record it leaves behind.