Signed just now

paypal.com

Psychevus attests that on 2026-11-07 19:05 UTC the public DNS of paypal.com showed the records below, earning grade B.

Grade: B · 88/100 (3 of 3 inbox checks pass)
DMARC: v=DMARC1; p=reject; rua=mailto:d@rua.agari.com,mailto:dmarc_agg@vali.email; ruf=mailto:d@ruf.agari.com,mailto:MTc4Mzcw@ruf.vali.email
SPF: v=spf1 include:pp._spf.paypal.com include:3ph1._spf.paypal.com include:3ph2._spf.paypal.com include:3ph3._spf.paypal.com include:3ph4._spf.paypal.com include:sendgrid.net include:aspmx.pardot.com ~all (9 of 10 lookups)
DKIM: s1 (RSA 2048-bit), s2 (RSA 1024-bit)
MX: mx1.paypalcorp.com, mx2.paypalcorp.com
MTA-STS: off
DANE: off
TLS-RPT: off
DNSSEC: on
CAA: on
BIMI: on

Ed25519 signature (JWS, RFC 7515 / RFC 8037) · key ed25519-XzWmcKUhkl6H1Vt6 · public keys · Public DNS over HTTPS (Cloudflare, Google), graded with the Psychevus report card.

How it works

What it proves

That Psychevus read your domain’s public DNS at the stated time and saw exactly these records and this grade. It’s a statement about public facts, so no login or domain verification is needed — and it can’t be edited: the Ed25519 signature covers every character.

Who it’s for

Vendor security questionnaires that ask “do you enforce DMARC?”, cyber-insurance applications, auditors, and agencies handing a fixed domain back to a client. Send the link; they verify it in one click, or offline.

Verify it yourself

The proof is a standard JWS. Fetch the keys from /.well-known/psychevus-proof-keys.json and check it with any JOSE library, e.g. jose.compactVerify(token, key) in JavaScript, or call /api/v1/proof?token=….