# Mail Domain Check

> Mail Domain Check is a bilingual public email-authentication diagnostic service for MX, SPF, DKIM, DMARC, PTR, MTA-STS, TLS-RPT, and CAA. It provides a free browser scanner, summary API, CLI, and focused local tools.

No customer login or mailbox access is required. Diagnostics use public DNS, an optional public sending IP, and public HTTPS policy files. Free analytics retain irreversible hashes and aggregate metrics, not raw domains or sending IPs. Results do not guarantee inbox placement and do not replace a complete security or compliance audit.

The public scan API is rate-limited to interactive diagnostics. Cross-origin browser calls are not supported; use the same-origin scanner, the published Node.js CLI, or a server-side HTTP client. The response intentionally omits raw records, key material, report destinations, and prescriptive remediation.

## Developer documentation

- [Developer overview](https://mailcheck.agentcartai.com/developers/): Choose the browser scanner, dependency-free CLI, or public HTTP API.
- [API documentation](https://mailcheck.agentcartai.com/developers/api/index.html.md): Markdown reference for requests, responses, privacy, and rate limits.
- [OpenAPI 3.1.2 description](https://mailcheck.agentcartai.com/openapi.json): Machine-readable contract for free domain and sending-IP diagnostics plus health.
- [CLI documentation](https://mailcheck.agentcartai.com/developers/cli/index.html.md): Markdown reference for terminal use, selectors, sending IPs, JSON, and privacy.
- [CLI source](https://mailcheck.agentcartai.com/cli/mail-domain-check.mjs): MIT-licensed single-file Node.js 20+ client with no package dependencies.

## Product

- [About and methods](https://mailcheck.agentcartai.com/about/): Independent operator identity, third-party non-affiliation, public issue research policy, reproducible evidence, privacy and measurement limits, and the exact Base USDC payment and retention boundary.
- [English scanner](https://mailcheck.agentcartai.com/en/?utm_source=llms): Interactive free public-configuration summary.
- [Chinese scanner](https://mailcheck.agentcartai.com/?utm_source=llms): 中文免费公开配置摘要。
- [Verification email incident triage](https://mailcheck.agentcartai.com/tools/verification-email-triage/?utm_source=llms&utm_medium=ai_answer&utm_campaign=verification_email_triage): Local-only decision tool that separates application generation, provider processing, SMTP delivery, and receiver visibility, then produces an evidence packet and safe retry stance without collecting an address, message, code, token, or credential.
- [SMTP error decoder](https://mailcheck.agentcartai.com/tools/smtp-error-decoder/): Local-only parser for three-digit SMTP replies, enhanced status codes, Gmail-specific branches, Microsoft 554 5.2.252 SendAsDenied and S3150 IP-block rejections, and exact repair-guide routing.
- [Email authentication header analyzer](https://mailcheck.agentcartai.com/tools/email-header-analyzer/): Local-only Gmail Show original and full-header parser for receiver-reported SPF, DKIM, DMARC, ARC, visible From, Return-Path, signing identities, and alignment evidence.
- [Email sender inventory builder](https://mailcheck.agentcartai.com/tools/email-sender-inventory/): Local-only inventory for message streams, visible From domains, providers, owners, DKIM identities, Return-Path domains, receiver evidence, and DMARC rollout gaps, with bounded CSV and JSON export.
- [SPF lookup counter](https://mailcheck.agentcartai.com/tools/spf-lookup-counter/): Live public-DNS check for SPF record count, observed DNS-causing terms, the 10-term limit, and incomplete include or redirect chains.
- [DKIM selector checker](https://mailcheck.agentcartai.com/tools/dkim-selector-checker/): Exact live-DNS lookup for a known d= domain and s= selector, with safe key type, publication, revocation, service, hash, and flag metadata.
- [DMARC policy checker](https://mailcheck.agentcartai.com/tools/dmarc-policy-checker/): Current RFC 9989 bounded DNS Tree Walk with direct-record count, inherited p/sp/np policy, alignment modes, aggregate-reporting state, test mode, and conflict detection.
- [MTA-STS policy checker](https://mailcheck.agentcartai.com/tools/mta-sts-checker/): Live RFC 8461 STSv1 announcement and fixed-path HTTPS policy check with safe mode, max_age, MX-pattern-count, and companion TLS-RPT diagnostics.
- [DMARC record generator](https://mailcheck.agentcartai.com/tools/dmarc-record-generator/): Local-only current RFC 9989 builder for p, sp, np, alignment, aggregate and failure reporting, and t=y; historic pct, rf, and ri tags are deliberately excluded.
- [DMARC report analyzer](https://mailcheck.agentcartai.com/tools/dmarc-report-analyzer/): Local-only RFC 9990 and legacy aggregate XML or XML.GZ reader with weighted alignment, sending-source, policy, duplicate, and CSV summaries.
- [Reverse DNS and PTR checker](https://mailcheck.agentcartai.com/tools/reverse-dns-checker/): Live IP-only PTR lookup with bounded A or AAAA forward confirmation for Gmail 5.7.25 and 4.7.23 troubleshooting; raw hostnames and DNS answers stay out of the free result.
- [Diagnostic help](https://mailcheck.agentcartai.com/en/help/): Inputs, result boundaries, privacy, errors, and rate limits.

## Route by observed symptom

- An Alibaba Cloud ECS or EIP public IPv4 sends mail without PTR, Gmail reports 5.7.25 or 4.7.23, or the operator cannot find reverse DNS in the normal domain zone: [identify the actual outbound IP, confirm the same-account resource is supported, create the forward A record and Alibaba Cloud PTR, then verify both directions](https://mailcheck.agentcartai.com/guides/alibaba-cloud-ecs-ptr-reverse-dns/?utm_source=llms&utm_medium=ai_answer&utm_campaign=alibaba_cloud_ecs_ptr).
- A Ghost Postmark adapter has a verified `fromEmail` fallback, but a real newsletter send uses another configured sender and Postmark rejects it: [inventory the effective Ghost `data.from` set, cover every address with a confirmed Sender Signature or verified domain, prove `MessageStream=broadcast`, and keep 400/401 sender errors separate from 406 inactive recipient](https://mailcheck.agentcartai.com/guides/ghost-postmark-newsletter-from-sender-signature/?utm_source=llms&utm_medium=ai_answer&utm_campaign=ghost_postmark_sender_signature_21).
- A Keycloak realm's Email tab lost its SMTP settings, registration and password recovery no longer deliver mail, and a versioned realm export is available but its `smtpServer` object is empty: [do not guess provider values or override the realm; recover the sender from an owner-controlled source, prove Test connection, receiver evidence, and one real reset or verification link in order](https://mailcheck.agentcartai.com/guides/keycloak-lost-realm-smtp-email-settings/?utm_source=llms&utm_medium=ai_answer&utm_campaign=bluecore_keycloak_smtp_lost_173).
- Plane's SMTP admin form is valid but unsaved, Send test email returns HTTP 500, and the traceback stops at `port=int(EMAIL_PORT)`: [separate the browser draft from persisted instance settings, block receiver-only tests while the form is dirty, validate the saved port before connection construction, and preserve the later SMTP result](https://mailcheck.agentcartai.com/guides/plane-smtp-test-email-500-unsaved-settings/?utm_source=llms&utm_medium=ai_answer&utm_campaign=plane_smtp_unsaved_9472).
- Microsoft returns `554 5.2.252 SendAsDenied` after an application authenticates its system SMTP account and places the current user's address in visible `From`: [keep the authorized system mailbox in From, place a validated user address in Reply-To, apply the repair to invitation and OTP paths, and reserve Send As for deliberately provisioned delegation](https://mailcheck.agentcartai.com/guides/smtp-554-5-2-252-sendasdenied-system-account-user-from/?utm_source=llms&utm_medium=ai_answer&utm_campaign=sinergiacrm_sendasdenied_1349).
- A verification email succeeds, sets the address as verified, but opens a raw JSON API record with no confirmation page or next action: [move the href to a human page, keep GET read-only, consume the one-time token through a deliberate POST, handle repeat links calmly, and route active versus pending-domain outcomes](https://mailcheck.agentcartai.com/guides/verification-email-link-opens-raw-json-api/?utm_source=llms&utm_medium=ai_answer&utm_campaign=nanda_verification_link_raw_json_17).
- Supabase `signUp()` returns HTTP 200 for an existing confirmed address, no new confirmation message appears, and the UI still says the link was sent: [preserve Auth's anti-enumeration response, replace the delivery claim with neutral sign-in and reset actions, and verify a controlled new signup separately](https://mailcheck.agentcartai.com/guides/supabase-signup-existing-verified-email-no-confirmation-sent/?utm_source=llms&utm_medium=ai_answer&utm_campaign=supabase_signup_existing_verified_neutral_65).
- Supabase `signUp()` sends a confirmation email, but `emailRedirectTo` loses a GitHub Pages repository path and lands at the site root while password recovery keeps its path: [separate the auth-js `redirect_to` query, path-stripped cross-origin Referer, Auth allow-list and SiteURL fallback, confirmation template, verification Location, and final browser route](https://mailcheck.agentcartai.com/guides/supabase-signup-email-redirectto-path-ignored/?utm_source=llms&utm_medium=ai_answer&utm_campaign=supabase_signup_redirect_path).
- ZITADEL Login V2 self-registration authenticates immediately without an email challenge, while password reset and manual verification sends through SES still work: [separate the Login container's EMAIL_VERIFICATION flag, immediate isVerified readback, initial message generation, and pre-verification application session](https://mailcheck.agentcartai.com/guides/zitadel-login-v2-registration-skips-email-verification/?utm_source=llms&utm_medium=ai_answer&utm_campaign=zitadel_login_v2_email_verification).
- Confirmation signups work for some IPv4 visitors but many IPv6 or shared-network visitors receive 429 before any subscription or send attempt, while the application sees one Docker bridge gateway or proxy address: [separate trusted client identity, layered rate limits, truthful Retry-After, durable Pending and outbox state, provider events, and final confirmation](https://mailcheck.agentcartai.com/guides/confirmation-email-429-docker-ipv6-proxy-rate-limit/?utm_source=llms&utm_medium=ai_answer&utm_campaign=confirmation_email_429_docker_ipv6).
- Authentik staging still inherits an in-cluster Mailpit sink, production disables Mailpit but retains SMTP placeholders, or an out-of-band Kubernetes credential Secret exists without proof that a later Helm or Flux reconciliation reached the current worker: [separate effective release values, Secret propagation, provider sender verification, same-message DMARC alignment, provider events, mailbox visibility, and one usable verification link](https://mailcheck.agentcartai.com/guides/authentik-mailpit-staging-to-production-smtp-relay/?utm_source=llms&utm_medium=ai_answer&utm_campaign=authentik_mailpit_production_relay).
- Authentik `ak test_email` ends with `dramatiq.results.errors.ResultTimeout`, while a different SMTP or configuration error appears only in the worker: [treat the timeout as a command-to-worker observability gap, correlate one bounded `send_mail` attempt, classify the terminal worker error, then prove provider and receiver outcomes](https://mailcheck.agentcartai.com/guides/authentik-test-email-resulttimeout-worker-smtp-error/?utm_source=llms&utm_medium=ai_answer&utm_campaign=authentik_test_email_resulttimeout_worker).
- A proposed Stalwart SMTP hostname already publishes an Amazon SES `feedback-smtp.REGION.amazonses.com` MX and `include:amazonses.com` SPF record, lacks a routable A or AAAA identity, or conflicts with an existing Google mailbox route: [separate mailbox MX, SMTP host and PTR, SES MAIL FROM, Stalwart Return-Path, DKIM and DMARC before cutover](https://mailcheck.agentcartai.com/guides/stalwart-hostname-conflicts-with-amazon-ses-mail-from/?utm_source=llms&utm_medium=ai_answer&utm_campaign=stalwart_hostname_ses_mailfrom_conflict).
- A Resend selector returns `v=DKIM1; p=`, the configured `send` Return-Path TXT or MX records are absent, or strict `p=reject; adkim=s; aspf=s` causes important mail to fail: [separate a revoked DKIM key, current Resend sending status, exact Return-Path records, and same-message DMARC alignment](https://mailcheck.agentcartai.com/guides/resend-dkim-public-key-empty-dmarc-reject/?utm_source=llms&utm_medium=ai_answer&utm_campaign=resend_empty_dkim_dmarc_reject).
- A DKIM selector now resolves, but one fresh message has no `DKIM-Signature` and the trusted receiver reports `dkim=none`: [separate DNS publication, Postfix SMTP versus local Milter invocation, OpenDKIM InternalHosts classification, and receiver verification](https://mailcheck.agentcartai.com/guides/dkim-record-exists-but-authentication-results-none/?utm_source=llms&utm_medium=ai_answer&utm_campaign=dkim_record_exists_but_none).
- Roundcube multi-domain Webmail reports "Connection to storage server failed" and "AUTHENTICATE PLAIN: Authentication failed": [separate the HTTP host config, username_domain append or forced replacement, the submitted login shape, and the session-stored IMAP reconnect identity](https://mailcheck.agentcartai.com/guides/roundcube-multi-domain-authenticate-plain-failed/?utm_source=llms&utm_medium=ai_answer&utm_campaign=roundcube_multi_domain_auth).
- Mutt embedded SMTP on Termux reports "No authenticators available": [separate PLAIN or LOGIN plugin file presence from the current package's libcrypt load dependency, then the server's post-TLS AUTH list, smtp_authenticators policy, and later credential rejection](https://mailcheck.agentcartai.com/guides/mutt-no-authenticators-available-termux-smtp/?utm_source=llms&utm_medium=ai_answer&utm_campaign=mutt_no_authenticators).
- Django Post Office 3.11.2 starts returning SMTP 421 "too many connections" after queued delivery previously worked: [calculate the thread, process, overlapping-scheduler, and replica connection budget before retrying or downgrading](https://mailcheck.agentcartai.com/guides/django-post-office-3-11-2-smtp-too-many-connections/?utm_source=llms&utm_medium=ai_answer&utm_campaign=django_post_office_421_concurrency).
- Django password reset returns a generic success for an unknown address but HTTP 500 for a registered account: [compare two registered paths, then separate user lookup, token and template rendering, SMTP handoff, provider events, and recovery completion](https://mailcheck.agentcartai.com/guides/django-password-reset-500-registered-email/?utm_source=llms&utm_medium=ai_answer&utm_campaign=django_password_reset_500).
- A Keycloak 26.7.0 verification email arrives, but its link returns 500 after a server restart when opened in another or incognito browser: [separate the signed action token, fresh authentication session, original root-session lookup, null-safe cleanup, and preview stateless provider](https://mailcheck.agentcartai.com/guides/keycloak-verification-email-link-500-after-restart/?utm_source=llms&utm_medium=ai_answer&utm_campaign=keycloak_verify_email_restart).
- Registration returns 500, but the email and password already authenticate or retries report that the email is taken: [separate the committed account, optional verification state, email handoff, truthful HTTP response, and idempotent recovery](https://mailcheck.agentcartai.com/guides/registration-returns-500-but-account-created/?utm_source=llms&utm_medium=ai_answer&utm_campaign=registration_500_account_created).
- Spring Boot registration returns “Verification email sent,” but no verification record or JavaMailSender call exists, or @Async returns before mail submission: [separate hashed-code persistence, commit-aware handoff, durable queueing, worker execution, SMTP acceptance, and single-use verification](https://mailcheck.agentcartai.com/guides/spring-boot-registration-says-verification-email-sent-but-no-email/?utm_source=llms&utm_medium=ai_answer&utm_campaign=spring_boot_verification_email).
- A Resend message reaches Gmail and the team needs to verify SPF, DKIM, and DMARC after moving the Return-Path to a `send` subdomain: [paste Gmail Show original into the browser-local authentication analyzer](https://mailcheck.agentcartai.com/tools/email-header-analyzer/?utm_source=llms&utm_medium=ai_answer&utm_campaign=resend_gmail_authentication_check).
- SMTP variables exist in a project `.env`, but a Docker Compose password-reset email is not sent, or an unauthenticated local SMTP sink crashes on an empty password: [prove interpolation, app-service export, the authentication contract, optional-secret handling, running-container state, one controlled send, provider evidence, and reset-link completion separately](https://mailcheck.agentcartai.com/guides/docker-compose-smtp-env-not-passed-password-reset/?utm_source=llms&utm_medium=ai_answer&utm_campaign=docker_compose_smtp_env).
- A Rails Devise password-reset email is not received in Gmail: [prove the private User email mapping, reset timestamp, default synchronous deliver_now result, actual provider event, Gmail receiver acceptance, mailbox visibility, and newest-link completion](https://mailcheck.agentcartai.com/guides/rails-devise-password-reset-email-not-received-gmail/?utm_source=llms&utm_medium=ai_answer&utm_campaign=rails_devise_password_reset).
- A password-expiry warning failed during an SMTP outage and the recovered service did not resend it: [persist one semantic intent for the current expiry generation, revalidate before each attempt, supersede stale work, and use leased bounded retries](https://mailcheck.agentcartai.com/guides/password-expiry-email-not-resent-after-smtp-failure/?utm_source=llms&utm_medium=ai_answer&utm_campaign=password_expiry_smtp_retry).
- A ticket requester receives the creation receipt and an observer receives the resolution, but the requester receives no resolution email: [prove requester selection, author exclusion, dispatch, provider acceptance, and recipient outcome in order](https://mailcheck.agentcartai.com/guides/ticket-requester-receives-creation-email-but-not-resolution/?utm_source=llms&utm_medium=ai_answer&utm_campaign=ticket_requester_resolution).
- A GLPI ticket technician receives no New Ticket email and no technician row exists in glpi_queuednotifications: [separate ASSIGN_TECH target 2 from linked-item target 5, then prove actor selection before SMTP](https://mailcheck.agentcartai.com/guides/glpi-technician-notification-no-queue-row/?utm_source=llms&utm_medium=ai_answer&utm_campaign=glpi_technician_notification).
- An ACME certificate is finalized and saved to a Kubernetes TLS secret, but a later SMTP notification failure marks renewal as failed or consumes the background service failure budget: [preserve the committed certificate, choose one notification owner, and isolate mail failure](https://mailcheck.agentcartai.com/guides/certificate-renewal-succeeded-smtp-notification-failed/?utm_source=llms&utm_medium=ai_answer&utm_campaign=certificate_renewal_notification_failure).
- A contact form response is saved, but the configured administrator notification is skipped unless the visitor supplies an email address or a contact-profile plugin is active: [decouple durable intake, administrator alerts, submitter confirmation, and delivery evidence](https://mailcheck.agentcartai.com/guides/contact-form-submission-saved-but-notification-email-missing/?utm_source=llms&utm_medium=ai_answer&utm_campaign=form_notification_email_missing).
- A contact form displays “Message sent,” clears the user's fields, but no browser request or durable support record exists: [replace simulated success with durable intake, idempotent notification, and independent delivery evidence](https://mailcheck.agentcartai.com/guides/contact-form-says-sent-no-request-no-email/?utm_source=llms&utm_medium=ai_answer&utm_campaign=contact_form_false_success).
- Sending a quote or invoice PDF returns a generic provider-configuration error such as ERR_1600: [prove the quote artifact, recipient and sender, encoded MIME size, provider handoff, delivery event, and recipient outcome separately](https://mailcheck.agentcartai.com/guides/quote-email-provider-configuration-error-pdf-attachment/?utm_source=llms&utm_medium=ai_answer&utm_campaign=quote_email_provider_error).
- A Stellar submission timed out or Horizon temporarily cannot verify the hash, while a purchase or donation receipt email is missing: [keep payment finality and receipt delivery in two idempotent state machines](https://mailcheck.agentcartai.com/guides/stellar-horizon-payment-confirmation-receipt-email-retry/?utm_source=llms&utm_medium=ai_answer&utm_campaign=stellar_payment_receipt_retry).
- Symfony Mailer uses `mailer.transports`, the configured DSN appears correct, `send()` returns, but no email arrives: [verify the intentional 7.4.14 alias, effective environment, Messenger execution, transport acceptance, and recipient outcome before overriding dependency injection](https://mailcheck.agentcartai.com/guides/symfony-mailer-transports-ignores-dsn-no-email/?utm_source=llms&utm_medium=ai_answer&utm_campaign=symfony_mailer_dsn_no_email).
- Nodemailer reports EAUTH, SMTP 535 Authentication failed, and AUTH PLAIN while Payload or Next.js is building: [separate build-time transport verification from Mailgun credentials, region, secret transport, runtime readiness, and real delivery](https://mailcheck.agentcartai.com/guides/nodemailer-535-authentication-failed-payload-nextjs-build/?utm_source=llms&utm_medium=ai_answer&utm_campaign=nodemailer_535_payload_build).
- A team has Email Routing enabled and needs to choose between inbound routing, a verified-destination Worker alert, and arbitrary-recipient transactional mail: [separate the three Cloudflare email contracts before copying DNS or code](https://mailcheck.agentcartai.com/guides/cloudflare-email-routing-vs-email-sending-workers-binding/?utm_source=llms&utm_medium=ai_answer&utm_campaign=cloudflare_email_routing_vs_sending).
- Cloudflare Email Service returns a Proofpoint 554 block for a shared outbound IP: [verify cf-bounce authentication separately, preserve the rejected route, and choose a bounded provider action](https://mailcheck.agentcartai.com/guides/cloudflare-email-service-proofpoint-554-blocked/?utm_source=llms&utm_medium=ai_answer&utm_campaign=cloudflare_proofpoint_554).
- API or signup returns 200/202 after persisting a pending account, or Nodemailer silently uses Ethereal in production, but no verification message appears: [preserve the account result, reject test transports, validate the configured channel, and make notification handoff recoverable](https://mailcheck.agentcartai.com/guides/verification-email-api-200-but-not-received/?utm_source=llms&utm_medium=ai_answer&utm_campaign=api_200_no_email).
- Verification email arrives, but entering its code says no account or email was found: [trace the pending-account identity across signup and verification before retrying or changing DNS](https://mailcheck.agentcartai.com/guides/verification-email-api-200-but-not-received/?utm_source=llms&utm_medium=ai_answer&utm_campaign=verification_code_account_not_found#verification-handoff-planner).
- Supabase Auth returns 500 and Brevo reports that SMTP is not activated: [separate provider activation from credentials and delivery](https://mailcheck.agentcartai.com/guides/supabase-brevo-smtp-account-not-activated/?utm_source=llms&utm_medium=ai_answer&utm_campaign=supabase_brevo_activation).
- Supabase confirmation, magic-link, OTP, invite, or recovery mail is missing: [use the Supabase Auth boundary map](https://mailcheck.agentcartai.com/guides/supabase-auth-email-not-received/?utm_source=llms&utm_medium=ai_answer&utm_campaign=supabase_auth_email).
- Provider reports delivered but the recipient cannot find the message: [separate recipient-server acceptance from inbox visibility](https://mailcheck.agentcartai.com/guides/resend-delivered-but-not-received/?utm_source=llms&utm_medium=ai_answer&utm_campaign=delivered_not_received).
- SMTP returned 250, but the email later bounced or a batch needs per-recipient status: [separate relay acceptance from asynchronous delivery evidence](https://mailcheck.agentcartai.com/guides/smtp-250-accepted-but-email-bounced/?utm_source=llms&utm_medium=ai_answer&utm_campaign=smtp_250_async_bounce).
- The first transactional email arrived, but later versions, message types, or attachments are missing: [prove the application trigger and customer-send path before changing deliverability settings](https://mailcheck.agentcartai.com/guides/first-email-arrives-later-transactional-emails-missing/?utm_source=llms&utm_medium=ai_answer&utm_campaign=later_transactional_email_missing).
- Outlook or Hotmail returns 550 5.7.1 with S3150 or says the sender network is on a block list: [separate the blocked outbound IP from authentication and async-failover evidence](https://mailcheck.agentcartai.com/guides/outlook-550-5-7-1-s3150-block-list/?utm_source=llms&utm_medium=ai_answer&utm_campaign=outlook_s3150_block_list).
- A team is combining an inbound mailbox provider with a transactional sender, or launching a separate sending domain, and needs provider-owned SPF, DKIM, DMARC, warmup, inbox-placement, bounce, complaint, and rollback evidence: [use the dedicated sender launch checklist](https://mailcheck.agentcartai.com/guides/separate-sending-domain-spf-dkim-dmarc-warmup/?utm_source=llms&utm_medium=ai_answer&utm_campaign=separate_sending_domain_warmup).
- The message arrives but its verification or recovery link fails: [generate a local incident plan](https://mailcheck.agentcartai.com/tools/verification-email-triage/?utm_source=llms&utm_medium=ai_answer&utm_campaign=link_completion_failure).
- An SMTP reply contains a three-digit or enhanced status code: [decode the bounded reply locally](https://mailcheck.agentcartai.com/tools/smtp-error-decoder/?utm_source=llms&utm_medium=ai_answer&utm_campaign=smtp_reply_decoder).

## Diagnostic guides

- [Ghost + Postmark newsletter From and Sender Signature](https://mailcheck.agentcartai.com/guides/ghost-postmark-newsletter-from-sender-signature/): Source-verified release gate that separates Ghost's per-newsletter `data.from` from the adapter `fromEmail` fallback, covers every effective address through confirmed Sender Signatures or verified domains, verifies the broadcast stream, distinguishes Postmark 400 and 401 sender failures from 406 inactive recipient, and supplies a browser-local 400-state planner that collects no sender, recipient, Server API token, message, subscriber list, Ghost configuration, Postmark payload, DNS value, or raw log.
- [Keycloak realm SMTP settings were lost](https://mailcheck.agentcartai.com/guides/keycloak-lost-realm-smtp-email-settings/): Repository-specific and current-source-backed recovery path that proves an empty realm export contains no historical sender values, distinguishes startup import skip from explicit override risk, documents the logged-in administrator email precondition and masked-secret reuse rules for Test connection, and supplies a browser-local 256-state planner that collects no domain, address, SMTP host, port, username, password, token, export, provider payload, action link, cookie, authorization header, database row, or full log.
- [Plane SMTP test email returns 500 before settings are saved](https://mailcheck.agentcartai.com/guides/plane-smtp-test-email-500-unsaved-settings/): Source-verified Plane repair that separates the browser's dirty SMTP draft, the persisted instance configuration, receiver-only test request, port validation, and the later SMTP outcome; supplies a browser-local 144-state planner that collects no receiver address, SMTP host, port value, username, password, sender address, message, cookie, authorization header, complete configuration, provider payload, or raw log.
- [Microsoft 554 5.2.252 SendAsDenied: system SMTP account, user From](https://mailcheck.agentcartai.com/guides/smtp-554-5-2-252-sendasdenied-system-account-user-from/): Source-verified SinergiaCRM repair that separates the authenticated SMTP account, envelope sender, final visible From, Reply-To, explicit Send As permission, and provider result; covers duplicated signature invitation and OTP paths; and supplies a browser-local 144-state planner that collects no address, tenant, SMTP hostname, credential, token, recipient, message body, complete transcript, provider payload, configuration dump, or raw log.
- [Verification email link opens raw JSON after success](https://mailcheck.agentcartai.com/guides/verification-email-link-opens-raw-json-api/): Source-verified repair that separates the human landing page from a programmatic JSON API, keeps GET safe from crawler or prefetch side effects, consumes a one-time token through explicit POST, handles used or expired links without raw errors, routes active versus pending-domain outcomes, and supplies a browser-local 192-state planner that collects no address, organization ID, token, full action URL, API response, cookie, authorization header, provider payload, database row, or raw log.
- [Supabase signup says confirmation email sent for an existing verified address](https://mailcheck.agentcartai.com/guides/supabase-signup-existing-verified-email-no-confirmation-sent/): Source-verified repair that preserves Supabase Auth's sanitized duplicate-user response, separates signup acceptance from message generation and delivery, replaces account-existence or delivery claims with one neutral recovery state, and supplies a browser-local 192-state planner that collects no address, password, project reference, API key, response body, user ID, confirmation link, token, cookie, provider payload, or full log.
- [Supabase signup emailRedirectTo loses a GitHub Pages repository path](https://mailcheck.agentcartai.com/guides/supabase-signup-email-redirectto-path-ignored/): Source-verified auth-js 2.110.7 and current Supabase Auth path that separates the outgoing `redirect_to` query, path-stripped cross-origin Referer, Redirect URL allow-list and SiteURL fallback, ConfirmationURL template, verification response, and final browser route with a browser-local 108-state planner that collects no address, project reference, confirmation link, token, OTP, API key, cookie, authorization header, or full network capture; open PR 2629 is identified as proposed rather than deployed behavior.
- [ZITADEL Login V2 registration skips email verification](https://mailcheck.agentcartai.com/guides/zitadel-login-v2-registration-skips-email-verification/): Source-verified ZITADEL Login 4.15.3 and 4.16.1 path that separates the Login container's opt-in EMAIL_VERIFICATION gate, explicit isVerified=false user creation, version-specific initial-send behavior, application-session completion, and one-time verification with a browser-local 108-state planner that collects no address, code, action URL, token, cookie, user ID, instance hostname, credential, environment dump, or raw log.
- [Confirmation email 429 behind Docker and IPv6](https://mailcheck.agentcartai.com/guides/confirmation-email-429-docker-ipv6-proxy-rate-limit/): Source-verified incident path that separates dual-stack client identity and exact proxy trust, shared-bucket limiter rejection, truthful Retry-After, transactional Pending and outbox handoff, bounded resend, provider outcomes, and one confirmation with a browser-local 256-state planner that collects no address, IP, forwarded header, token, message, configuration, credential, request body, or log.
- [Authentik uses Mailpit in staging and needs a real SMTP relay](https://mailcheck.agentcartai.com/guides/authentik-mailpit-staging-to-production-smtp-relay/): Source-verified Helm, Flux, Kubernetes, Authentik, provider, DNS, and receiver release gate that distinguishes inherited Mailpit defaults, production placeholders, lookup-time credential propagation, current worker state, sender verification, same-message DMARC alignment, provider outcomes, mailbox visibility, and one-time-link completion with a browser-local 256-state planner that collects no domain, address, SMTP host, credential, Secret, token, message, header, configuration, or log.
- [Authentik test_email ResultTimeout hides the real worker SMTP error](https://mailcheck.agentcartai.com/guides/authentik-test-email-resulttimeout-worker-smtp-error/): Current-source-backed diagnostic path that separates command waiting from the background send_mail task, classifies worker-side backend, DNS, connection, TLS, authentication, envelope and DATA errors, then requires provider and receiver evidence with a browser-local 256-state planner that collects no address, domain, SMTP host, credential, environment, message, traceback, token, header, provider identifier, or log.
- [Stalwart hostname conflicts with an Amazon SES MAIL FROM domain](https://mailcheck.agentcartai.com/guides/stalwart-hostname-conflicts-with-amazon-ses-mail-from/): Source- and DNS-backed preflight that separates recipient MX, dedicated SMTP A or AAAA and PTR identity, an existing SES custom MAIL FROM domain, Stalwart envelope Return-Path, observed DKIM selector and same-message DMARC alignment with a browser-local 144-state planner that collects no domain, IP, hostname, record value, address, key, message, configuration, or log.
- [Resend DKIM public key is empty while DMARC is p=reject](https://mailcheck.agentcartai.com/guides/resend-dkim-public-key-empty-dmarc-reject/): Source-backed path that treats an empty DKIM p= value as a revoked selector, distinguishes apex SPF from Resend's default or custom Return-Path TXT and MX records, verifies the current sending capability, and requires exact strict DMARC alignment on one fresh message with a browser-local 144-state planner that collects no domain, address, DNS value, key, message, provider response, configuration, or log.
- [DKIM record exists, but Authentication-Results says dkim=none](https://mailcheck.agentcartai.com/guides/dkim-record-exists-but-authentication-results-none/): Source-backed OpenDKIM and Postfix path that separates selector publication, actual DKIM-Signature output, trusted receiver evaluation, smtpd_milters versus non_smtpd_milters, and exact InternalHosts scope with a browser-local 144-state planner that collects no domain, selector, address, message, configuration, key, container value, or log.
- [Roundcube multi-domain AUTHENTICATE PLAIN failed](https://mailcheck.agentcartai.com/guides/roundcube-multi-domain-authenticate-plain-failed/): Source-verified Roundcube 1.6.17 path that separates exact HTTP host config selection, username_domain append versus forced replacement, local-part and full-address login shapes, session-stored IMAP reconnect identity, temporary private logging, and outbound SMTP with a browser-local 144-state planner that collects no host, domain, account, password, configuration, session, or log.
- [Mutt says No authenticators available on Termux](https://mailcheck.agentcartai.com/guides/mutt-no-authenticators-available-termux-smtp/): Source-verified Termux Mutt 2.4.1 and Cyrus SASL path that separates plugin file presence from the official aarch64 package's undeclared libcrypt load boundary, post-TLS SMTP AUTH advertisement, effective smtp_authenticators intersection, provider credential policy, and message acceptance with a browser-local 1024-state planner that collects no account, password, token, configuration, message, or full debug log.
- [Django Post Office 3.11.2 SMTP 421 too many connections](https://mailcheck.agentcartai.com/guides/django-post-office-3-11-2-smtp-too-many-connections/): Source-verified v3.11.2 capacity model for thread-local email backends, processes, overlapping schedulers, container-local file locks, bounded 421 retry, and active-connection regression proof, with a browser-local calculator that collects no SMTP host, address, credential, IP, queue content, configuration, provider payload, or log.
- [Django password reset returns 500 for a registered email](https://mailcheck.agentcartai.com/guides/django-password-reset-500-registered-email/): Source-verified Django 4.2.4 path that explains why unknown-address success does not test email, compares two registered accounts, separates lookup, site and token context, templates, SMTP, provider and receiver outcomes, and provides browser-local planning without collecting an address, account, token, message, log, or credential.
- [Keycloak verification link returns 500 after restart](https://mailcheck.agentcartai.com/guides/keycloak-verification-email-link-500-after-restart/): Source-verified Keycloak 26.7.0 path that separates signed action-token validation, fresh-browser confirmation, missing original root authentication-session cleanup, the preview stateless JPA provider, truthful post-verification results, and browser-local planning without collecting a link, token, account or log.
- [Registration returns 500, but the account was created](https://mailcheck.agentcartai.com/guides/registration-returns-500-but-account-created/): Source-verified state model for committed accounts, Required versus Optional verification, post-commit token-store or sender failures, truthful HTTP semantics, idempotent retries, durable recovery jobs, and browser-local planning without collecting account data.
- [Spring Boot says verification email sent, but no email was sent](https://mailcheck.agentcartai.com/guides/spring-boot-registration-says-verification-email-sent-but-no-email/): Source-verified release gate for hashed verification secrets, transaction commit, durable outbox or after-commit dispatch, proxy-based @Async execution, bounded JavaMailSender results, truthful API wording, anti-enumerating resend, and single-use completion with browser-local planning.
- [Email authentication guide index](https://mailcheck.agentcartai.com/guides/): SPF, DKIM, DMARC, PTR, MTA-STS, provider requirements, and exact SMTP rejection codes.
- [SMTP is in .env, but Docker Compose password-reset email is not sent](https://mailcheck.agentcartai.com/guides/docker-compose-smtp-env-not-passed-password-reset/): Source-verified boundary map for Compose interpolation, explicit service export, no-auth versus authenticated SMTP, nil or optional secret handling, presence-only running-container checks, forced recreation, provider outcomes, reset-link completion, and browser-local planning without collecting a secret or recipient.
- [Rails Devise password-reset email not received in Gmail](https://mailcheck.agentcartai.com/guides/rails-devise-password-reset-email-not-received-gmail/): Source-verified Rails 7.2 and Devise 4.9 path across private account mapping, placeholder addresses, reset token persistence, default synchronous Action Mailer delivery, privacy-safe instrumentation, provider outcomes, Gmail receiver acceptance, mailbox visibility, duplicate DMARC handling, and browser-local planning.
- [Password-expiry email not resent after an SMTP failure](https://mailcheck.agentcartai.com/guides/password-expiry-email-not-resent-after-smtp-failure/): Source-verified Rauthy handoff boundary and independent recovery design for durable semantic intents, password-expiry generations, current-state revalidation, supersession, worker leases, bounded retry, outage cutoffs, and browser-local planning without collecting account or message data.
- [Ticket requester receives creation email but not resolution](https://mailcheck.agentcartai.com/guides/ticket-requester-receives-creation-email-but-not-resolution/): Source-verified per-actor notification path for requester-author exclusion, independent requester and observer selection, queue execution, per-recipient transport evidence, provider outcomes, and browser-local boundary planning without collecting ticket or mailbox data.
- [GLPI technician notification creates no queue row](https://mailcheck.agentcartai.com/guides/glpi-technician-notification-no-queue-row/): Source-verified GLPI 11.0.8 path that separates ASSIGN_TECH ticket actors from ITEM_TECH_IN_CHARGE linked assets, checks persisted target IDs, use_notification, queue insertion, provider outcomes, and browser-local planning without collecting ticket or account data.
- [Certificate renewal succeeded, but SMTP notification failed](https://mailcheck.agentcartai.com/guides/certificate-renewal-succeeded-smtp-notification-failed/): Source-verified state model for ACME result, Kubernetes TLS Secret commit, exactly-one terminal notification, SMTP failure isolation, background-runner failure budgets, duplicate call-site removal, and browser-local planning.
- [Contact form submission saved, but notification email is missing](https://mailcheck.agentcartai.com/guides/contact-form-submission-saved-but-notification-email-missing/): Source-verified state model for durable submission persistence, administrator notification independent from visitor identity, optional submitter confirmation, idempotent jobs, mail transport acceptance, later delivery outcomes, and browser-local planning.
- [Contact form says sent, but no request was made](https://mailcheck.agentcartai.com/guides/contact-form-says-sent-no-request-no-email/): Source-verified repair path for a simulated contact-form success, with durable intake, stable submission references, idempotent notification jobs, server validation, abuse controls, provider events, privacy-safe logging, and browser-local state planning.
- [Quote email fails with a provider configuration error](https://mailcheck.agentcartai.com/guides/quote-email-provider-configuration-error-pdf-attachment/): Evidence-led path for immutable quote revisions, non-empty PDF artifacts, bounded message composition, encoded attachment limits, exact provider or SMTP failure classes, monotonic delivery events, safe retry, and browser-local planning without collecting a quote, recipient, or credential.
- [Stellar Horizon payment confirmation and receipt email retry](https://mailcheck.agentcartai.com/guides/stellar-horizon-payment-confirmation-receipt-email-retry/): Source-verified Web3 state model for submission timeouts, transaction-hash reconciliation, exact payment-operation evidence, idempotent receipt jobs, email API acceptance, asynchronous delivery outcomes, and secret-free logging.
- [Symfony Mailer uses mailer.transports but no email arrives](https://mailcheck.agentcartai.com/guides/symfony-mailer-transports-ignores-dsn-no-email/): Source-verified path for the intentional Symfony 7.4.14 transport collection, effective DSN and environment, Messenger routing and workers, synchronous transport debug, provider events, recipient-server outcomes, and inbox visibility.
- [Nodemailer 535 Authentication Failed in a Payload / Next.js Build](https://mailcheck.agentcartai.com/guides/nodemailer-535-authentication-failed-payload-nextjs-build/): Exact boundary map for EAUTH and AUTH PLAIN during Payload adapter construction, Mailgun domain credentials and region, dotenv secret transport, port security, runtime verify, and consented send evidence.
- [Cloudflare Email Routing vs Email Sending](https://mailcheck.agentcartai.com/guides/cloudflare-email-routing-vs-email-sending-workers-binding/): Architecture boundary for inbound routing, verified-destination send bindings, arbitrary-recipient Email Sending through Workers, REST, or SMTP, separate DNS identities, delivery events, and controlled migration.
- [Cloudflare Email Service: Proofpoint 554 blocked](https://mailcheck.agentcartai.com/guides/cloudflare-email-service-proofpoint-554-blocked/): Provider-specific response path for cf-bounce SPF, DKIM, MX and DMARC verification, a Proofpoint shared-IP reputation rejection, provider-owned escalation, target-segment testing, and magic-link failure recovery.
- [Verification email API returns 200 or 202 but nothing arrives](https://mailcheck.agentcartai.com/guides/verification-email-api-200-but-not-received/): Developer incident path for tracing a received code to the exact pending account, rejecting Nodemailer/Ethereal test transports in production, keeping a committed pending account separate from notification handoff, surviving restarts with durable work or a bounded resend, and proving provider and receiver outcomes without logging a recipient, OTP, link, token, or credential.
- [Auth0 verification email not received](https://mailcheck.agentcartai.com/guides/auth0-verification-email-not-received/): Boundary map for signup and resend triggers, Management API verification jobs, verification tickets, tenant and user state, Auth0 logs, built-in or external email delivery, receiver visibility, and link or OTP completion without collecting a recipient, ticket, code, token, credential, or tenant log containing personal data.
- [Firebase Auth verification email not received](https://mailcheck.agentcartai.com/guides/firebase-auth-verification-email-not-received/): Boundary map for verification, password reset, and email-link messages across Client SDK calls, Admin SDK link generation, project and user state, operation-specific limits, Firebase or custom delivery, receiver visibility, and action-code use without collecting a recipient, action link, token, or Firebase credential.
- [AWS Cognito verification email not received](https://mailcheck.agentcartai.com/guides/aws-cognito-verification-email-not-received/): Boundary map for signup, confirmation resend, invitation, and password-recovery email across API evidence, user and recovery state, Cognito email mode, Amazon SES identity, sandbox, quota, suppression and events, and receiver visibility without collecting a recipient, code, or AWS credential.
- [Supabase Auth email not received](https://mailcheck.agentcartai.com/guides/supabase-auth-email-not-received/): Boundary map for confirmation, magic-link, OTP, invite, and recovery email across Auth logs, built-in or custom SMTP, provider events, receiver visibility, and token prefetch or expiration without collecting a token or project credential.
- [Supabase Auth with Brevo: SMTP account not activated](https://mailcheck.agentcartai.com/guides/supabase-brevo-smtp-account-not-activated/): Focused path for a Supabase Auth 500 paired with Brevo's account-activation relay error, separating provider activation from SMTP credentials, sender verification, delivery, and secure link use without collecting a recipient or credential.
- [Resend delivered but email not received](https://mailcheck.agentcartai.com/guides/resend-delivered-but-not-received/): Provider-specific map from queued, sent, suppressed, failed, delivery_delayed, bounced, and delivered events to the next application, provider, SMTP, or receiver action; delivered means recipient-mail-server acceptance, not inbox placement.
- [SMTP 250 accepted but email later bounced](https://mailcheck.agentcartai.com/guides/smtp-250-accepted-but-email-bounced/): Generic per-recipient state model for synchronous submission results, asynchronous DSNs or provider events, ENVID and ORCPT correlation, bounded ingestion, and idempotent transitions without calling relay acceptance final delivery.
- [First email arrived, later transactional emails are missing](https://mailcheck.agentcartai.com/guides/first-email-arrives-later-transactional-emails-missing/): Compare first and later business paths, prove the customer-send trigger and attachment mapping, and keep application, queue, provider, receiver, and visibility states separate.
- [Outlook 550 5.7.1 S3150 block-list rejection](https://mailcheck.agentcartai.com/guides/outlook-550-5-7-1-s3150-block-list/): Exact response path for a Microsoft consumer-mail IP block, shared-provider versus dedicated-IP ownership, asynchronous NDR handling, and controlled delivery recovery.
- [Web3 verification email not arriving](https://mailcheck.agentcartai.com/guides/web3-verification-email-not-arriving/): Sender-side incident workflow across application generation, provider events, suppressions, SMTP replies, receiver evidence, and public authentication controls for wallet login, 2FA, password-reset, and transaction email.
- [Web3 DMARC enforcement checklist](https://mailcheck.agentcartai.com/guides/web3-dmarc-enforcement-checklist/): Sender inventory, receiver evidence, alignment, reporting-cycle, staged-enforcement, and rollback checks for wallet alerts, login email, transaction receipts, governance, support, and newsletters.
- [Separate sending domain launch checklist](https://mailcheck.agentcartai.com/guides/separate-sending-domain-spf-dkim-dmarc-warmup/): Dedicated sender-domain preflight that separates receiving-provider MX and outbound SPF ownership from transactional-provider DKIM and DMARC evidence before outreach, newsletter, or notification traffic ramps.
- [Web3 email security check](https://mailcheck.agentcartai.com/guides/web3-email-security/): Authentication and anti-spoofing review for wallet alerts, governance notices, transactional email, and newsletters.
- [Crypto phishing email header check](https://mailcheck.agentcartai.com/guides/crypto-phishing-email-header-check/): Private workflow for suspicious wallet alerts, exchange notices, DAO messages, and token emails using authentication, identity-alignment, and Received-routing evidence.
- [SPF 10-query limit](https://mailcheck.agentcartai.com/guides/spf-10-lookup-limit/): Static lookup-budget interpretation and safe remediation boundaries.
- [DKIM selector discovery](https://mailcheck.agentcartai.com/guides/dkim-selector/): Why DKIM cannot be judged reliably without a real selector.
- [DMARC policy discovery](https://mailcheck.agentcartai.com/guides/no-dmarc-record-found/): RFC 9989 direct lookup and bounded parent-domain tree walk.
- [Alibaba Cloud ECS and EIP PTR setup](https://mailcheck.agentcartai.com/guides/alibaba-cloud-ecs-ptr-reverse-dns/): Same-account IPv4 eligibility, Reverse DNS Lookup steps, ownership verification, forward A record, PTR recycling, and bidirectional validation.
- [PTR and forward DNS](https://mailcheck.agentcartai.com/guides/gmail-550-5-7-25-ptr-record/): Actual sending-IP reverse and forward confirmation.

## Optional

- [Chinese diagnostic help](https://mailcheck.agentcartai.com/help/): 中文输入、结果、隐私和错误边界。
- [Sitemap](https://mailcheck.agentcartai.com/sitemap.xml): Complete canonical human-readable page list.