Skip to content
dnsdon

Privacy

The short version: we don't keep a history of what you check, analytics cookies are only set if you accept them, and nothing is kept longer than it needs to be.

What happens when you run a check

The domain you enter is sent as DNS queries to public resolvers (Cloudflare, Google Public DNS, Quad9), to the domain's parent and authoritative nameservers, and to the registry's RDAP service. Those operators receive the queries from our server, not from your device, under their own privacy policies.

For SSL checks, our server also connects to the site itself on ports 443 and 80, or on the port you choose, identifying itself with a dnsdon user agent. DNS lookups fetch one page over HTTP when a name is an alias of a hosting service (such as GitHub Pages or S3), to check for an unclaimed resource. Email checks fetch the domain's MTA-STS policy file from mta-sts.<domain> over HTTPS when one is announced, and the BIMI logo when one is published; the logo is embedded in the report, so your browser never loads it from the domain's server. The site's operator will see these connections coming from our server, not from you.

The Subdomain Finder sends the domain name (and nothing about you) to the public Certificate Transparency search services crt.sh and Cert Spotter, which list the certificates issued for it.

What we store

  • Report cache. A completed report is cached for 60 seconds, keyed by the domain and options, so repeated checks are fast. It contains no information about you and expires automatically.
  • Shared reports. Each report you view is held for 30 minutes so it can be shared. Only if you choose Share link is it saved as a snapshot, readable by anyone who has the link, and deleted after 30 days. Snapshots contain the report only, nothing about you.
  • Rate limiting. To keep the tools available to everyone, counters keyed by a one-way hash of your IP address (or your account, on paid plans) are kept for up to a day: per-minute counters for each tool, and a daily count of checks.
  • Error logs. If something breaks on our side, technical error details are logged to help fix it. We don't log the domains you check as part of normal operation.

What we don't do

  • No saved history of the domains you check, beyond reports you deliberately share (our analytics provider does see page addresses; see Analytics below).
  • No advertising, and no advertising cookies.
  • No selling or sharing of query data.
  • No search-engine indexing of individual reports—they are marked noindex.

Accounts and monitoring

The free tools need no account, and set no cookies unless you accept analytics cookies (see Analytics below). If you sign up for monitoring, we store your email address, the domains you monitor and the results and alerts of their checks. Signing in sets a session cookie, used only to keep you signed in. Sign-in uses Google, which tells us your name and verified email address.

If you collect DMARC reports with us, the mail providers that send them tell us which servers sent mail as your domain, how many messages, and whether they passed SPF and DKIM. They contain no message content and no recipient addresses. We keep them for 365 days.

Payments are handled by Paddle (Paddle.com Market Ltd), which acts as our reseller and merchant of record. Paddle collects your payment and billing details under its own privacy policy; we never see or store card details. We receive and keep your Paddle customer ID, your subscription and its status, and a record of each payment (amount, tax, date and invoice number) for accounting.

You can delete your account, its monitors and their history at any time from your settings.

If you send us a message through the contact form, we keep your name, email address and message so we can reply.

Fonts

Fonts are served from this site, not from a third-party font service.

Analytics

We use Microsoft Clarity to see how the site is used and where it gets in the way. Clarity records how you interact with pages: the addresses of pages you view, clicks, scrolling and mouse movement, and what the page showed, so a session can be replayed. It also receives your browser, device, screen size and approximate location, derived from your IP address.

  • What it doesn't see. Anything you type into a form, including the domain box, is hidden from recordings. Account pages (dashboard, monitors, settings) are hidden entirely.
  • The domains you check. A report's address includes the domain you checked (for example /email-checker?domain=example.com), and the report shows it, so Clarity receives it. These are public domain names, and nothing links them to you unless you are signed in.
  • Cookies only with consent. Until you accept the cookie banner, Clarity sets no cookies and cannot link your visits. You can change your choice with Cookie settings at the bottom of any page. Details are in the cookie policy.
  • Who processes it. Microsoft processes this data for us under the Microsoft Privacy Statement, and keeps recordings for up to 30 days and aggregated data for up to 13 months.

Changes

We will update this page before collecting anything new, and show the date of the last change below.

Last updated October 25, 2026. Questions: contact us.