Frequently asked questions

echo.email analyses one email per address and explains the result. The answers below cover how the service works and what each check in the report means.

How does echo.email work?

The home page hands out a fresh address made of three words, such as power.file.tube@echo.email. A message sent to the address arrives at the echo.email mail server, which records the SMTP conversation and passes the message on for analysis. A few seconds later the page switches to a report covering authentication, content, compliance and delivery. Nothing needs installing and no account exists.

How long does the address stay valid?

The address stays live while the page stays open. The page checks in every two seconds, and a reload within 60 seconds keeps the same address in the same tab. Once the page has been closed for more than a minute, the mail server refuses new mail to the address with a permanent error.

The first message to arrive wins. Later messages to the same address are refused, so every report belongs to exactly one email. Messages larger than 10 MB are refused during the SMTP conversation.

How long are reports kept?

Every report, the stored message and the downloaded image data are deleted automatically 24 hours after the message arrived. During those 24 hours the report link works for anyone holding the link, and afterwards the link stops working. The sample report is the one exception, since the sample comes from a test message sent for the purpose.

What happens to the message content?

echo.email stores the whole message, meaning headers, body and attachments, together with the SMTP session details such as the sending IP address, the HELO name and the TLS version. Storage sits in the EU, and the mail server runs in Helsinki, Finland. Anyone with the report link sees the full message, so test messages work best with content safe to share. Newsletters often carry tracking links and an unsubscribe link tied to one recipient, and a copy sent to a test list keeps those private.

Three addresses reach the operator directly: postmaster@echo.email, abuse@echo.email and privacy@echo.email. The privacy policy has the full details.

What does the SPF check test?

SPF lists the servers allowed to send mail using a domain in the return path. echo.email takes the domain from the envelope sender (the MAIL FROM address, also called the return path) and evaluates the SPF record of the domain against the IP address of the server delivering the message. Only a pass counts as a good result. Softfail, neutral and none all leave the receiver without SPF proof of the sender.

The HELO name is not checked, matching how the large mailbox providers evaluate SPF for bulk mail. The report shows every record and mechanism along the way, so the path to the final result stays visible.

Why does the number of DNS lookups matter?

An SPF evaluation is allowed at most 10 DNS lookups. The include, a, mx, ptr, exists and redirect mechanisms each count toward the limit, including the ones inside nested includes. Going over the limit turns the result into a permanent error, and receivers then treat the message as having no valid SPF at all. Void lookups, meaning queries returning no record, have a separate limit of two. Long chains of third-party includes are the usual cause, and trimming the list of services fixes the problem.

What does DKIM prove?

DKIM adds a cryptographic signature to the message headers. The signing domain publishes the public key in DNS under a selector, and echo.email fetches the key and verifies the signature against the headers and body as received. A pass means the signed parts arrived unchanged and the signing domain vouched for them.

The report lists the signing domain (d=), the selector (s=), the signed headers (h=) and the key type and size. A body length limit (l=) is flagged, because the limit allows extra content to be appended after signing.

What is DMARC?

DMARC ties SPF and DKIM to the domain in the visible From address. The From domain publishes a policy at _dmarc.<domain> telling receivers how to treat mail failing authentication: none, quarantine or reject. A message passes DMARC when SPF or DKIM passes for a domain aligned with the From domain.

DMARC adds no authentication of its own. The value lies in the alignment requirement and in the aggregate reports (rua=) receivers send back to the domain owner.

What does aligned mean?

Alignment compares an authenticated domain with the From domain. Relaxed alignment requires the same organisational domain, so mail.example.com aligns with example.com. Strict alignment requires the exact same hostname. The organisational domain comes from the Public Suffix List, which knows names such as example.co.uk count as one registrable domain. When the report says aligned without a qualifier, the comparison is with the From domain.

What is BIMI?

BIMI publishes a brand logo for mailbox providers to show next to authenticated mail. The record lives at default._bimi.<domain> and points to an SVG logo (l=) and, for most providers, a Verified Mark Certificate (a=). BIMI applies only to domains with an enforcing DMARC policy, meaning quarantine or reject at 100 percent. echo.email shows the record and whether the DMARC policy meets the requirement.

Why does reverse DNS matter?

Every IP address sending mail needs a PTR record pointing to a hostname, and the hostname needs an A or AAAA record pointing back to the same IP address. The round trip is called forward-confirmed reverse DNS, or FCrDNS. Large mailbox providers treat FCrDNS as the minimum for a sending server, and mail from an IP address without a PTR record is often refused outright.

What is generic reverse DNS?

Some PTR records follow an ISP naming pattern, such as 192-0-2-10.dynamic.example.net. Names like these suggest a residential connection or a server nobody configured for mail, and filters treat them with suspicion. A dedicated name in the sender’s own domain, such as mail.example.com, reads as a deliberately configured mail server.

Which HELO name works best?

The sending server introduces itself with a HELO or EHLO name at the start of the SMTP conversation. A good name belongs to the sending server, resolves in DNS and matches the PTR record of the sending IP address. Bare IP addresses, names like localhost and random strings are typical for malware and snowshoe spam, and filters weigh them accordingly.

Why check TLS?

Opportunistic TLS encrypts the SMTP conversation when the receiving server offers STARTTLS. echo.email offers STARTTLS on every connection and records the TLS version and cipher the sender chose. Mail sent without TLS travels in plain text between the two servers, and Google and Yahoo list TLS as a requirement for bulk senders. The report also counts links and images loaded over plain http, because those requests travel unencrypted too.

Why check IPv6?

Two questions decide IPv6 readiness. The first is whether the message arrived over IPv6, which shows the sender reaches IPv6-only mail servers. The second is whether every host serving images and links in the message has an AAAA record, so a reader on an IPv6-only network or behind carrier-grade NAT still loads the content. The report marks the message as ready for IPv6 when both answers are yes.

How is email size measured?

Email size is the number of bytes as transmitted: all headers, every MIME part, attachments and the overhead of base64 or quoted-printable encoding. Gmail clips messages with more than about 102 KB of HTML and hides the rest behind a link, and the clipped part often holds the unsubscribe link and the tracking pixel.

What is image weight?

Image weight is the total size of the remote images referenced in <img> tags, measured by downloading each image once. The figure is a minimum, since images from srcset attributes and CSS backgrounds are not counted. A heavy message loads slowly on mobile connections and costs the reader data.

What is image bloat?

Image bloat estimates the bytes a sender saves by serving each image closer to the size the message displays. An image up to twice its display size counts as zero bloat, since high-density screens use the extra pixels. Beyond twice the display size, the extra pixels add bytes without adding detail. Images under 1 KB, such as spacers, are left out of the figure.

How does echo.email handle images?

The analysis downloads every remote image once and records the HTTP status, redirects, size, content type and pixel dimensions, then compares the dimensions with the size declared in the HTML. Downloading an image is what a mail client does when a reader opens the message, so open tracking registers an open. The downloads come from the Cloudflare network, and requests to private or internal addresses are refused.

Links are parsed from the HTML and grouped by host, with the query parameters decoded for easier reading. echo.email never follows ordinary links, because following a link risks confirming a subscription, triggering an action or registering a click. The one exception is the one-click unsubscribe URL described below.

What is List-Unsubscribe?

List-Unsubscribe is a header defined in RFC 2369. The header holds one or more ways to leave the list, as a mailto: address, an https: URL or both. Mailbox providers use the header to show their own unsubscribe button next to the sender name. Plain http URLs are outdated, and https is the expected form.

What is one-click unsubscribe?

RFC 8058 adds a second header, List-Unsubscribe-Post, with the fixed value List-Unsubscribe=One-Click. With both headers present, the mailbox provider sends a POST request to the https URL and the recipient leaves the list without visiting a web page. Google and Yahoo require one-click unsubscribe for bulk senders.

echo.email sends the same POST request and reports the response. Any 2xx status counts as success. The request unsubscribes only the temporary echo.email address.

What does non-interactive unsubscribe mean?

A non-interactive unsubscribe completes without the recipient opening a browser or confirming anything. RFC 8058 one-click is the preferred method. A mailto: address in List-Unsubscribe also counts, though unsubscribing by mail is slower and gives the recipient no confirmation, so providers treat mailto as a fallback.

Why is an in-body unsubscribe link still needed?

Marketing laws in most countries expect a visible way to leave the list inside the message, usually a footer link. The headers serve the mailbox provider, and the footer link serves the reader. echo.email looks for a link with unsubscribe wording or an unsubscribe-style URL. The detection is a heuristic and occasionally picks the wrong link. A separate tracking parameter on the footer link keeps footer and header unsubscribes apart in the sender’s statistics.

What is List-Id?

List-Id (RFC 2919) names the mailing list a message belongs to, for example News <news.example.com>. Google and Yahoo do not require the header. Receivers and recipients use the header to sort and filter mail by stream, so adding one is good practice.

What is the good practice checklist?

The checklist follows the requirements Google and Yahoo published for bulk senders in 2024: aligned SPF, aligned DKIM, forward-confirmed reverse DNS, TLS, a From domain outside the freemail providers with DMARC not failing, a published DMARC policy, at least one aligned authentication method, one-click unsubscribe and a visible unsubscribe link. Each row reads yes or no. A red row is a likely cause of weaker inbox placement at the large providers, and a full score of nine is the baseline for bulk mail.

How is the message rendered?

The rendered view shows the HTML part inside a sandboxed frame. The browser does the rendering, so the result matches a desktop browser rather than a specific mail client or device. Scripts, forms and links are disabled in the preview. Separate views show the message with images blocked and with alt text in place of each image, which is how many readers first see a message.

What does the MIME section show?

MIME is the structure inside a message: the parts, their content types, character sets, transfer encodings and the boundaries separating them. A typical newsletter has a multipart/alternative container with a text/plain part and a text/html part. A missing plain text part, a missing closing boundary or unusual nesting stands out in the tree.

What does the payload section show?

The payload section shows the raw message as received, with statistics: total size, line count, the longest line, characters outside ASCII and bare line feeds. RFC 5322 limits a line to 998 characters, and some servers break or reject longer lines. Bare line feeds without a carriage return are a common source of DKIM failures, since servers along the way rewrite them.

What does the DNS section show?

Every DNS query made for the report appears in the DNS section, grouped by purpose: reverse DNS, SPF, DKIM, DMARC, BIMI and the IPv6 check. Each entry shows the name, record type, response code, answers with TTL and any authority records. The list shows which records produced each result, which helps when a recent DNS change has not yet reached every resolver.

More free tools

scan.mx
Check a domain’s mail setup: MX, SPF, DKIM, DMARC, BIMI.