Why does /audit return in ~3 seconds?

D‑7: publish new DKIM selector(s); verify dkim=pass in staging
D‑6: set up envelope domains under your brand for SPF alignment
D‑5: validate One‑Click headers and endpoints (without auto‑posting)
D‑4: run side‑by‑side traffic; compare AR and alignment results
D‑3: stage DMARC policy per route; keep RulePack guardrails
D‑2: confirm complaint rate and throttling behavior
D‑1: freeze configs; export current DNS as rollback reference

We read DNS and key email header fields only, use parallel resolvers with 2s timeouts, and return structured results with suggestions.

What is Proof‑of‑Scan?

We hash canonical JSON (sha256) and provide a Verify endpoint to recompute via multiple public DNS resolvers and compare hashes.

No. We never store bodies. We parse headers only, delete .eml right after parsing, and keep PDF/JSON for evidence.

Warm up routes, publish selectors, stage DMARC and test unsubscribe headers before cutover. This 7‑day plan reduces risk and preserves alignment.

Attach PDF with scanId/sha256 and Verify results to the cutover ticket.