Why does /audit return in ~3 seconds?

We read DNS and key email header fields only, use parallel resolvers with 2s timeouts, and return structured results with suggestions.

What is Proof‑of‑Scan?

We hash canonical JSON (sha256) and provide a Verify endpoint to recompute via multiple public DNS resolvers and compare hashes.

Do you store email bodies?

No. We never store bodies. We parse headers only, delete .eml right after parsing, and keep PDF/JSON for evidence.

DMARC subdomain policy (sp=) — when to use it

Use sp= to set a different policy for sub‑domains than the parent. Helpful when migrating routes or when only some sub‑brands are ready for enforcement. Example: p=reject; sp=quarantine.

Audit subdomains

Run audits on key sub‑domains and ensure alignment paths exist before raising policy.

Patterns

Parent p=reject, sub‑brands sp=quarantine during migration
Transactional sub‑domains strict; marketing sub‑domains staged
Explicit sp= avoids surprises when inheriting parent policy

DMARC subdomain policy (sp=) — when to use it

Audit subdomains

Patterns

Next steps