TrustHeader ingests DMARC aggregate and failure reports and SMTP TLS reports, archives the original payload, and runs authentication and hygiene checks against it. Findings show their derivation and exclude checks that could not run — a report is an observation, not proof a domain is safe everywhere.
What it does
Three surfaces, kept structurally separate so the parts reachable by mail infrastructure never touch the authenticated dashboard.
Ingest
Reports arrive by email or over HTTPS and land in an immutable raw archive before anything is parsed. Failure-sensitive raw messages expire on a bounded window; everything else stays rebuildable.
Assess
Modules cover DMARC, SPF, DKIM, DNSSEC, MX hygiene, MTA-STS, TLS reporting, DANE and BIMI. A skipped check is never counted as a pass.
Serve
The anonymous surfaces mail infrastructure needs to reach run apart from the dashboard, so nothing public can see tenant report data.
/.well-known/mta-sts.txtPOST /v1/tlsHow it works
Point your domain at TrustHeader and reports start arriving.
Publish the DMARC, MTA-STS and TLS reporting records that point at TrustHeader for each domain you monitor.
Change policy or reporting addresses as your setup changes; TrustHeader keeps receiving.
Reports get parsed, assessed and stored, ready to view in the dashboard or pull from the API.
The repository is private and the platform is not yet generally available.