Checks mail-sending code and DNS records against the Gmail/Yahoo bulk sender rules and Microsoft Outlook.com's: SPF, DKIM, DMARC, RFC 8058 one-click unsubscribe, TLS - each with the date it took effect. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
This page is the working piece. The full pack has everything below.
21 dated checks over SPF, DKIM, DMARC, RFC 8058 one-click unsubscribe and TLS, in VS Code and in the browser
A deliverability consultant bills $150 to $250 an hour
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.
Fifteen findings, ten of them errors, out of 21 checks - that is what one 42,000-recipient nightly digest module produces, the kind of mailer file a backend developer at a small SaaS company writes once and touches twice a year. It passes lint, tests and code review. It also breaks four separate requirements that Gmail, Yahoo and Microsoft Outlook.com have been enforcing on bulk senders for over two years.
The dates are the part people get wrong. Google and Yahoo's bulk sender requirements took effect on 2024-02-01 and apply to anyone sending more than 5,000 messages a day to their users, counted per From domain. Microsoft Outlook.com started enforcing the same authentication set on 2025-05-05, routing non-compliant bulk mail to the Junk folder. Nothing warns you on the day you cross the threshold.
Here is what the fixture actually contains, line by line.
Line 9 is an SPF record with eleven include: tokens. RFC 7208 section 4.6.4 caps SPF evaluation at ten DNS lookups; past that the receiver returns PermError, which DMARC treats as an SPF failure. The record was fine when it had six includes. Nobody changed it - the vendors it points at added their own includes. The same line ends in ?all, so any server passes SPF anyway.
Line 10 is a DKIM record carrying t=y, testing mode, which tells receivers to treat a signature failure exactly as if the message were unsigned. The key on that line is 55 base64 characters, where a 2048-bit key is about 392.
Line 11 is v=DMARC1; p=none; pct=20; sp=none - a policy that instructs receivers to do nothing, applied to a fifth of the mail, with every subdomain exempted. It satisfies the Gmail and Outlook.com minimum and protects nothing.
Line 16 sets port 25, secure: false and rejectUnauthorized: false on the transport, against a requirement to transmit over TLS. Line 23 sends the whole campaign From [email protected], a domain that publishes p=reject for its own users - so the mail fails DMARC at the receiver by construction.
Then the unsubscribe, which is where the code-side findings cluster. Line 27 sets List-Unsubscribe to a mailto: address and no https:// URI, and sets no List-Unsubscribe-Post at all. One-click unsubscribe under RFC 8058 is an HTTPS POST carrying the body List-Unsubscribe=One-Click; a mailto-only header cannot serve it, and without the paired Post header the mail client shows the old two-step link instead. Line 32 declares the unsubscribe route with app.get and wraps it in requireAuth - so even when a client does send the POST, it arrives at a route that answers GET only, behind a login the mail client has never seen.
That is the part an online SPF or DMARC checker structurally cannot tell you. Those tools read published DNS for a domain that already exists. Eight of these 21 checks live in code - the headers, the TLS flags, the From line, the unsubscribe route - and two more read records still sitting in a Terraform file.
Bulk Sender Lint runs the 21 checks over the file you have open and prints the rule, the line, the clause (RFC 7208, 6376, 7489, 8058) and how many days ago that requirement took effect. That part is free, in the editor and in the browser, with nothing uploaded. The paid part is a different axis: sweep every matching file in the workspace and write a dated report you keep - the artefact you hand to a deliverability review or a client. $29 once, one licence key per person or team seat, 7-day full refund. A deliverability consultant bills $150 to $250 an hour.
Run it on the fixed version of the same file and it says: clean against all 21 checks.
It reads the files where sending is configured - mailer code, DNS records, the unsubscribe route - and applies 21 checks drawn from the Gmail, Yahoo and Microsoft Outlook.com bulk sender requirements and from RFC 7208, 6376, 7489 and 8058. Each finding names the line, the clause it comes from, and the date that requirement took effect.
Backend and platform developers who own transactional or marketing email inside a product: the person paged when a 40,000-recipient digest lands in Junk. It is written for the repository rather than the marketing dashboard, so it fits teams sending through Amazon SES, SendGrid, Mailgun, Postmark or their own SMTP relay.
Online checkers read DNS for a domain you have already published. They cannot see the mailer code, where the List-Unsubscribe-Post header, the TLS flag and the unsubscribe route live, and they cannot read a record still sitting in a Terraform file. Eight of the 21 checks are code-side and invisible to them.
Free: checking the file you have open, all 21 checks, every finding with its clause and its line - and the same engine runs free in the browser with nothing uploaded. Paid, $29 once: sweeping every matching file in the workspace and writing a dated report you keep as the evidence artefact.
A deliverability consultant bills $150 to $250 an hour, and reviewing one sending stack is rarely a single hour. The extension is $29 once, one licence key per person or team seat, with a 7-day full refund. The single-file check and the browser check stay free either way.
One question, answered by the person who built it. Your email only if you want the answer sent.