Home › Changelog

Changelog

What changed in the tool and when, newest first: checks, the report, the API, fixes. I keep this by hand from the commit history, so the dates are the days the change was made. The project started on August 14, 2026.

Nov 1, 2026

MailerLite won't send a test to an address nobody has verified, and its verification email used to take our one-time address, so you got no test. Now that email leaves the address free, the test page shows a button to confirm it, you send your test to the same address, and the report is the usual one. Only your click opens that link; the link check no longer does.

Oct 31, 2026

One API call now checks a domain's mail setup with no email involved: GET /api/v1/infra/check?domain=example.com. It covers SPF, DKIM, DMARC, MX, PTR and blocklists, connects to the domain's own mail hosts to read STARTTLS and the certificate, and answers in JSON with ok, a status and a score out of 100. MTA-STS, TLS-RPT, BIMI, DNSSEC, DANE, the name servers and the date the domain's registration runs out are in the answer too and cost no points. Every run is stored, and with diff=true you get what changed since your own last run of that domain, so a cron job can fail the day a DKIM key disappears. Somebody else checking the same domain never becomes your baseline, and a renewed certificate or one blocklist timing out doesn't count as a change. No key is needed. The API reference has the cron line.
DKIM is the one check that needs help here, because a domain doesn't publish a list of its selectors. The call tries the selectors you pass, the ones found in your earlier runs and a list of common names, and says unknown when none of them answers, since that proves nothing about the domain.
Eight more single checks in the API, for one question at a time: GET /api/v1/tools/ptr, /mta-sts, /tls-rpt, /dnssec, /dane, /smtp, /ns and /registration.

Oct 30, 2026

Setup pages for the assistants and editors that reach the test through the MCP server: Claude, Claude Code, Cursor, Gemini CLI, GitHub Copilot, Zed, Warp, OpenCode and any other client. Each one has the exact config for that client, since the key names differ: Gemini CLI wants httpUrl, OpenCode wants type: remote.
GitHub Actions and GitLab CI/CD have their own pages too, with the workflow to paste and what makes a job fail.

Oct 29, 2026

On the first screen, "Copy all addresses" under the inbox placement test now copies the test address as well. It used to copy only the provider mailboxes, so an email sent to that list never reached the email test, and its report kept waiting for a message that had gone everywhere else.
In the same card, each provider now shows its number of mailboxes as a plain figure next to its own Copy button. In Russian the phrase "15 почтовых ящиков" did not fit and ran over the provider name. The total under the list also takes the right plural form in Russian, Ukrainian, Polish, Czech and Romanian: it used to say "2 почтовых ящиков".

Oct 24, 2026

Three new free tools next to the DNS checkers. The email header analyzer takes the headers of a message you received and draws its route server by server, with the delay and TLS of each hop, then shows the receiving server's own SPF, DKIM and DMARC verdict and whether the From, DKIM and Return-Path domains align. The headers are sent in the body of the request, read in memory and not stored. The MX checker lists the mail servers in the order senders try them, with their addresses, and flags a null MX, a domain with no MX, CNAME or IP targets and hosts that do not resolve. The BIMI checker goes through the four things a logo in the inbox depends on: DMARC at quarantine or reject, the record, the SVG file against the Tiny PS profile and the certificate with its expiry date. In the API they are POST /api/v1/tools/header, GET /api/v1/tools/mx and /bimi.
The report reads in a new order. Both scores and the count of mailboxes that put the email in the inbox open the page, followed by the folder at each provider as a row of one square per mailbox. Then come the message as received, every link with its redirects and the registry age of its domain, and the three fixes worth most. The 42 checks sit underneath in their six groups, with filters by status. A recommendation that is not followed is marked TIP, since that group never costs points.
After "I've sent it" the first screen stays where it is and shows the check live: each group of checks fills in as it finishes, and so does the count of mailboxes that have reported. An address that expires before any email arrives says so on its card, with a new one a click away, instead of opening an error page.
The verdict, the fix plan and the translations of a report keep the form of address the page uses: "Sie" on German pages, "tú" on Spanish ones, and so on for every language that has two. A German plan could switch to "du" under a page that says "Sie".

Oct 19, 2026

One email with its Subject header twice, or with none, used to make the folder check treat the whole provider mailbox as unreadable for as long as a test was running there. On October 19 one email without a subject, which arrived a few seconds before a test, did this to 12 of the 14 provider mailboxes. Now the marker counts in any copy of the subject. A message without one is skipped.

Oct 16, 2026

Four free DNS checkers, listed on Free tools: SPF, DMARC, DKIM and blocklists. No email is involved, they read live DNS. The SPF checker follows every include and counts lookups against the limit of ten. The DMARC checker reads the policy and alignment, and looks up whether each external report address has agreed to take reports. For DKIM you give a selector and get the key decoded, with its type, size and flags. The blocklist checker asks the IP or domain lists the report uses and shows each answer on its own line. A lookup that timed out or a list that refused the query is shown as not checked and never counted as clean. The same checks are in the API as GET /api/v1/tools/spf, /dmarc, /dkim and /blocklist.
Spamhaus answers again. From October 9 our DNS lookups went through resolvers that Spamhaus treats as public, and it answers those with a refusal instead of a result. About half of the reports since then show Spamhaus ZEN as not consulted; none of them counted it as clean. Lookups now go through a resolver of our own, so a new test of the same email gets Spamhaus's answer.
The key form for Zapier and n8n and the Mailchimp and HubSpot panels now speak the language of the page they are on, in all 31 languages of the site. English pages are unchanged.
A sample report opens without sending anything: both scores, every check, the fix plan and a folder check at several providers, on made-up data for news.example.com. It is a fixed page and does not expire.

Oct 14, 2026

In ChatGPT, the plugin no longer passes on anybody's email address or IP address. The provider mailboxes for the folder check are listed on the test's own page, where one button copies them all, and the card links there instead of printing them. Reports and permanent mailboxes show a sender as its domain; the message view drops people's names and masks phone numbers too. The DNS records in a fix plan stay exactly as you need to paste them. Other MCP clients, Claude among them, see no change.

Oct 13, 2026

On German pages, a report scoring below 70 now offers Mailculture's email audit, for anyone who would rather have a deliverability agency fix the setup. It is a partner offer and says so; other languages don't show it.
Email Spam Tester passed Zapier's review and is listed in Zapier's app directory as a beta. You no longer need an invite link: search for it in the Zap editor and connect it with a key from the Zapier page.

Oct 12, 2026

A test's email is now deleted an hour after it arrives, once its checks have run, instead of after two days. The report stays at its link with every finding, the score and the fix plan; the "message as received" view and the API's /message show the email for that hour and then say it is gone. A report link is meant to be passed on, to whoever fixes the DNS or into a ticket. For as long as the email was stored, anyone holding the link could read all of it. Emails to permanent mailboxes and monitoring copies keep their own retention.
The MCP server no longer offers permanent mailboxes to Claude. A permanent mailbox belongs to someone, and Claude does not say who is asking, so it cannot use one yet. In ChatGPT they work as before.

Oct 10, 2026

The folder check no longer loses Outlook for most of a day when Microsoft ends a session early. Our Outlook mailbox kept presenting the refused sign-in until its 24 hours ran out; now a refused one is thrown away and the next check signs in again. On October 9 this kept Outlook out of the check from 17:00 to 04:00 UTC.

Oct 6, 2026

Email Spam Tester connects to HubSpot. On the HubSpot page you pick a marketing email and send its test with HubSpot's own "Send test email", so it arrives from HubSpot's servers with your domain's signature; HubSpot offers no API for that button. The page reserves the address, adds the provider mailboxes for the folder check, makes a copy of the email with the marker in its subject and deletes the copy once the test arrives. Tests from there keep a history with the score and what changed, and a permanent address can join your lists as one contact, so every email they get is checked.
Email Spam Tester has nodes for n8n, the n8n-nodes-email-spam-tester package. In a workflow, one node creates a test address, your usual Send Email or Gmail node sends to it, and the same node waits for the report and passes on the score, the problems and the fixes. It also reads the folder check and keeps permanent mailboxes for newsletters, and a trigger starts a workflow when a report is ready. It uses the same free keys as Zapier; the n8n page has the form.
Email Spam Tester works in Zapier. A Zap can create a test address, get the report of the email sent there with its score, problems and fixes, and keep a permanent mailbox whose every incoming email is checked and handed on, so a newsletter that drops below a score can post to Slack. It is waiting for Zapier's review; the Zapier page has the invite link and the key.
The API has personal keys. Nothing that worked without a key needs one now; a key is for automation platforms, whose calls all come from the platform's own servers and would otherwise share one IP's daily limit. You get one with an email address from POST /api/v1/keys. With it, limits count per key, the key's tests form a history, and it can keep permanent mailboxes: addresses you subscribe to a newsletter so that every issue gets checked. Their reports open only with that key. The API reference lists the calls.

Oct 6, 2026

WordPress plugin 0.1.1: the WP-CLI help and messages give the command's current name, wp deliverability-tester, instead of the old one.

Oct 5, 2026

The WordPress plugin is in the WordPress.org directory as Tanichev Email Deliverability Tester. It sends a test through the site's own wp_mail(), with whatever SMTP plugin is behind it, and can send the site's own password reset and WooCommerce order emails filled with sample data. Monitoring, when switched on, reports on each new kind of email the site sends, grouped by the plugin that sent it. The plugin page has the details.
Links to LinkedIn, Xing and other large platforms (social networks, messengers, app stores, review and job sites, marketplaces, Google Maps) no longer show up as broken. LinkedIn answers an automated check with code 999 and Xing with "page not found", while a person who clicks the same link gets the page, so a company footer lost points for links that work. The report now counts these links as working without opening them, including ones that pass through a mailing platform's click tracker first. Short links like lnkd.in and the platforms' own outbound redirects are still followed, so where they lead is still checked against the threat lists.
When a platform turns our check away at one of those redirects (Amazon answers robots with 503, LinkedIn with 999), the link is reported as not checked instead of broken. A page the platform says is gone, like a deleted Google Doc, is still a broken link.

Sep 26, 2026

A subscription confirmation is no longer charged for having no List-Unsubscribe header. The four bulk-sender checks used to take any message with a mailing platform's headers for a mailing, so Mailchimp's "Please Confirm Subscription" lost 18 of its 100 points for a header it does not need. The report now reads the message first and names the kind: subscription confirmation, welcome letter, transactional letter, automated notification or mailing. Only a mailing is held to the Gmail and Yahoo rules; the other kinds get "not applicable" and the reason. A message that carries List-Unsubscribe or List-Id is checked as before, whatever it says: the sender declared it list mail. Scoring version 1.7.0, tuned on 1,761 messages our long-lived mailboxes received; 500 of them gain a point.
The kind is shown on the message card as "Type" and in the API as message.kind. The documentation cards for List-Unsubscribe and one-click unsubscribe now say when the check does not apply.

Sep 25, 2026

DKIM checks now read each signature's algorithm. A message signed with both an RSA and an Ed25519 key, as RFC 8463 suggests, was told its key was too short: an Ed25519 key has no bit length, and the check read that as zero. The report now names each signature by type. A message signed only with Ed25519 gets a warning to add an RSA signature too, and an rsa-sha1 signature no longer counts, for DKIM or for DMARC, as RFC 8301 requires.

Sep 24, 2026

A DKIM key shorter than 2048 bits is now a warning instead of a pass. A 1024-bit key still verifies, so mail arrives, but a key that short can be cracked, and whoever cracks it can sign mail as you. The warning names the selector and costs no points, because 1024 is still the default at several sending platforms.

Sep 21, 2026

The free tier is now a written commitment. The first 100,000 reports stay unlimited, and after that 5 tests per IP address per day remain free for as long as the service runs. The terms say so, and the footer no longer calls the service "currently free".

Sep 19, 2026

Email scoring remains the default. Add Gmail delivery to check both with one recipient list and one report, or open the standalone Gmail test. Refreshed the Gmail dashboard with an inbox rate, folder breakdown and per-mailbox results.
Added an optional Gmail inbox placement test using public GMass seed inboxes. The start screen lets you choose between a technical email score and real folder placement. Gmail reports save observations for 30 days, distinguish Promotions from Spam, and never treat missing results as Spam.
Gmail testing explains public results before creating a test and uses a separate subject marker instead of exposing the report link. Instructions cover both campaign sends and quick To/CC checks.

Sep 18, 2026

A message with two DKIM signatures, one of which does not verify, is now a warning instead of a pass. Mail keeps arriving on the signature that works, so the broken key stays broken until the working one fails too. The warning names the selector to fix.

Sep 17, 2026

When the page can't get you a test address, it says so where the address would be and offers another try. It used to replace the whole page with an error about an analysis nobody had started.
On a phone the test address wraps onto a second line, so you can read what you are about to copy. It was cut off with an ellipsis.
A report has a button that copies its link. Reports get forwarded, and the address bar was the only way to pass one on.
RFC citations link straight to the quoted section, without a redirect in between, and the Google help links follow their pages to the Workspace help site.
/api leads to the API reference rather than a 404.
On a phone, the page with your test address offers to copy its own link, so you can open it on the computer you send from. The address stays reserved for an hour either way.
Under the address, a short note on where sending platforms keep their "send test" box, since a test sent from a mail app leaves out the headers the platform adds.
The documentation, the API reference and the agent skill said 39 checks while reports ran 41. The number now comes from the check registry, so the next check shows up on every page at once.

Sep 13, 2026

Dropped the three SORBS zones from the blocklist roster. SORBS shut down in 2024 and its zones answer "not listed" to everyone, which is not information. The infrastructure check now queries 21 lists.

Sep 4, 2026

The AI fix plan no longer times out and retries on a slow minute. The advisor has its own clock now, and a slow response costs you a wait rather than the plan.

Aug 24, 2026

DMARC report addresses are checked. The report warns when a rua or ruf address will never receive anything, and when a record lists more report addresses than a receiver owes you.
Citations point at the DMARC RFC that is in force, and a finding that outlived its rule was dropped.
Return paths that bulk senders actually use, the per-recipient bounce addresses, are no longer refused. The report shows them.

Aug 22, 2026

Reports are served in the language they are being read in, with translation on demand, and the report shows whole while the translation is on its way.
A written API reference in 31 languages replaced the generated Swagger page, with a sandbox next to it.
Backups three times a day, kept for five days, verified every week by restoring the newest one.
The agent page and SKILL.md in every language. The last English left on a translated report is gone: 99 interface labels translated, and every long dash taken out of them.
An SPF record's lookup cost is now counted as what the record costs, not what this one message paid.

Aug 21, 2026

Moved to a server of its own. No daily quota, and report links are permanent.
MCP server with four tools, so an agent can reserve an address, wait for the report and read it.
Every warning and failure carries the section of the standard it rests on, quoted, plus the Google page where one exists. 79 sources behind 36 of the checks.
The site and the report in 31 languages. Documentation for every check. The AI plan is written in the reader's language.
A logo, an icon set, a language switch that keeps your test, and the report page translated.

Aug 19, 2026

The AI plan moved under the score and the wait has something to watch: a stage and a count of seconds.
The AI verdict is a description now, not a headline. The headline is computed from the score.
An unaligned envelope no longer counts as a DMARC failure when DKIM is aligned.
The message as received: headers in wire order, both bodies, attachments, raw source.

Aug 17, 2026

MIME-encoded headers are decoded before their length is measured.
Test addresses match regardless of case, so a mangled address still finds its inbox.

Aug 15, 2026

The classic score is calibrated against what mail-tester.com actually charges for the same message. The side-by-side comparison that came out of it is in the repository.
The blocklist roster was audited against reality and three dead lists were dropped. One slow blocklist can no longer mark every report incomplete.
A retention worker, end-to-end pipeline tests, and a link fetcher hardened against requests to internal addresses.

Aug 14, 2026

Started. Scoring model, message parser, the authentication and infrastructure evaluators, the DNS and blocklist collectors, and inbound port 25 verified end to end.

Have an idea or found a bug?

Email Serhii Tanichev directly: hi@email-spam-tester.com. Every message is read by the person who wrote the code, and the fix usually ends up on this page.