Methodology

What we collect

Every record starts as an unsolicited commercial email received at a mailbox we control. We keep the message headers, the visible body, the sending domain, and the results our mail server recorded when it accepted the message. We do not go looking for mail; we only publish what was sent to us.

We also look up public facts about the sending domain at the time we receive the message: when it was registered, whether it has a website, and whether its mail authentication records exist. Those checks use public DNS and WHOIS data and nothing else.

What we publish, and what we never publish

We publish the sending domain, the subject line, the pitch as it appeared, the authentication results, the domain facts above, our label, and a short explanation of how the message got through. Where the body names a person, a phone number, a street address, or a company that is plausibly the victim rather than the sender, we redact it.

We never publish the recipient address, the recipient's name, attachments, tracking links, or the raw headers. We do not publish messages that appear to be personal correspondence, even if they are unwelcome.

How labels are decided

Labels are suggested by a small set of explainable rules. A domain registered in the last 30 days that sends a sales pitch is suggested as a lookalike or throwaway. A message sent through a legitimate business's mail server with that business's name nowhere in the pitch is suggested as a compromised mailbox. A message sent from a hosting provider's shared IP with a website form's signature is suggested as an abused form.

A person reviews every record before it is published, reads the suggestion and the evidence, and either confirms it, changes it, or holds the record back. No record goes live from a rule alone.

What “likely” means

When we say a mailbox was likely compromised, we mean the evidence points that way but we could not confirm it with the domain owner. When we are confident, we say so without the qualifier. When the evidence is thin, we do not publish.

Authentication results are captured when the message arrives

SPF, DKIM, and DMARC results are recorded by our mail server at the moment it accepts the message. We publish those results as they were. A domain owner who later fixes their records will not see the published result change, because it describes what happened at the time, not what is true today. The record page shows the receipt time for that reason.

Corrections, annotations, and removals

If a record is wrong, we correct it and mark the correction. If a domain owner shows us the underlying problem is fixed, we add a note saying so, and in most cases remove the record. The full process, including how we verify that someone controls a domain, is in the removal policy. Requests start on the removal page.