We don't want your address book.
Logging every address sent to a lookup tool would turn it into a honeypot. The useful signal is which domains people check and whether resolution works — not who they are.
The lookup runs in your browser
The playground asks Cloudflare's DNS-over-HTTPS resolver for MX records and reads the Thunderbird ISPDB. The email address is parsed on your device; only the domain is used in those requests.
The fallback sends the domain only
If your network blocks DNS-over-HTTPS, the browser calls our API with the domain. It does not send the local part, and we put the original username back on your device after the response.
Counters are aggregate
If Upstash is configured, we count lookups, unique domains, providers, outcomes, latency and pageviews. The stored key is the domain — never the full address and never the local part.
No cookies
The site sets no cookies. Vercel Analytics is cookieless. There is no login, no tracking pixel and no advertising script.
Rate limiting is ephemeral
The API keeps a short-lived in-memory counter per IP to enforce 60 requests per minute. It is not written to a database and disappears with the instance.
The public API is explicit
If you call /api/lookup with a full address, that address is part of the request URL. Use ?domain= if you want to keep the local part out of the URL. Our application code still records only the domain.
The resolver is open source. If you spot a gap between this page and the code, the docs explain the resolver, and the repo is one issue away.