Privacy Policy

HeaderCheck (“the App”) is a privacy-first iOS and iPadOS application that analyzes email authentication headers (SPF, DKIM, and DMARC) entirely on your device from pasted text or an .eml file.

Summary

Analysis stays on your device. HeaderCheck does not require an account, does not sign you in, and does not upload headers, message content, or identifiers to a server operated by the developer. There are no analytics or tracking SDKs in the App.

Information the App processes

When you paste headers or open an .eml file, the App processes that content locally to show authentication verdicts, alignment hints, and cautious heuristic flags. That content is not transmitted to the developer for analysis.

Reputation hints (on-device)

With HeaderCheck Pro, the App can show warn-only reputation hints next to authentication results. By default these use only data already on your device: the From domain is compared against bundled disposable-email and freemail domain lists, and public relay IP addresses are read from the Received headers you provided. No network access is used for these checks.

Optional live DNS lookups (off by default)

With HeaderCheck Pro, you can turn on “Live DNS lookups” in Settings. This option is off until you enable it, and you can turn it off at any time. When it is off, or without Pro, the App makes no reputation-related DNS queries.

When it is on and you view a result, the App sends ordinary DNS queries through your device’s configured DNS resolver (for example your network or VPN provider’s resolver):

• For up to four public relay IPv4 addresses from the Received headers, a block-list lookup in the reversed-address form (for example 4.3.2.1.bl.spamcop.net) against the SpamCop Blocking List (bl.spamcop.net) and the Passive Spam Block List (psbl.surriel.com). Spamhaus public mirrors are not used. IPv6 addresses are not sent.
• For the From domain: TXT lookups for its SPF record and its DMARC record (_dmarc. plus the domain), and an MX lookup.

These queries necessarily reveal the looked-up IP addresses and domain names to your DNS resolver and to the operators of those DNS zones, as with any DNS lookup. Headers, message content, subjects, and email addresses are never uploaded, and nothing is sent to a server operated by the developer. Results are shown as hints only; timeouts or unexpected answers are treated as unknown.

The developer does not run these DNS services and does not receive the queries or their answers. SpamCop and PSBL are operated by third parties under their own policies. Lookups happen only on your device, and their results are only shown on screen (and in a summary or PDF you choose to copy or export).

Information stored on your device

If you save analyses to History (subject to free limits, or unlimited with Pro), they are stored locally on your device using Apple’s on-device storage (SwiftData). Deleting the App removes that local data, subject to any backups you manage yourself (for example iCloud device backups controlled by Apple and your settings).

Purchases

Optional HeaderCheck Pro is a one-time In-App Purchase processed by Apple through StoreKit. Payment card details are handled by Apple; the developer does not receive your payment card information. Apple’s privacy practices apply to the App Store and purchase processing.

No developer-operated tracking

The App does not include third-party analytics, advertising, or crash reporting SDKs that send usage data to the developer. Network access is not required for core analysis; the only optional network use is the live DNS lookups described above, which you must turn on.

Disclaimer

HeaderCheck reports authentication results found in the headers you provide. It does not guarantee that a message is safe or malicious, and it is not legal or forensic advice.

Contact

Privacy questions about HeaderCheck: [email protected].

Changes

If this policy changes, the updated text will be posted at this URL with a revised effective date.

Home · Support