# MailAlign

> Paste raw email headers and get From / Return-Path / Reply-To / DKIM d= alignment (relaxed and strict), the SPF, DKIM, DMARC and ARC verdicts recorded by receiving servers, the Received hop chain with per-hop delays and public IPs, and plain-English findings. Free paste tool, JSON API and a remote MCP server for AI agents. No network or DNS lookups; header text is never stored.

## For AI agents

- [MCP server](https://mailalign.mike-tusa.workers.dev/mcp): remote MCP over Streamable HTTP (POST only, stateless, JSON responses). Protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. Tool `analyze_headers` (headers: the raw header block; optional include_raw). Read-only. Client config (most MCP clients accept this; some use a different format, for example VS Code uses a `servers` key): `{"mcpServers":{"mailalign":{"type":"http","url":"https://mailalign.mike-tusa.workers.dev/mcp"}}}`
- [OpenAPI 3.1 spec](https://mailalign.mike-tusa.workers.dev/openapi.json): machine-readable description of the JSON API
- [MCP server card](https://mailalign.mike-tusa.workers.dev/.well-known/mcp/server-card.json): static description of the MCP server and its tool
- Works with AI agents and assistants that can call an MCP server or a JSON API, for example Muse, Claude, ChatGPT or Cursor (descriptive only). MailAlign is not affiliated with, endorsed by or sponsored by Meta, Google, Microsoft or any email provider.

## JSON API

- `POST https://mailalign.mike-tusa.workers.dev/api/analyze`: body `{"headers": "<raw email headers>"}` (application/json), or the raw header text itself (text/plain). Max 65536 bytes. Response: { verdict (pass|review|fail|unknown), summary { critical, warning, info, ok, hops, headers, verdictMeaning }, identities { from, returnPath, replyTo, subject, dkimSignatures[] }, authentication { authservId, spf, dkim[], dmarc, count }, arc { chainResult, instances, latestCv, sealers, results[], note }, hops [ { hop, from, by, with, ip, ipScope, timestamp, delaySeconds, tls } ] (oldest first), publicIps, totalDelaySeconds, findings [ { severity (critical|warning|info|ok), code, title, detail } ], meta }. Optional key: `Authorization: Bearer <key>` or `X-Api-Key: <key>`. Response headers: X-MailAlign-Tier (anonymous|free), X-MailAlign-Quota-Remaining. Errors: { "error": { "code", "message" } } with 400 invalid_input, 401 invalid_key, 503 unavailable (key check temporarily failed), 404 not_found, 405 method_not_allowed, 413 too_large, 429 rate_limited / daily_limit / monthly_limit / pool_exhausted.
- `POST https://mailalign.mike-tusa.workers.dev/api/keys` (no body, no sign-up, no email): returns 201 { key, plan: "free", monthlyLimit, note } once. Keys look like `ma_live_` + 32 hex. Only a SHA-256 hash of the key and a monthly counter are stored. About 3 new keys per hour per IP (best-effort, counted per server instance) and a global cap of about 200 new keys per day; 429 rate_limited / pool_exhausted, 503 unavailable when today's storage write budget is used.
- `GET https://mailalign.mike-tusa.workers.dev/api/health`: { ok, version, day }.
- Verdicts are read from what the receiving servers wrote in Authentication-Results / ARC headers; MailAlign does not re-verify signatures. Organizational-domain matching for relaxed alignment is an offline approximation.

## Limits, keys and pricing

- Anonymous (no key): about 30 checks/min per IP and a shared pool of about 5000 checks per UTC day.
- Free key: about 100 analyses per key per UTC calendar month, about 30/min per key, not charged to the anonymous pool. All free keys together share a pool of about 20000 analyses per UTC day (429 pool_exhausted), and about 200 new keys can be issued per day in total. No paid tier.
- Counts are approximate: counters are batched per server instance before being saved, so a key can occasionally get a few more than 100 in a month and the daily pools can run slightly over.
- The MCP endpoint uses the same keys and counters: each `tools/call` is one check. Non-check MCP messages don't count as checks, but are capped at about 120/min per IP (HTTP 429 + Retry-After).
- Header text you submit is analyzed in memory and discarded when the response is sent. It is never written to storage, logs or analytics, and MailAlign makes no network or DNS lookups.

## Optional

- [Privacy](https://mailalign.mike-tusa.workers.dev/privacy)
- [Terms](https://mailalign.mike-tusa.workers.dev/terms)
- Contact: digitalpromohub.support@gmail.com