Email intelligence
An email address tells you about a domain long before it tells you about a person. This module examines the mail infrastructure behind the address, how the domain authenticates its mail, and which public exposure signals exist, without ever touching credentials or breach contents.
Example: security@example.com
What this module collects
- Normalised address and its domain
- Mail platform identified from MX records
- Free consumer, business or disposable provider classification
- SPF policy, including multiple-record misconfiguration
- DMARC policy and reporting addresses
- DKIM selectors discoverable from a documented list
- MTA-STS policy where published
- DNSSEC status of the mail domain
- Full DNS record set for the domain
- Domain registration data via RDAP
- Certificate transparency records for the domain
- Gravatar public avatar presence
- Breach exposure metadata where an API key is configured
What this module will not do
These limits are deliberate. Each one is a place where a tool could produce a confident-looking answer that is not supported by public evidence.
No passwords, tokens, cookies or breach contents
Breach checks return only the name, date and categories of data involved. Credential material is never retrieved, displayed or stored, under any configuration.
No mailbox existence probing
SMTP verification is unreliable against modern mail servers, which accept-then-bounce, and it generates unsolicited traffic to a third party's infrastructure. Deliverability is assessed from published MX records instead.
No identity assertion from the local part
A handle derived from the part before the @ is offered as a lead marked 'possible'. It is never treated as evidence that a person holds accounts under that name.