← Check catalogue
MSG-AUTHDeterministic
Bulk email authenticates and unsubscribes correctly
What the source requires
SPF, DKIM and DMARC alignment, plus a one-click unsubscribe whose headers are covered by the DKIM signature.
Why this is hard to satisfy
DNS configuration is beyond practice staff, and almost nobody checks the signature-coverage condition — so mail silently stops arriving.
What we do about it
DNS and header checks. Pure lookups, no judgement involved.
In build · phase one
What this tier means
Same input, same verdict, every time — no model in the loop. This is the only tier where the word “verified” is literally true.