I tested my browser-based email checkers against dkimpy, checkdmarc and pyspf: 12,618 results, 76 disagreements

I built five email security tools for Toggle9 that run in the browser: a DKIM checker, a DMARC checker, an SPF checker, an MX lookup and an email header analyzer. There's no backend. DNS queries go from your browser to Cloudflare's public resolver, and DKIM signatures are verified with WebCrypto. That raises an obvious question: why would anyone trust a JavaScript reimplementation of RFC 6376? There are established open-source libraries for all of this: dkimpy for DKIM, checkdmarc for DMARC and