Skip to content

Free tools

About our checker

37 Digital’s free tools check websites and email set-up when someone asks them to. They’re run by 37 Digital Limited. This page explains what they look at, how often they run, and how to contact us about a check.

Who makes the checkers

The checkers are designed, built and maintained by 37 Digital, a web studio in London founded by Dan Tulloch in 2020. Their rules follow the published standards – RFC 7208 for SPF, RFC 6376 for DKIM, RFC 9989 for DMARC, WCAG 2.2 for alt text and the Open Graph protocol for share previews – and we review them whenever a standard or a platform’s rules change. Last reviewed .

The email security checker

The email security checker reads a domain’s public DNS records. If you enter an email address, it uses only the part after the @.

  • It looks up the domain’s mail servers (MX), its SPF and DMARC records, and DKIM keys under the names that common email services use. It also follows the records those point to, such as the SPF records of services your SPF includes.
  • The lookups go through Cloudflare’s public DNS service, the same way any computer looks up a domain.
  • It never connects to your website or your mail servers, and it doesn’t send any email.

DNS records are public by design, and anyone can look them up with free tools, so there’s no opt-out list for the email checker. If you’re concerned about checks of your domain, email us and we’ll talk it through.

The image alt text and link preview checkers

These – the image alt text checker and the link preview checker – read one web page, the address someone enters, to check its images or its title, description and share tags.

  • Each check fetches that one page’s HTML, following up to 5 redirects, within 8 seconds and up to 2 MB. It doesn’t follow links, run JavaScript, send cookies or download images, styles or scripts.
  • The link preview checker shows the page’s share image by loading it in the visitor’s own browser, not from our server.
  • Only public websites on the normal web ports can be checked. Addresses on private networks are refused.

How to recognise our checker

Requests come from Cloudflare’s network and identify themselves with this user agent:

Mozilla/5.0 (compatible; 37DigitalTools/1.0; +https://www.37digital.com/tools/about-our-checker)

Cloudflare also adds a CF-Worker header naming 37digital.com to every request, so the source can’t be hidden.

We don’t read robots.txt. Robots rules are written for crawlers that work through a site on their own, and our checker never does that: each check is one page that a person asked us to look at, and we never follow its links or crawl the rest of the site. Google’s own user-triggered fetchers, such as Google Site Verifier and Google Read Aloud, work the same way: because a person asked for the fetch, they generally ignore robots.txt.

Stopping or allowing our checker

  • Ask us to stop: email hello@37digital.com and we’ll add your domain to our opt-out list. It covers the domain and its subdomains, takes effect at once and is checked on every redirect.
  • Block it yourself on Cloudflare: in Security › Security rules, choose Create rule › Custom rules. Select Edit expression, enter cf.worker.upstream_zone eq "37digital.com", choose the action Block and deploy the rule.
  • Let it in on Cloudflare: create a rule with the same expression and the action Skip, and in its skip options tick Browser Integrity Check and, on Pro plans and above, All Super Bot Fight Mode rules. Bot Fight Mode on Cloudflare’s free plan can’t be skipped by any rule, so if it’s on, paste your page’s HTML into the tool instead.

Pasted HTML is checked in memory and never stored or logged. If you give the page’s address too, we never fetch it: we use that address to make sense of the page’s links, and log only its domain with the check, as we do for every check.

How often checks run

Only when someone asks. Each check is one person pressing the button: there’s no crawling, no scheduled re-checks of other people’s domains and no list of domains to work through. The only exception is our own domain, which we check every hour to make sure the tool is working.

To keep the tools fair and stop them being misused:

  • Each connection can run 20 email checks a day, at least 10 seconds apart.
  • Each connection can run 15 checks a day with each page checker.
  • Any one website – all its addresses counted together – can be fetched at most 20 times in each hour, across all visitors.
  • There’s a daily limit on checks across all visitors.
  • Cloudflare Turnstile checks that a person, not a script, is asking. Most people never see it, but it sometimes asks you to tick a box.

What we keep

We don’t keep your results. For 7 days we keep a log of each check: the tool, the domain checked, the outcome, how long it took and a code for your connection that changes every day. We never store your IP address. The counts behind the daily limits are deleted after 48 hours. Our privacy policy has the details.

Guidance, not an audit

The checks are automated, so treat the results as guidance rather than a full audit. They can only see what’s public: a DKIM key under an unusual name won’t be found, and a record you’ve just changed may still show its old value for a while.

Questions and complaints

If a result looks wrong, you have a question about a check, or you want to complain, email hello@37digital.com. We reply within one working day, or within 24 hours if Cloudflare passed your complaint on to us.