About Patchkit

Who makes Patchkit

Patchkit is built by Ahmet Karaca at Akaya Labs, an independent software studio. Ahmet Karaca designs and writes the product: the DNS checkers, the pipeline that reads DMARC reports, the dashboard and the articles on this site, which are published under that name. Patchkit is a small, independent product, and questions sent to the support address are read by the person who builds it.

Why it exists

Email authentication used to be optional housekeeping. That changed when Google and Yahoo began requiring SPF, DKIM and DMARC from bulk senders in February 2024, and Microsoft followed for Outlook.com in May 2025. The details are in our comparison of the Gmail, Yahoo and Outlook sender requirements. Today a missing or broken record can send your invoices and password resets to spam.

Two things make this harder than it should be. First, most checkers stop at "something is wrong". Knowing that your SPF record exceeds ten DNS lookups does not tell you which line to change at your DNS host. Patchkit tries to answer with the exact record to publish and where to paste it. Second, the safe path to a strict DMARC policy (p=reject) depends on knowing every service that sends mail as your domain. The only reliable source for that is DMARC aggregate reports, which arrive as compressed XML attachments that few people can read by hand. Patchkit reads them for you and turns them into a list of senders and a plan.

How it works

The free tools

The DMARC checker, SPF checker, DKIM checker and MX lookup run live DNS queries for the domain you enter, and the domain health check runs all four at once and scores the result. None of them needs an account. Each finding comes with an explanation and, where there is one, the record that fixes it. The SPF record generator and DMARC record generator build a new record or upgrade an existing one, and the setup guides show the steps for common senders and DNS hosts. If you want the background first, the SPF, DKIM and DMARC articles explain each standard in plain language.

Report monitoring

When you add a domain in the dashboard, Patchkit gives it its own report address on patchkit.email. You add that address to the rua tag of your DMARC record; the setup screen shows your current record with the address added, keeping any report addresses you already have. From then on, mailbox providers that send DMARC reports mail a summary of the traffic they saw from your domain to that address, usually once a day.

Each report is parsed into rows: the sending IP address, how many messages it sent, the domains it used and whether SPF and DKIM passed and aligned. Patchkit then works out who each sender is. It first matches the DKIM signing domain against a catalog of known email services, and if that fails it looks up the reverse DNS name of the sending IP. Senders end up grouped as authorized, misconfigured, forwarders or unknown, so you can see which services need a fix and which traffic is not yours.

Everything else follows from that list. The dashboard tracks your current DMARC policy and shows when your legitimate mail passes reliably enough to move to the next stage, from p=none through p=quarantine to p=reject, together with the record for that step. Alerts tell you when a DNS record is removed or changed, when SPF goes over its lookup limit, when a new unknown sender appears, when alignment drops or when reports stop arriving, and a weekly summary email recaps the week. How far back the dashboard looks depends on your plan:

• Free: the last 14 days of reports in the dashboard
• Starter: the last 90 days of reports in the dashboard
• Pro: the last 365 days of reports in the dashboard
• Agency: the last 365 days of reports in the dashboard

The details of each plan, including how many domains it covers and which alerts arrive by email, are on the DMARC monitoring pricing page. If you are weighing options, see how Patchkit compares with other DMARC tools.

Your data

Aggregate reports describe mail sent using your domain: IP addresses, message counts, domains and authentication results. They contain no message content and no recipient addresses. Patchkit only reads aggregate reports; it does not ask for or process DMARC failure reports. Here is what happens to the data, in short:

• Report emails are received by Cloudflare and the raw messages are stored in Cloudflare R2. They are deleted 30 days after they arrive. A report that could not be processed is kept until it is fixed and processed again, then deleted the same way.
• Mail sent to a report address that does not belong to any domain is deleted after 7 days.
• Processed report data is stored for 365 days, whatever your plan; the plan decides how much of that history the dashboard shows. Resolved alerts are deleted once they are older than your plan's history; open alerts stay until they are resolved.
• For the free tools, results are cached in server memory for a few minutes and are not written to the database. Your IP address is used only to apply a rate limit.
• For your account, Patchkit stores your name, your email address and a bcrypt hash of your password, never the password itself.
• Patchkit never changes your DNS. It reads public records and shows you what to publish; you make every change at your DNS host yourself, so nothing changes without you.

The API and its PostgreSQL database run on Railway, the website runs on Vercel, account and alert emails are sent through Resend, Lemon Squeezy handles billing as the merchant of record, and Sentry receives error reports, with personal data turned off on the API side. Google Analytics loads only after you accept the cookie banner.

You stay in control of your data. Under account settings, "Download my data" gives you a JSON file with your profile, workspace, domains, senders, daily statistics and the reports your dashboard shows. Removing a domain deletes its processed report data right away (the raw report emails follow the 30-day rule above), and deleting your account removes your user record and every workspace you are the only owner of. It is a permanent deletion, not a grace period. The full details, including your rights under GDPR and KVKK, are in our privacy policy, and the rules for using the service are in the terms of service.

Contact

For questions about your account, a report that looks wrong, a missing DNS host in the guides or anything else, write to support@patchkit.app. Bug reports with the domain and what you expected to see are especially welcome.