InbxGuard – Email Deliverability, SPF, DKIM, DMARC Checker & Email Logs

InbxGuard helps administrators investigate WordPress email configuration. It works with or without WooCommerce and loads its dashboard assets only on its own administration page.

An accepted mail attempt is not a confirmed inbox delivery. The plugin does not measure inbox placement and does not promise that an email reaches a recipient.

Free features

• Guided setup with provider, exact DKIM selector/CNAME, DNS host and actual sending-IP inputs.
• SPF static analysis, nested includes/redirects, loop and lookup-budget warnings, split TXT records and unsafe qualifiers. This is configuration analysis, not a full SMTP-session SPF evaluator.
• DMARC exact-tag validation for policy, subdomain policy, percentage, alignment and reporting addresses. Organizational-domain discovery uses a bundled Public Suffix List.
• Configured DKIM TXT/CNAME inspection. Unknown selectors are inconclusive; account-specific selectors are never invented.
• Background audit steps, progress reporting and cached results. DNS errors remain unknown instead of becoming missing-record failures.
• Email attempt metadata, failure visibility, filtered logs and batched CSV export with spreadsheet formula protection.
• Independent log retention, defaulting to 30 days on new installations. Scheduled cleanup requires regularly functioning WordPress cron.
• Failure admin notice, dashboard widget, cached Site Health checks and wp inbxguard audit --format=json for WP-CLI installations.
• Optional plain-text alternatives for HTML messages sent through compatible PHPMailer transports.
• Destination-specific SMTP TCP probes and optional PSBL reputation checks for an explicitly configured public sending IPv4. The web server IP is not substituted for a mail provider IP.
• WooCommerce template configuration observations and a safe preview-lint integration hook. Without a rendered preview, content remains unverified.
• WordPress personal-data exporter and eraser integration, available without a paid license.

Premium edition

Premium code is distributed outside WordPress.org through Freemius. Install the premium build to use paid features or a trial; the free build does not contain locked premium implementations.

• Explicitly enabled, encrypted message-content capture with sensitive-message exclusion and supplementary token redaction.
• Resend of eligible intact messages only. Excluded, redacted, expired, unavailable or attachment-dependent messages cannot be reconstructed or resent.
• Scheduled audit monitoring with threshold, deduplication, failed-notification retry and recovery handling.
• Email, Slack/Discord webhook and optional Twilio SMS monitoring notifications. Email alerts depend on the configured mailer.
• Print-ready audit reports that can be saved as PDF in a browser; Agency entitlements enable report branding.

Backup transports, retry queues, provider delivery-event webhooks, DNS publishing, DMARC aggregate ingestion, external reputation APIs and a cross-site agency hub are not shipped in this release.

Privacy and security

Free logs store metadata, not message bodies, headers or visitor IP addresses. Subjects of recognized authentication/reset messages are replaced with a generic label. Third-party message formats cannot all be recognized, so avoid putting secrets in subjects and configure additional exclusions where necessary.

Content logging is off by default. Premium content capture normally derives an installation-specific encryption key from strong WordPress authentication secrets in wp-config.php. Back up that file securely: changing its secrets, installation path, database name or table prefix requires re-encrypting retained data first. Advanced deployments may instead configure WPEDA_ENCRYPTION_KEY as a base64-encoded random 32-byte key. Keep a separate backup of external keys. WPEDA_ENCRYPTION_KEYS can retain older named keys during rotation. Missing or incorrect keys make the corresponding content unavailable; there is no plaintext fallback.

Legacy plaintext bodies, headers and IPs are blocked from viewing/resend immediately and removed in bounded maintenance batches. Legacy local timestamps are converted using the site timezone recorded during upgrade; historical timezone changes cannot be reconstructed exactly. Keep a database backup before upgrading.

Uninstall deletes plugin data by default for new installations. An explicit retention preference can preserve historical logs, but stored service credentials and settings are always removed. Deactivation stops scheduled plugin events.

External services

• Cloudflare DNS over HTTPS: The hosting resolver is used first. Only after enabling optional fallback permission in Setup and a local resolver error, domain and selector queries are sent to https://cloudflare-dns.com/dns-query. Requests use bounded timeouts. No message bodies or recipients are sent. Privacy | Terms.
• PSBL: An additional opt-in checks the actual configured sending IPv4 against psbl.surriel.com through the DNS resolver. This discloses that IP. IPv6, private addresses, resolver failures and unsupported response codes are not treated as clean listings. Service information and policy.
• Freemius: The bundled SDK provides optional account connection, licensing, trials, premium updates and purchase screens. Its SDK connection screen describes the information shared when connecting. Free diagnostics do not require an account. Privacy | Terms.
• Configured webhooks (premium): Monitoring messages containing site name and score are sent only to the administrator-configured HTTPS endpoint. Discord and Slack use their respective payload formats. Review the destination service’s privacy policy.
• Twilio (premium, optional): With explicitly configured credentials and phone numbers, monitoring notifications are sent through https://api.twilio.com. This shares the destination/source numbers and monitoring message. Stored tokens require encryption and are never echoed into settings fields. Privacy | Terms.

Postmaster links are reference links opened by the administrator; they do not connect accounts or import API data.

Included third-party resources

• Freemius WordPress SDK 2.13.4, GPL-compatible distribution. Source and notices.
• Chart.js 4.4.2, MIT. The bundled browser file is in assets/vendor/chartjs. Unminified source and build instructions.
• Mozilla Public Suffix List snapshot, MPL-2.0. The list retains its upstream notices in resources/public-suffix-list.dat. Source and license information.