# What DNS Autopilot reads in Gmail

DNS Autopilot asks for read-only Gmail access (`https://www.googleapis.com/auth/gmail.readonly`) only when you choose Connect Gmail. Gmail's permissions cannot be narrower than that, so the limit is enforced in code and described here.

## What is searched

One fixed search, which also looks in Spam and Trash because reports are often filed there:

```
has:attachment {subject:"report domain" subject:dmarc} {filename:gz filename:zip filename:xml} after:<date>
```

Nothing else is ever searched.

## What is read

For each matching message: the sender, subject, date, and authentication headers (Authentication-Results and ARC), and the attachments ending in .xml, .gz, or .zip up to 10 MB. These headers let DNS Autopilot check that the report really came from the provider it names, including when a Google Group forwards it. Message bodies and other headers are not requested, read, or stored. Attachments that are not DMARC reports are discarded.

## What is stored

The parsed report (reporting organization, source IP addresses, message counts, SPF and DKIM results) and the original attachment, for 25 months. The Gmail message id is kept for 60 days so a report is never imported twice.

## Limited Use

DNS Autopilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

Gmail data is used only to show you your reports. It is not used for advertising, not sold, and not read by people unless you ask or the law requires it.

## Disconnect

Open Settings, then Gmail connections, and choose Disconnect. The token is deleted and the sync stops at once. You can also remove access at https://myaccount.google.com/permissions. Settings also deletes all stored data.

## For Google Workspace administrators

If your organization limits third-party apps, mark DNS Autopilot as trusted in the Admin console under Security, then Access and data control, then API controls, then App access control: choose Configure new app, search for DNS Autopilot, and set it to Trusted. Until Google verifies the app, an unverified-app screen appears for personal accounts.

Privacy policy: https://dnsautopilot.com/privacy