Privacy policy
This policy describes what DNS Autopilot (dnsautopilot.com, operated by agntwrk) collects, why, how long it is kept, and how to have it removed. Last updated 2026-10-18.
What we collect
The email address and name of the Google account you sign in with. If you connect Gmail, only DMARC report emails: for each one, the sender, subject, date, authentication headers (Authentication-Results and ARC), and the report attachments. We never read other mail or any message text. We also store the report data itself (reporting organization, source IP addresses, message counts, SPF and DKIM results), the DNS records we look up for your domains, billing details held by Stripe, and standard server logs (IP address, user agent, request path). We do not sell personal data and do not use it for advertising.
How we use it
To show your reports and domain health, to send the alerts and weekly digest you enable, to bill paid plans, to secure the service, and to contact you about your account.
Google user data
Gmail access is read-only, requested only when you choose to connect a mailbox, and used only to find and read DMARC reports as described above. DNS Autopilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, we do not sell it, and no person reads it unless you ask us to or the law requires it.
Service providers
Google Cloud (hosting and storage in the United States), Stripe (payments; we never see your card number), and Resend (alert and digest emails, and the inbox behind your report address). Each processes data only to run the service.
DNS lookups and the free check
The free check and your dashboard look up public DNS records (DMARC, SPF, DKIM, MX, and the records for MTA-STS, TLS-RPT, DNSSEC, CAA, and blocklists) and reverse DNS of mail server and sending IP addresses. For the domain checked, we also contact its HTTPS server to read the certificate, its mta-sts host to read the policy file, the domain registry's RDAP service for the registration dates, and Google Public DNS over HTTPS to validate DNSSEC. These are public data about domains, not about you. A result is cached in memory for ten minutes. To limit checks to 20 an hour, a counter in our database stores only a hash of your IP address and the hour, not the address itself.
Retention and deletion
Parsed reports and their original attachments are kept for 25 months. Gmail message ids, used only to skip reports already imported, are kept for 60 days. Server logs are kept for 365 days. You can delete all of your data, and disconnect Gmail, from Settings at any time; deletion removes your reports, domains, connections, and tokens. You can also write to us and we delete your account, normally within 30 days.