/proof/sample with the send_id of any AUBOSmail message you received — anyone can verify, no AUBOSmail account required.Cryptographic verification
This page lets anyone verify the contents and timing of an email AUBOSmail sent — without trusting AUBOSmail. Five layers, each verifiable independently in your browser.
Layer 1 · Send identifiers
Layer 2 · WORM artifacts (Cloudflare R2 Object Lock, 365 days)
Each artifact is stored on R2 with Object Lock in COMPLIANCE mode. AUBOSmail itself cannot edit or delete these objects until the retention period expires. Sizes shown for context — the actual bytes are content-addressed by SHA-256.
Layer 3 · Daily Merkle root
Every send is a leaf in the daily Merkle tree. The root is signed Ed25519 by the AUBOSmail proof-roots key, published at /proof/roots/2026-04-30, and mirrored to GitHub.
Layer 4 · DKIM signature
The RFC 5322 message in Layer 2 is signed by Postal with the per-domain DKIM private key. Anyone can fetch the public key from DNS and verify the body hash matches the canonical content.
Layer 5 · Bitcoin anchor (OpenTimestamps)
The daily Merkle root is committed to Bitcoin via OpenTimestamps the morning after. Once anchored, the root cannot be backdated, even by AUBOSmail. Verifiable with any OpenTimestamps client and any Bitcoin block explorer.
You don't need an AUBOSmail account, an API key, or any AUBOSmail software to verify this send. The canonical JSON is on R2. The DKIM key is in DNS. The Merkle root is on GitHub. The Bitcoin anchor is in the public blockchain. AUBOSmail's only job is to publish the proof — the math is everyone else's.