# IncogSay — Zero-Trust Link & Email Authentication Diagnostic Engine
> Free, privacy-first cybersecurity diagnostic platform for real-time URL threat detection, multi-hop redirect chain expansion, and email authentication auditing (SPF, DKIM, DMARC, BIMI, SSL/TLS). 100% edge-evaluated in user browser / Cloudflare Worker; zero data retention.

## Core Capabilities & Services
- **URL Phishing & Threat Scanner**: Real-time evaluation of URLs using Shannon entropy ($H(X) = -\sum P(x)\log_2 P(x)$), typosquatting brand mimicry (Levenshtein distance $\le 2$), IDN homograph detection (Cyrillic lookalikes), subdomain stacking, and live threat feed telemetry.
- **Redirect Chain Tracer**: Multi-hop HTTP redirection unpacker tracing up to 15 hops (301 Moved Permanently, 302 Found, 303 See Other, 307 Temporary Redirect, 308 Permanent Redirect, and HTML meta refresh) with redirect loop detection.
- **SPF Record Validator**: RFC 7208 compliance parser, syntax mechanism analyzer, and 10-lookup quota calculator.
- **DKIM Key Inspector**: Cryptographic key decoder supporting 1024/2048/4096-bit RSA and Ed25519 public keys with automated selector discovery.
- **DMARC Policy Enforcement Checker**: RFC 7489 policy alignment analyzer (`p=reject`, `p=quarantine`, `p=none`, `sp`, `pct`, `rua`, `ruf`, `aspf`, `adkim`).
- **SSL / TLS Certificate Handshake Inspector**: Edge-evaluated TLS 1.3 socket inspector reporting CA issuer, SAN list, cipher suites, validity period, and expiration countdown.
- **Domain Age & RDAP Lookup**: ICANN registration date, expiration date, and domain longevity risk scoring.
- **BIMI Brand Indicator Checker**: Brand indicator SVG Tiny P/S validator and Verified Mark Certificate (VMC) checker.
- **Email Header Analyzer**: RFC 5322 raw header relay tracer with hop delay calculations and authentication verification.
- **Email Security Posture Radar**: Comprehensive 0-100 score and letter grade (A+ to F) evaluating domain anti-spoofing posture.

## Direct Tool Endpoints
- Homepage & Hero Console: https://incogsay.com/
- Comprehensive Tool Index: https://incogsay.com/tools
- URL Threat Scanner: https://incogsay.com/tools/url-scanner
- Safe Link Checker: https://incogsay.com/tools/safe-link-checker
- Redirect Checker & Hop Tracer: https://incogsay.com/tools/redirect-checker
- Domain Age & RDAP Lookup: https://incogsay.com/tools/domain-age-checker
- SSL / TLS Certificate Checker: https://incogsay.com/tools/ssl-checker
- SPF Record Checker & Syntax Validator: https://incogsay.com/tools/spf-checker
- SPF Record Generator: https://incogsay.com/tools/spf-generator
- DKIM Key Lookup & Inspector: https://incogsay.com/tools/dkim-checker
- DKIM Record Generator: https://incogsay.com/tools/dkim-generator
- DMARC Policy Enforcer: https://incogsay.com/tools/dmarc-checker
- DMARC Record Generator: https://incogsay.com/tools/dmarc-generator
- BIMI Brand Indicator Checker: https://incogsay.com/tools/bimi-checker
- BIMI Record Generator: https://incogsay.com/tools/bimi-generator
- Email Header Analyzer: https://incogsay.com/tools/email-header-analyzer
- Email Security Posture Score: https://incogsay.com/tools/email-security-score
- MTA-STS Policy Generator: https://incogsay.com/tools/mta-sts-generator
- QR Code URL Scanner & Quishing Defense: https://incogsay.com/tools/qr-url-scanner
- Password Entropy Checker: https://incogsay.com/tools/password-entropy-checker

## Programmatic Guides (pSEO)
- Provider SPF & DKIM Setup: https://incogsay.com/tools/spf/[provider-slug] (Supports Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES, HubSpot, Zoho Mail, Brevo, Postmark, Klaviyo, Salesforce, Shopify, Mailgun, ActiveCampaign, Proton Mail, Resend, Fastmail, Constant Contact, Campaign Monitor, Zendesk)
- URL Shortener & Redirect Expansion: https://incogsay.com/tools/redirect/[service-slug] (Supports Bitly, TinyURL, t.co, Linktree, is.gd, Cutt.ly, Rebrandly, Dub.co, Short.io, Ow.ly)
- Enterprise Domain Trust Reports: https://incogsay.com/tools/security-check/[domain-slug] (Supports Google, Microsoft, PayPal, Apple, Netflix, Amazon, GitHub, Stripe, Shopify, Cloudflare, Chase, Discord)

## Standards & Protocol Compliance
- **RFC 7208**: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email
- **RFC 6376**: DomainKeys Identified Mail (DKIM) Signatures
- **RFC 7489**: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- **RFC 8446**: The Transport Layer Security (TLS) Protocol Version 1.3
- **RFC 8461**: SMTP MTA Strict Transport Security (MTA-STS)
- **BIMI Standard**: Brand Indicators for Message Identification (AuthIndicators Working Group)

## API & Edge Endpoints
- Threat Scanner API: `GET https://incogsay.com/api/scan?url={targetUrl}`
- Forensic HTML Sandbox: `GET https://incogsay.com/api/preview?url={targetUrl}`
- Real Redirect Tracer: `GET https://incogsay.com/api/redirect-trace?url={targetUrl}`
- Live SSL Inspector: `GET https://incogsay.com/api/ssl-check?domain={domain}`
- RDAP Domain Age: `GET https://incogsay.com/api/domain-age?domain={domain}`

## Data & Privacy Governance
- 100% Stateless Edge Evaluation: No query logs, no IP tracking, no database storage.
- Sitemap: https://incogsay.com/sitemap.xml
- Robots: https://incogsay.com/robots.txt
- Documentation: https://incogsay.com/documentation
- Contact: https://incogsay.com/contact