Email security check

What this tool checks

Enter a domain (or an email address; the part after the @ is used) and the tool reads its public DNS records. It looks at:

• MX: mail servers, or a null MX (MX 0 .) saying the domain accepts no mail.
• SPF (RFC 7208): the v=spf1 TXT record. It checks there is exactly one, how it ends (-all, ~all, ?all, +all or nothing), whether it uses the deprecated ptr mechanism, and how many DNS lookups it needs, following every include: and redirect=.
• DMARC (RFC 7489): the v=DMARC1 record at _dmarc.example.com, its p= policy, pct= and report address (rua=).
• DKIM: keys live at selector._domainkey.example.com, and the selector can be any name. The tool tries selectors used by common providers (such as google, selector1, selector2, default, k1). If a random selector also answers, the domain has a wildcard record and selectors cannot be tested from outside.
• MTA-STS (RFC 8461): the v=STSv1 record at _mta-sts.example.com, then the policy file at https://mta-sts.example.com/.well-known/mta-sts.txt and its mode.
• TLS-RPT (RFC 8460): the v=TLSRPTv1 record at _smtp._tls.example.com.
• BIMI: a v=BIMI1 record at default._bimi.example.com, reported only when present.

What it can't see: whether your mail actually passes SPF and DKIM. That only shows in the Authentication-Results header of a real message. For a subdomain without a DMARC record of its own, it walks up to the parent domain the way receivers do and tells you whose policy applies.

Reading the results

Each finding is marked pass, info, warning or fail, and problems come with a fix and, where useful, a ready-to-copy record for your domain. The Published records table shows the raw records the verdicts are based on: MX, SPF, DMARC, the DKIM selectors found, the MTA-STS mode and any BIMI record.

Common problems and fixes

No SPF record, or more than one

Publish exactly one v=spf1 TXT record listing every service that sends as your domain; two records are a permanent error. A domain that never sends mail should say so:

example.com. TXT "v=spf1 -all"

SPF needs more than 10 DNS lookups

Each include: counts, plus every lookup inside it. Remove includes for services you no longer use, or replace some with the ip4:/ip6: ranges they cover (those ranges can change, so review them). Replace ptr too.

example.com. TXT "v=spf1 ip4:192.0.2.0/24 include:_spf.example.net -all"

DMARC missing or stuck on p=none

Start with p=none and a report address, read the reports until all legitimate mail passes, then move to quarantine and reject. The tool suggests:

_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com; adkim=r; aspf=r"

A pct= below 100 applies the policy to only that share of failing mail.

MTA-STS record but the policy file won't load

The file must be served over HTTPS with a valid certificate for mta-sts.example.com; check it with the SSL/TLS certificate check. A minimal policy:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400

Move to mode: enforce once TLS-RPT reports are clean, and change the TXT record's id= whenever the policy changes.

No TLS-RPT

Add a reporting address for TLS failures on your inbound mail:

_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

If mail still lands in spam, run a blacklist check on your sending IP.

FAQ