Email security check
Can someone send mail as your domain? Enter a domain to see its DMARC, SPF, DKIM, MX and MTA-STS setup, and the records to fix it. Free, no account.
What the check looks at
The check reads the domain's public DNS records, the same ones every receiving mail server reads:
- DMARC tells receivers what to do with mail that claims to come from your domain but fails authentication. It decides the category at the top.
- SPF lists the servers allowed to send mail for the domain.
- DKIM publishes the keys your mail is signed with. The check searches the selectors that common providers use.
- MX names the servers that receive your mail. A domain without mail should say so with a null MX.
- MTA-STS and TLS-RPT make sure mail to you travels encrypted and that you hear about failures. They are optional.
The result describes the published records. Each receiving server makes its own decision about a given message. For the full technical report with every finding, use the domain health check.
Domains that do not use mail
A domain that never sends or receives mail can still be used in forged mail. Three records close that off: a null MX (MX 0 .), an SPF record that allows no server (v=spf1 -all) and a DMARC policy of reject (v=DMARC1; p=reject).
Frequently asked questions
What do Protected, Partial and Monitoring only mean?
The category comes from the DMARC policy a receiver applies to the domain (RFC 9989). Protected means reject: receivers are asked to refuse mail that fails DMARC. Partial means quarantine: failing mail is treated as suspicious, usually the spam folder, but still delivered. Monitoring only means none: receivers report failures but do not act. Unprotected means there is no DMARC record, and Broken means the record is not valid. With test mode (t=y) receivers apply one step less, so p=reject; t=y counts as quarantine.
Why is quarantine Partial and not Protected?
With quarantine a forged message is still delivered, only to the spam folder or with a warning, where people do find and open it. Only reject asks receivers to refuse it. That is why quarantine shows as "Spoofable: no, but not fully protected".
Why does it say DKIM was not found on common selectors?
A DKIM key is published under a name, the selector, that only the sender knows. The check tries a list of selectors that common mail providers use. If none of them has a key, your provider may still use another one, so the check never says DKIM is missing. Use the DKIM check with a selector you know.
Why is a subdomain checked as its main domain?
DMARC is set on the registered domain, and subdomains use its policy unless the sp= tag says otherwise. The check therefore looks at the registered domain, for example example.com when you enter mail.example.com, and the DMARC section shows the subdomain policy.
Is anything stored about the domains I check?
No. Results are kept in memory for ten minutes so a repeated check is answered from the same result, and are then gone. The domain is not logged, and your IP address is only used in memory for the rate limit. See the privacy policy.