Email Security Checker
Check SPF, DKIM and DMARC records to validate email authentication, plus MTA-STS and TLS-RPT for encrypted delivery.
How to check SPF, DKIM and DMARC
- Type the domain that appears after the @ in your addresses, without
https://, for exampleexample.com. - Press Check Email Security. The lookups run on this server against public DNS; there is no signup and nothing is stored.
- Read the score out of 100, then open each section for the record found, its issues and the recommended fix.
- After changing DNS, wait for the record's TTL to expire and run the check again.
What the result means
The score adds up four parts: SPF (30 points), DMARC (35), DKIM (25) and MX (10). DMARC only gets full marks with p=reject.
- SPF lists the servers allowed to send for the domain. A healthy record ends in
-allor~all, for examplev=spf1 include:_spf.google.com -all. The checker flags+alland?all, a missingall, more than one SPF record (receivers then ignore SPF entirely), unknown terms and more than 10 DNS lookups. - DMARC tells receivers what to do when SPF and DKIM do not align with the From domain. A target record looks like
v=DMARC1; p=reject; rua=mailto:dmarc@example.com. Warnings coverp=none, a missingrua=,pctbelow 100, unprotected subdomains (sp=none) and duplicate records. - DKIM shows each common selector that returned a key. A DKIM warning can simply mean your provider uses a selector outside the list (see the FAQ).
- MX lists mail servers by priority. A single
0 .record is a Null MX: the domain accepts no mail, which is correct for a domain that never sends or receives email when paired withv=spf1 -allandp=reject. - MTA-STS (not scored) tells sending servers to deliver to you only over verified TLS, so an attacker on the path cannot strip encryption. It needs a TXT record at
_mta-sts.example.comand a policy file athttps://mta-sts.example.com/.well-known/mta-sts.txt. The checker fetches the policy, reads the mode (enforce,testingornone) and checks that every MX host matches one of itsmx:lines. - TLS-RPT (not scored) asks senders to email you a daily report of TLS delivery failures, for example
v=TLSRPTv1; rua=mailto:tls-reports@example.comat_smtp._tls.example.com. Set it up before moving MTA-STS to enforce.
To write or fix the records, use the Email Auth Record Builder.
Frequently asked questions
How do I check a domain's DMARC record?
Enter the domain above: the checker reads the TXT record at _dmarc.example.com and reports the policy, subdomain policy, pct and report address. From a terminal, dig +short TXT _dmarc.example.com shows the raw record.
Why does it say no DKIM record was found when my mail is signed?
DKIM keys live at <selector>._domainkey.<domain>, and selectors cannot be listed through DNS. This tool tries 22 common selectors (default, google, selector1, selector2, k1, mailgun, sendgrid and others). A custom selector will not be found. Read it from the s= tag of the DKIM-Signature header in a message you sent, for example with the Email Header Analyzer.
Is p=none enough for DMARC?
No. p=none only collects reports; spoofed mail is still delivered. Use it while you find all your legitimate senders, then move to p=quarantine and p=reject. The DMARC Report Analyzer helps read the reports.
What does "too many DNS lookups" mean for SPF?
SPF allows at most 10 mechanisms that trigger DNS lookups (include, a, mx, exists, ptr, redirect). Above that, receivers return a permanent error and SPF fails. This checker counts the top-level ones; nested includes add more. Remove unused includes or replace them with ip4:/ip6: ranges.
Does this check MTA-STS, TLS-RPT or BIMI?
MTA-STS and TLS-RPT, yes: it reads both DNS records, fetches the MTA-STS policy file and checks that your MX hosts match it. They are shown but not added to the score. BIMI is not checked. For CAA, DNSSEC and HSTS alongside DMARC and SPF, use the Domain Security Posture Scanner.