Platform
Email security monitoring: SPF, DKIM, DMARC and more
Email security monitoring checks the records that stop attackers sending mail as you and reading mail sent to you. EASMLens grades every domain it attributes to your organisation, including the parked and legacy domains that are easiest to spoof, and tells you when a record changes.
Your least-watched domain is the one attackers use
Most organisations configure DMARC on their main domain and forget the rest: the old brand, the country domains, the domain registered for a campaign in 2019. Each one without an enforced policy can be used to send convincing phishing or invoice fraud in your name.
Governments have made this a requirement. New Zealand's Secure Government Email requirements, Saudi Arabia's Haseen email records and the UK's former NCSC Mail Check all point at the same records. When the NCSC retired Mail Check in March 2026, many UK organisations lost their only outside-in view of them.
How EASMLens does it
- 1
Find every domain
Domains come from discovery, so parked and legacy domains are checked alongside the main one.
- 2
Grade the records
SPF syntax and lookup limits, DKIM selectors, DMARC policy and reporting, MTA-STS policy, TLS-RPT reporting, DNSSEC signing, DANE and BIMI are checked and graded per domain.
- 3
Verify senders
You declare the services allowed to send mail as each domain, and EASMLens checks that the records actually authorise them and nothing else.
- 4
Read the path
Paste a message header and the Received chain is analysed hop by hop, showing which systems handled the message and where authentication passed or failed.
- 5
Watch for change
Record changes are detected on every scan, so a weakened DMARC policy or a broken SPF include is reported, not discovered after an incident.
What it checks
SPF
Syntax, the ten-lookup limit, overly permissive mechanisms and missing records.
DKIM
Published selectors and key strength.
DMARC
Policy (none, quarantine or reject), coverage and reporting addresses.
MTA-STS and TLS-RPT
Whether inbound mail must use TLS, and whether you receive failure reports.
DNSSEC and DANE
Whether DNS answers are signed and mail server certificates are pinned.
BIMI
Brand indicator records for supporting mail clients.
What you get
- A grade per domain with the specific records that need attention
- Declared-sender checks showing services that are authorised but missing, or present but undeclared
- Header path analysis for suspicious messages
- Alerts when a record changes or a policy weakens
Where it helps
- New Zealand
- Evidence for Secure Government Email expectations on government domains. See EASM in New Zealand.
- Saudi Arabia
- Email records expected under the Haseen requirements. See EASM in Saudi Arabia.
- United Kingdom
- An outside-in replacement for the retired NCSC Mail Check. See EASM in the UK.
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Do we need to send you our DMARC reports?
- No. EASMLens checks the published DNS records from the outside, so it works without access to your mail system or reporting mailbox.
- Why check domains we do not send email from?
- Because attackers can. A domain with no SPF record and no DMARC policy can be spoofed freely. Publishing a reject policy on non-sending domains closes that gap at almost no cost.
- What is declared-sender verification?
- You list the services allowed to send mail for a domain, such as your email platform and marketing tool. EASMLens confirms the records authorise exactly those services, catching both missing and stale entries.
- Does this replace the NCSC Mail Check service?
- It covers the same records and adds DANE, BIMI, declared senders and change alerts, for every domain attributed to you.
Related capabilities
Attack surface discovery
Find every internet-facing domain, subdomain, IP, certificate, cloud service and API attributed to you, including shadow IT nobody told security about.
Dangling DNS and subdomain takeover
Find CNAME records pointing at cloud resources that no longer exist, before someone claims the resource and serves content on your subdomain.
Certificate and website monitoring
Catch expired and expiring TLS certificates, sites still on plain HTTP and website quality issues across every web asset you own, not just the main site.