Free tool
Free email security checker: SPF, DKIM, DMARC, MTA-STS and more
Enter a domain to grade the public records that stop attackers sending email in its name. The check reads public DNS, takes a few seconds, needs no sign-in, and tells you what to fix in plain English.
What this checks
The checker grades the records that decide whether someone can send email as your domain, and whether mail sent to you is protected in transit. SPF, DKIM and DMARC carry most of the score because they stop spoofing. Each result is a pass, a warning or a fail, with the fix in plain English.
- SPF
- One SPF record, how it ends (-all, ~all or other) and the 10 DNS lookup limit.
- DMARC
- The policy (none, quarantine or reject), the reporting address and whether it applies to all mail.
- DKIM
- Whether a DKIM key is published at eight common selectors, and whether it looks shorter than 2048 bits.
- MTA-STS
- Whether the domain publishes an MTA-STS record and policy file, and whether the policy is in enforce mode.
- TLS-RPT
- Whether the domain asks sending servers to report failed secure connections.
- DNSSEC
- Whether a validating resolver confirms the domain's DNS answers are signed.
- BIMI
- Whether a brand logo record is published. Shown for information; it is not a security control.
- MX
- Which mail servers receive email for the domain, if any.
Results come from public DNS records and the published MTA-STS policy file. This is a snapshot, not a full assessment, and it does not certify a domain against any standard.
Frequently asked questions
- Is this an email security scan?
- No. It reads public DNS records, the same records every mail server reads before delivering a message, plus the MTA-STS policy file a domain publishes for mail senders. No email is sent and no mail server is contacted.
- Why does it say no DKIM was found when we use DKIM?
- DKIM keys sit under selector names that cannot be listed from DNS. The checker tries eight common names. If your provider uses a different selector, DKIM can be working even though this check cannot see it.
- Do you keep the domains I check?
- No list of checked domains is kept. A result is cached for one hour, and rate limits use a one-way code in place of your IP address that expires within a day.
- What score should we aim for?
- DMARC at p=reject with SPF and DKIM passing is the main goal, because that is what stops someone sending as your domain. MTA-STS, TLS-RPT and DNSSEC then protect mail in transit and the DNS answers themselves.
- How is this different from EASMLens?
- This page checks one domain once. EASMLens finds every domain attributed to your organisation, including parked and legacy domains, grades them on every scan and alerts you when a record changes or a policy weakens.
Monitor every domain you own
One check shows one domain at one moment. EASMLens finds the domains attributed to your organisation, grades their email records on every scan and tells you when a record changes.