Email Security Checker
Every email security record for a domain, in one check.
Email security is four separate problems and it is easy to solve some and believe you have solved all of them. SPF says which servers may send as you. DKIM signs messages so they can be verified after relaying. DMARC ties those to the visible From address and tells receivers what to do on failure. MTA-STS and TLS-RPT protect and monitor the transport of mail sent to you. A domain can score well on three and be trivially spoofable because of the fourth.
The single most common gap is DMARC at p=none. It is published, it collects reports, and it stops nothing — receivers are told to take no action on failure. It is the correct starting point and a bad resting point, and a great many domains have been resting there for years. Moving to quarantine and then reject is what turns SPF and DKIM from telemetry into enforcement.
The second gap is transport. SPF, DKIM and DMARC all protect your outbound reputation — they stop other people forging you. None of them encrypts a single message sent to you. That is MTA-STS, and without it a network attacker can strip TLS and read inbound mail in plain text no matter how good your authentication records are.
What this tool does
Seven records at once
MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, so you see the gaps between them rather than one record at a time.
Weighted by what matters
DMARC and SPF carry the most weight because they are what a receiving server uses to reject forged mail. BIMI carries none — it is a logo.
The partial-credit cases
p=none and ~all are shown as partial rather than pass. Both are published, and neither stops anything.
Specific next steps
Each component says what is missing and why it matters, so the score resolves to something to change.
Frequently asked questions
What does this check?
MX records, SPF, DKIM at common selectors, DMARC including its policy and reporting address, MTA-STS with its policy file, TLS-RPT, and BIMI. It scores them by weight and explains what each one is missing.
How is the score calculated?
Each component has a weight reflecting what it actually prevents: DMARC 30, SPF 25, DKIM 15, MTA-STS 12, MX 10, TLS-RPT 8. A pass earns the full weight, a partial half. BIMI is reported but scores nothing, because it protects nothing.
Why is my domain marked down for SPF ending in ~all?
A soft fail asks receivers to accept the mail and mark it. That is the right setting while you are still discovering which servers send for you, and it means a forged message is likely to be delivered. The end state is -all.
Why is DKIM only "partial" when I have it configured?
Because DKIM selectors are chosen by your provider and there is no way to enumerate them from outside. The check tries common ones, so a miss means "not found at the selectors tried" rather than "not configured". Use the DKIM checker with your actual selector to confirm.
I do not send email from this domain. Do I still need these records?
Yes, and it is quick. A domain that sends no mail should publish an SPF record of v=spf1 -all and a DMARC record of p=reject. Without them, a parked or internal-only domain is a free identity for anyone who wants to send phishing that appears to come from you.
Does a good score guarantee my email arrives?
No. Authentication is necessary but deliverability also depends on sending reputation, list hygiene, content and complaint rates. This measures whether your domain is configured to resist spoofing and interception — a different question from whether your campaigns land in the inbox.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.