Email Security Check — SPF, DMARC, MX and DKIM
Check any domain for SPF, DMARC and MX configuration, discover common DKIM selectors, and get a plain reading of what is misconfigured and what it lets an attacker do.
Advertisement
Records are read live over DNS-over-HTTPS. DKIM selectors cannot be enumerated from DNS, so we probe a list of selectors used by the major providers — a negative result means those specific selectors are absent, not that DKIM is unconfigured.
Advertisement
Frequently asked
What is the single most important record here?
DMARC with a policy of quarantine or reject. SPF and DKIM only describe how mail can be authenticated; DMARC is the record that tells receiving servers what to do when authentication fails, and without it the other two have no enforcement.
My SPF record looks fine but mail still fails.
Check the lookup count. SPF permits a maximum of ten DNS-resolving mechanisms; exceeding it is a permanent error, and it is easy to exceed once several SaaS include statements are stacked.
Advertisement