Email Security
SPF, DKIM, DMARC, MX, BIMI, MTA-STS and TLS-RPT in one scored overview.
Enter a target
e.g. example.com — press ⏎ / ⌘⏎
What is Email Security?
Email Security audits MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI in one query and produces a weighted 0-100 score. Weights follow blast radius: DMARC and SPF decide whether your domain can be spoofed at all, while BIMI is cosmetic.
Each check runs the same engine as its dedicated tool, so the overview and the deep dive can never disagree. Findings are listed inline, with a link through to the full analysis.
The three most common problems: a DMARC policy left at p=none, an SPF chain exceeding the 10 DNS lookup limit, and a DKIM key left in testing mode (t=y). All three leave the record looking present while the protection does nothing.
Frequently Asked Questions
9 questionsWhat's the difference between SPF, DKIM and DMARC?
SPF lists which servers may send mail for your domain; DKIM cryptographically signs each message; DMARC defines what receivers should do with failures (none/quarantine/reject) and where to send reports. Together they stop spoofing.
DKIM shows "not found" but I use DKIM?
The tool probes common selectors (default, google, selector1-2, k1, mail). If your provider uses a custom selector the record exists but won't appear here — check your provider's dashboard for the selector name.
Which DMARC policy should I use?
Start with p=none and watch the reports (rua) for a few weeks; once legitimate sources pass SPF/DKIM, move to p=quarantine, then p=reject. Jumping straight to reject can drop legitimate mail.
Does having all three stop spoofing entirely?
Exact-domain spoofing is largely blocked. Phishing via lookalike domains (typosquatting) can continue, so user awareness and brand monitoring still matter.
What score should I aim for?
It depends on your setup. Reaching 100 requires BIMI and MTA-STS, which are optional for most organisations. The practical target is MX, SPF, DKIM and DMARC all green — that's the core that stops your domain being spoofed. The other three are improvements.
In what order should I fix things?
Start with SPF (fastest win), enable DKIM in your provider's panel, then publish DMARC at p=none and collect two weeks of reports. Only raise the policy once reports are clean. Leave MTA-STS and BIMI for last; both depend on DMARC being settled.
Why don't results update immediately after a change?
Results are cached for five minutes, and the DNS records have their own TTL. Wait a few minutes and re-run.
Should I check subdomains separately?
Yes. SPF and DKIM are not inherited — every sending subdomain needs its own records. DMARC is inherited, which is why setting sp= deliberately matters.
How do I protect a domain that sends no mail?
Three records suffice: a null MX ("0 ."), a reject-only SPF (v=spf1 -all) and a strict DMARC (p=reject). That combination keeps parked or web-only domains from being used in spoofed mail.