Email Security Checker
Check SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI for a domain and get the records to fix them.
Related tools
- MX & SMTPCheck a domain's mail servers and test SMTP connections, STARTTLS and open relay.
- Blacklist CheckerCheck whether an IP address or a domain's mail server is listed on DNS blocklists.
- Domain HealthOne check for DNS, email authentication, TLS, security headers and redirects, with a grade per area and a full report.
- DNS LookupLook up DNS records by type, including reverse (PTR) lookups for IP addresses.
About this tool
Email Security reads the records receivers use to decide whether mail from your domain is genuine: SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489), MTA-STS (RFC 8461), TLS-RPT (RFC 8460) and BIMI. It explains each finding and gives you a corrected record to copy.
SPF and DMARC records are resolved through XGM's DNS API and analysed in your browser, including every SPF include and external DMARC report authorisations. DKIM selectors, MTA-STS (with the policy file over HTTPS), TLS-RPT and BIMI are checked from the XGM server. No mail is sent and nothing is stored.
How to use it
- Enter the domain used in your From address, for example example.com.
- Read the verdict for each record: missing, monitoring only or enforced.
- Work through the findings from critical to informational and copy the suggested records.
- Publish the changes at your DNS provider, wait for the TTL to expire and run the check again.
FAQ
What does p=none do?
Receivers deliver failing mail as usual and only send reports to the rua address. Use it to learn which services send mail for your domain before enforcing a policy.
What is the difference between quarantine and reject?
With p=quarantine receivers treat failing mail as suspicious, usually by putting it in spam. With p=reject they refuse it during delivery. Reject gives the strongest protection against spoofing.
Why does SPF fail with too many DNS lookups?
RFC 7208 limits SPF evaluation to 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts. Above the limit receivers return permerror and SPF does not pass.
Can I have more than one DMARC or SPF record?
No. Receivers ignore all DMARC records when more than one is published (RFC 7489 section 6.6.3), and two SPF records are a permerror (RFC 7208 section 4.5).
How does XGM find my DKIM selector?
DKIM keys live at <selector>._domainkey.<domain> and the selector is not published anywhere else. XGM tries common selectors used by large providers; you can also enter your own from a DKIM-Signature header (the s= tag).
Read the full Email Security Checker guide