Discuss your project

TOOLBOX · SECURITY CHECK

Check Email Security.

Can someone forge emails in your name? Enter a domain and see whether SPF, DKIM and DMARC really prevent it, with DNS records to copy.

The bot check protects the toolbox against automated abuse.

We query public DNS records of your domain (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI) and, if set up, read the MTA-STS policy over HTTPS. We send no emails and do not connect to your mail server. We do not store results permanently.

WHY IT MATTERS

Your Sender.
Not the Attackers’.

Technically, anyone can enter any address in the sender field of an email. Only SPF, DKIM and DMARC give receiving servers the means to recognize and reject forgeries of your domain. All three are records in the DNS of your domain.

  • Spoofing

    A forged mail with your domain as the sender looks like a genuine one in the mailbox. With DMARC enforcement (quarantine or reject), recipients should sort out or reject such mails instead of delivering them.

  • CEO Fraud and Invoice Fraud

    Mails in the name of management or with changed bank details are meant to trigger transfers (business email compromise). DMARC prevents attackers from using exactly your domain for this. It does not help against look-alike domains; training and clear approvals do.

  • Deliverability

    Since 1 February 2024, Google requires SPF or DKIM from all senders to Gmail accounts, and SPF, DKIM and DMARC from bulk senders (around 5,000 mails per day and more) (Google email sender guidelines). Since November 2025, Gmail increasingly rejects non-compliant mails (Google FAQ). Yahoo has set comparable requirements since February 2024 (Yahoo Sender Best Practices).

WHAT IS CHECKED

Three Records Against Spoofing.
Two for Transport.

The grade follows the protection against forged senders. A domain without valid DMARC reaches C at best, even if SPF and DKIM are correct.

  • 01

    DMARC

    Links SPF and DKIM to the visible sender address and tells recipients what happens to forgeries: none (only observe), quarantine or reject, plus the test mode t=y. We check against the current standard RFC 9989, with subdomains (sp, np) and reports (rua).

  • 02

    SPF

    Which servers may send for your domain? We check for exactly one valid record and its terminator (-all, ~all, ?all, +all), and count the DNS lookups across all include levels. More than 10 make SPF ineffective.

  • 03

    DKIM

    A digital signature of every outgoing mail. We look for keys under the selectors of large providers and check the key length: under 1024 bits invalid, 2048 bits recommended.

  • 04

    Mail Servers and Null MX

    Does the domain receive email? Domains without email should declare this with a null MX and still set SPF -all and DMARC p=reject. The German BSI also recommends this for unused domains (TR-03182).

  • 05

    MTA-STS and TLS-RPT

    MTA-STS requires sending servers to use an encrypted connection with a valid certificate. TLS-RPT sends you reports when this fails.

  • 06

    BIMI and DANE

    For information: BIMI shows your logo in some mailboxes, DANE secures encryption through DNSSEC. Neither counts toward the grade.

STEP BY STEP

From p=none
to p=reject.

Setting DMARC to reject right away can hit legitimate mails, for example from the newsletter service or web shop. The safe way is in stages, as the DMARC standard RFC 9989 describes and as Microsoft and Google also recommend.

  1. 01

    Record All Senders

    Note every service that sends with your domain: the mailbox (for example Exchange Online), newsletter, CRM, accounting, web shop, scanners and printers.

  2. 02

    SPF and DKIM for Every Service

    Add every service to the SPF record and stay at 10 DNS lookups at most. Activate DKIM in every service that offers it: anyone who later sets p=reject must sign with DKIM, because SPF fails with forwarding (RFC 9989, Section 7.4).

  3. 03

    Observe with p=none

    Publish v=DMARC1; p=none; rua=mailto:… and evaluate the reports for at least a month (RFC 9989, Section 7.4). Every legitimate sender must pass SPF or DKIM aligned with your domain.

  4. 04

    Enforce with p=quarantine

    When the reports are clean, switch to quarantine for an equally long period and compare the results. For testing there is t=y: recipients then apply the policy one level weaker. The former pct has been dropped since RFC 9989.

  5. 05

    Goal: p=reject

    When all legitimate senders pass, switch to reject and keep an eye on the reports. If your users write to mailing lists on the internet, RFC 9989 advises against p=reject; anyone who sets it anyway should point out restrictions with mailing lists to the users (Section 7.4). New services always go into SPF and DKIM first.

QUESTIONS

Good to Know.

What does the email security check test?

It queries the public DNS records of your domain: mail servers (MX), SPF including all included records and the number of DNS lookups, DMARC with policy, subdomains and report address, DKIM keys under common selectors with key length, MTA-STS with policy, TLS-RPT and, for information, BIMI and DANE.

Why does the check not find my DKIM key?

DKIM keys live under a freely chosen name (selector), for example selector1._domainkey.your-domain.com. These names cannot be listed through DNS. We query the selectors that large providers prescribe. If your service uses a different name, we do not find the key and report this as a note, not as an error. You can see the selector in the header of every sent mail under “DKIM-Signature: … s=…”.

Is SPF not enough?

No. SPF only checks the technical sender address (MAIL FROM, visible in the header as Return-Path), not the address recipients see in the mailbox. Only DMARC requires SPF or DKIM to match the visible sender domain and tells recipients what should happen with a forgery (RFC 9989, Section 4.4). Without DMARC, spoofing your domain remains possible.

How is the grade calculated?

Every check has a weight, DMARC the largest. Passed counts in full, a warning counts half, a critical finding counts nothing. This gives a score from 0 to 100 and the grade A+ to F. Without valid DMARC, C is the best possible grade, and the same applies with +all in the SPF record. A+ is only possible without a critical finding. Information such as BIMI and DANE does not count.

Does the check send emails or store my domain?

No. It only reads public DNS records and, if set up, the public MTA-STS policy over HTTPS. It does not connect to your mail server and sends no mails. The result stays in memory for five minutes so that repeated requests do not query again, and is gone afterwards.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss Email Protection