Email & domain security check
Scan any domain for SPF, DKIM, DMARC, TLS, DNSSEC and blacklist problems. Get a grade, a prioritized list of issues and copy-paste fixes.
What we check
All checks run in parallel and results stream in as they finish.
Full include tree, the 10-lookup limit, void lookups and the final all qualifier.
Probes common and custom selectors, key type and size, revoked and test-mode keys.
Policy strength, alignment, reporting addresses and third-party authorization.
STARTTLS, protocol versions, ciphers, certificates, open relay, VRFY/EXPN, banners.
DNS record, HTTPS policy file, mode and that every MX is covered.
Reporting address for TLS delivery failures.
TLSA records per MX, verified against the live certificate.
Logo format (SVG Tiny PS), VMC/CMC certificate and DMARC prerequisites.
DS/DNSKEY chain of trust, algorithms and RRSIG validity per record set.
Delegation, SOA serials, open recursion, zone transfers (AXFR), CAA.
Mail server IPs and the domain against dozens of DNSBLs.
Registrar, expiry date, lock status and registrar nameservers.
Each category is scored 0–100 and weighted into one overall score. The report shows every point gained or lost.
- 45%
Email authentication
SPF · DKIM · DMARC
- 25%
Transport security
SMTP TLS · MTA-STS · TLS-RPT · DANE
- 15%
DNS hygiene
DNSSEC · nameservers · zone transfer · CAA
- 15%
Reputation
DNS blacklists · reverse DNS
Some findings cap the grade regardless of the rest: an open relay, a broken DNSSEC chain or a missing DMARC policy.
What the letter grade means.
- A 90–100 Enforced DMARC, strong TLS, no listings
- B 80–89 Solid, a few hardening steps left
- C 65–79 Spoofable or weak transport security
- D 50–64 Several important protections missing
- F 0–49 Critical gaps, e.g. open relay or no SPF
Check an IP address or domain against DNS blacklists, with reverse DNS, ASN and location.
Build valid SPF and DMARC records step by step.