Email Security Checker
How it works
Public DNS lookups only. The checker reads SPF on the domain, DMARC at _dmarc, DKIM at the selector you enter or 20 common ones, MTA-STS, TLS-RPT, and BIMI. It follows every SPF include to count lookups. No mail is sent. Results are cached for five minutes.
| Check | Points | Full credit |
|---|---|---|
| DMARC | 25 | p=reject with rua reporting, 100% of mail |
| SPF | 20 | One record, -all, 10 lookups or fewer |
| DKIM | 15 | RSA 2048 or Ed25519 key at a selector |
| MTA-STS | 10 | v=STSv1 record published |
| MX | 5 | Mail servers present, or a null MX |
| TLS-RPT | 5 | v=TLSRPTv1 record with rua |
| BIMI | 0 | Informational |
Frequently asked questions
Keep exploring
- Subdomain Finder
Discover the subdomains of any domain from passive sources
Open tool - SSL/TLS Checker
Check a certificate, its expiry, chain, and TLS protocol support
Open tool - Security Headers Checker
Grade a site's HTTP security headers and get the fixes
Open tool - CVE Database
Severity, EPSS, and KEV status for every CVE
Open tool
Start testing in minutes
Connect your GitHub repos and domains, and get fully set up in a few clicks.