Email Security Checker

How the grade works

The checker resolves public DNS records only. It reads the SPF record on the domain, the DMARC record at _dmarc, DKIM keys at <selector>._domainkey, MTA-STS at _mta-sts, TLS-RPT at _smtp._tls, and BIMI at default._bimi. It also counts the DNS lookups that SPF evaluation needs by following every include and redirect. Results are cached for five minutes.

Grades: A+ at 95 or more, A at 85, B at 70, C at 55, D at 40, E at 20, F below 20. A domain with a null MX record does not need DKIM, MTA-STS, or TLS-RPT and receives full credit for them.

The path to p=reject

1. Inventory senders. Publish DMARC with p=none and a rua address. Aggregate reports show every service that sends as your domain.
2. Authenticate each sender. Add each service to SPF with an include and turn on DKIM signing in the service. Keep SPF under 10 lookups. Flatten or remove unused includes.
3. Enforce. Move to p=quarantine, watch reports for two weeks, then set p=reject. Add sp=reject so unused subdomains cannot be spoofed either.
4. Protect inbound mail. Publish MTA-STS with mode: enforce and TLS-RPT so sending servers require TLS to your MX hosts and tell you when it fails.

What this tool does not do

• It does not send test email or connect to your mail servers.
• It does not fetch the MTA-STS policy file, so it cannot confirm the policy mode.
• It finds DKIM keys only at the selector you enter or at 20 common selectors. A missing key at those selectors does not mean DKIM is off.
• It does not verify the SPF result for a specific sending IP.

Check the web side of the same domain with the security headers checker and the SSL checker.