Validate your domain’s email authentication records in seconds. Check SPF, DKIM, DMARC, and DNSSEC configuration against best practices. Free, no sign-up required.
The reportedIP Email Security Checker validates a domain's SPF policy, DKIM signing keys, DMARC policy, DNSSEC chain of trust, MTA-STS transport policy, TLS reporting and BIMI logo record in one pass and returns a scored report with concrete, copy-ready recommendations.
SPF is read from the domain's TXT record including nested includes and the 10-lookup limit; DKIM probes common selector names in parallel (or the selectors you provide); DMARC is read from _dmarc.<domain>; DNSSEC verifies DS and DNSKEY records and the validation flag of a validating resolver.
MTA-STS is read from _mta-sts.<domain> and the policy file is then fetched from https://mta-sts.<domain>/.well-known/mta-sts.txt, because a record announcing a policy that senders cannot fetch protects nobody. Its mx entries are compared against the domain's real MX records: under enforce mode, a sender refuses to deliver to an MX host the policy does not list. TLS-RPT is read from _smtp._tls.<domain>; its report addresses are checked for shape, never contacted. BIMI is read from default._bimi.<domain>; the logo and certificate URLs are checked for form and reachability, the SVG itself is not parsed.
How the score is weighted: authentication counts most, because it decides whether someone else can send mail as your domain. DMARC 25 points, SPF 20, DKIM 20. Transport and infrastructure follow: DNSSEC 15, MTA-STS 12, TLS-RPT 8. Together that is 100. Only the checks you actually selected count, so deselecting one removes it from the calculation instead of scoring it zero.
BIMI is reported but carries no weight at all. It decides whether your logo appears next to your messages, which is branding with an authentication precondition, not protection. A domain with flawless SPF, DKIM, DMARC and DNSSEC is not one point less secure for having no logo, so BIMI neither lowers the score nor colours the overall verdict. Its own card still shows whether the record works, and that card will tell you when a BIMI entry is inert because DMARC is not at p=quarantine or p=reject.
A missing DKIM result can simply mean your provider uses a custom selector. Enter it manually for a definitive answer. The score is a guide, not a compliance certificate.
Email authentication is critical for protecting your domain from spoofing, phishing, and abuse. Without proper SPF, DKIM, and DMARC records, attackers can send emails that appear to come from your domain, damaging your reputation and putting your users at risk.
Our Email Security Check analyzes your domain’s DNS records to verify that all email authentication mechanisms are properly configured. We check for common misconfigurations and provide actionable recommendations to improve your email security posture.
SPF defines which mail servers are authorized to send email on behalf of your domain. It uses a DNS TXT record to list approved IP addresses and mechanisms. Without SPF, any server can claim to send email from your domain.
DKIM adds a digital signature to outgoing emails, allowing receiving servers to verify the message was not altered in transit and truly originates from your domain. DKIM uses public/private key cryptography stored in DNS.
DMARC ties SPF and DKIM together, telling receiving servers what to do when authentication fails. It provides reporting capabilities so you can monitor authentication results and protect against unauthorized use of your domain.
DNSSEC adds cryptographic signatures to DNS records, preventing DNS cache poisoning and man-in-the-middle attacks. It ensures that DNS responses are authentic and have not been tampered with during transit.
1. Enter your domain: Type any domain name to begin the security analysis.
2. Automatic DNS queries: Our tool queries multiple DNS record types including TXT records for SPF, DKIM selectors, and DMARC policies, as well as DNSSEC chain validation.
3. Policy validation: Each record is parsed and validated against RFC specifications and industry best practices.
4. Security scoring: You receive a clear pass/fail assessment for each protocol with specific recommendations to fix any issues found.
5. Actionable recommendations: Detailed guidance on how to fix misconfigurations or implement missing authentication records.
Missing SPF record: Without an SPF record, your domain has no protection against email spoofing. Add a TXT record starting with “v=spf1” that lists your authorized mail servers.
SPF too permissive (+all): An SPF record ending with “+all” allows any server to send email as your domain. Use “-all” (hard fail) or “~all” (soft fail) instead.
No DMARC policy: Without DMARC, receiving servers don’t know what to do with emails that fail SPF/DKIM checks. Start with “v=DMARC1; p=none” and gradually move to “p=quarantine” or “p=reject”.
DMARC set to p=none: While “p=none” enables monitoring, it doesn’t protect against spoofing. Transition to “p=quarantine” or “p=reject” after analyzing your DMARC reports.
Missing DKIM: Without DKIM, receiving servers cannot verify email integrity. Configure your mail server to sign outgoing messages and publish the public key in DNS.
DNSSEC not enabled: Without DNSSEC, your DNS records are vulnerable to cache poisoning attacks. Contact your DNS provider to enable DNSSEC for your domain.
What is email authentication?
Email authentication is a set of techniques (SPF, DKIM, DMARC) that verify the sender of an email is who they claim to be. These DNS-based records help prevent phishing, spoofing, and improve email deliverability.
Do I need all three protocols (SPF, DKIM, DMARC)?
Yes. SPF alone is not enough because it can be bypassed. DKIM alone doesn’t tell receivers what to do on failure. DMARC ties them together and provides a policy for handling unauthenticated messages. All three work together for comprehensive protection.
Will implementing these records affect my email deliverability?
Properly configured email authentication improves deliverability. Major providers like Google and Microsoft require SPF and DKIM, and favor domains with DMARC policies. Start with DMARC p=none to monitor before enforcing.
How long do changes take to propagate?
DNS changes typically propagate within 1-48 hours depending on the TTL (Time to Live) values of your records. Most changes are visible within a few hours.
What is DNSSEC and do I need it?
DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records. While not required for email authentication, it prevents DNS spoofing attacks that could redirect your email traffic. It is increasingly recommended as a security best practice.
A correct SPF record does not help if the sending IP address sits on a blocklist. Check that address against 15 lists at once.
Reject known attackers before the message body is transferred, the way mail servers already query Spamhaus.
DNS changes need time to spread across the internet. Watch the propagation across 76 resolvers before you start debugging.