Check how well a domain is protected against email spoofing. One click tests SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, explains every problem found and tells you how to fix it.
// public DNS records only · results cached for 5 minutes
Most phishing still relies on spoofing a trusted domain. Without a strict SPF, valid DKIM signatures and a DMARC policy at quarantine or reject, anyone can send mail that appears to come from you. This checker shows in seconds whether a domain is protected, and what is missing, so admins can fix their zone and analysts can judge a sender domain.
Enter a domain, or paste an email address or URL: the domain is extracted.
Read the grade, then open each check for its records and findings.
Apply the suggested fixes in your DNS zone and run the check again.
It queries the public DNS of a domain and checks its MX servers, SPF record (syntax, the 10 DNS lookup limit, the final all qualifier), DMARC policy, DKIM public keys on common selectors, MTA-STS policy, TLS-RPT reporting and BIMI logo record. Each check gets a pass, warning or fail with a fix, and the domain gets an overall grade.
SPF lists the servers allowed to send mail for a domain. DKIM signs each message with a key published in DNS, so receivers can verify it was not altered. DMARC ties both to the visible From address and tells receivers what to do when they fail (none, quarantine or reject), and where to send reports.
RFC 7208 limits SPF evaluation to 10 DNS-querying terms (include, a, mx, ptr, exists, redirect), nested includes included. Above that, receivers return a permanent error and SPF fails for every message. The checker follows the whole include tree and counts them for you.
DNS cannot list DKIM selectors, so the checker tries the selectors used by common providers. If yours uses a custom one, open a message sent by the domain, read the s= tag of its DKIM-Signature header (the EML Analyzer shows it) and enter it in the custom selectors field.
No. p=none only collects reports: spoofed mail is still delivered. Use it to find all your legitimate senders, then move to p=quarantine and p=reject so receivers block mail that impersonates your domain.
Results are kept in memory for 5 minutes to avoid repeating the same DNS queries, then discarded. Only public DNS records and the public MTA-STS policy file are read.
