Email security test: SPF, DKIM and DMARC
Reads your domain’s SPF, DKIM and DMARC records, shows whether someone else could send email on your behalf, and explains how to tighten your records.
What does this test do?
An email security check reads your domain's SPF, DKIM and DMARC records in DNS to tell you whether someone else can send spoofed email in your name. It also checks MTA-STS, TLS-RPT and BIMI, and whether your SPF includes point at unregistered domains. It sends no email and never connects to your mail server.
Sources and method
Reads public DNS records, the MTA-STS policy file if there is one (one request) and the domain registration of SPF targets (RDAP). It doesn’t send email or connect to your mail server.
What it checks and how to fix it
Every item the test looks at, why it matters and what to do if it is missing. The result screen lists only the gaps found on your site.
Mail servers (MX)
Shows which servers accept incoming mail for your domain.
How to fix it
Informational only.
SPF record
Declares which servers may send email on behalf of your domain. Without it, receiving servers can’t tell spoofed mail apart.
How to fix it
Combine every sending service you use into a single SPF record.
alanadiniz.com. TXT "v=spf1 include:_spf.google.com -all"SPF terminator
The ‘all’ at the end of the record decides what happens to servers that aren’t on the list. ?all and +all provide no protection.
How to fix it
Use -all if you’re sure you’ve listed every sender; if not, use ~all during the transition.
SPF DNS lookup limit
SPF allows at most 10 DNS lookups. If the limit is exceeded, the whole record is treated as invalid and your protection silently disappears.
How to fix it
Remove unused includes and, if needed, replace them with fixed IP ranges.
SPF include target unregistered
An include:/redirect= in your SPF record trusts another domain. If that domain’s registration lapses and is free again, whoever registers it can send SPF-valid mail as you (phishing, fraud). A disused provider’s include lingers for years.
How to fix it
Remove include:/redirect= entries of providers you no longer use. Delete any target that looks unregistered immediately; if one is expiring soon, confirm with the provider.
alanadiniz.com. TXT "v=spf1 include:_spf.google.com include:eski-saglayici.example -all"DKIM signature
Cryptographically signs outgoing mail, proving that the content wasn’t altered in transit and really came from you.
How to fix it
Turn on DKIM in your email provider’s dashboard and add the record it gives you to DNS. If you know the selector name but the record wasn’t found, check that the record is published.
google._domainkey.alanadiniz.com. TXT "v=DKIM1; k=rsa; p=MIIBIjAN…"DMARC record
Tells receiving servers what to do with mail that fails SPF and DKIM, and has reports sent to you. This is the layer that actually keeps your domain from being used in phishing attacks.
How to fix it
Start with p=none to collect reports; once legitimate senders are fixed, move to quarantine and finally to reject.
_dmarc.alanadiniz.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@alanadiniz.com"DMARC policy
p=none only monitors; it doesn’t stop spoofed mail. Protection starts with quarantine or reject.
How to fix it
Once no legitimate senders are left failing in the reports, tighten the policy step by step.
_dmarc.alanadiniz.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@alanadiniz.com"MTA-STS
Requires mail sent to you to be encrypted in transit between servers, so the connection can’t be downgraded to unencrypted.
How to fix it
Publish a policy file and add an _mta-sts record to DNS.
MTA-STS policy file
The DNS record alone does nothing; sending servers read the policy from mta-sts.yourdomain.com. Without the file, or with mode: testing, unencrypted delivery is still accepted.
How to fix it
Publish the policy file over HTTPS, list your MX hosts in mx: lines and switch to mode: enforce once reports are clean.
version: STSv1
mode: enforce
mx: mail.alanadiniz.com
max_age: 604800TLS-RPT
When sending servers cannot connect to you encrypted (certificate error, downgrade attempt), they report it to the TLS-RPT address. Without the record you never hear about MTA-STS problems.
How to fix it
Put the report address in the _smtp._tls record.
_smtp._tls.alanadiniz.com. TXT "v=TLSRPTv1; rua=mailto:tlsrpt@alanadiniz.com"DKIM key length
A 1024-bit RSA key is approaching the breakable range; 512 bits has long been broken. If the key is broken, an attacker sends validly signed mail in your name.
How to fix it
Rotate selectors to 2048-bit RSA (or Ed25519) keys; remove the old selector from DNS after a while.
DMARC enforcement rate (pct)
With pct below 100 the policy applies to only part of the mail; a share of forged mail is still delivered. Useful during rollout, not a permanent setting.
How to fix it
Once reports are clean, remove the pct tag or set it to 100.
BIMI
Informational: BIMI shows your logo in supporting mail clients for domains that enforce DMARC (quarantine/reject); forged mail appears without the logo.
How to fix it
After moving DMARC to reject, publish the default._bimi record with an SVG logo and (for Gmail) a verified mark certificate.
DNSSEC
Verifies that your DNS responses weren’t altered in transit. Since all of the records above rely on DNS, it protects the layer underneath.
How to fix it
You can turn it on in your domain registrar’s and DNS provider’s dashboards.
Quick checks
One question, one answer: is my SPF record right, is the site down, when does my certificate expire? They don't use your daily scan allowance and need no account.
SPF record check
SPF record checker and validator
DKIM record check
DKIM checker: key and selector lookup
DMARC record check
DMARC checker and record validator
MX lookup
MX lookup: check mail server records
Frequently asked questions
Is DMARC p=none enough?
What is the SPF 10 DNS lookup limit?
Is it free? Do I need an account?
Is it safe to run on my site?
Primary sources
Other tests
SSL/TLS check
Shows whether your certificate is valid, when it expires and whether the connection uses current encryption.
Security headers test
Grades the security settings your site sends to browsers (HSTS, CSP, cookie flags) and lists what is missing.
DNS and domain security
Checks when your domain expires, whether the transfer lock is on and whether your DNS records are protected (DNSSEC, CAA).
Cookie and consent check
Shows whether trackers such as Google Analytics or Meta Pixel load before the visitor consents.
JavaScript library vulnerabilities
Finds jQuery, Bootstrap and other libraries on your site, flags versions with known vulnerabilities and names the safe one.
Subdomain finder
Finds your subdomains and flags forgotten records that someone else could take over.
Attack surface scan
Collects what an attacker can learn about you from public sources: subdomains, the software you run, DNS.
Other free scanners
WP Lens: WordPress scan
Matches the versions of WordPress core, plugins and themes against known vulnerabilities.
Port scan
Finds the ports your server exposes and their service versions, and matches them against known vulnerabilities. Runs only with your confirmation.
Dependency scan (SBOM)
Matches the dependencies in your package-lock, yarn.lock or SBOM file against known vulnerabilities.
Banner to CVE
Paste a service version line and see the known vulnerabilities of that version. No scanning.